Skip to content

Commit

Permalink
Check if the Authorization header for Basic Authentication is valid
Browse files Browse the repository at this point in the history
If the header is not valid, DRF returns None when calling the
authenticate() method. This can cause troubles when users are
leveraging the remote authentication because Pulp thinks they
are anonymous users. In the end, authorized users cannot
push or pull content from Pulp. This affects only admin users
in scenarios where the token authentication is disabled.

closes #1577

(cherry picked from commit b1c5d70)
  • Loading branch information
lubosmj authored and mdellweg committed Dec 4, 2024
1 parent 5672378 commit 32bcee5
Show file tree
Hide file tree
Showing 2 changed files with 1 addition and 3 deletions.
1 change: 1 addition & 0 deletions CHANGES/1577.bugfix
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fixed a bug that disallowed users from leveraging the remote authentication.
3 changes: 0 additions & 3 deletions pulp_container/app/token_verification.py
Original file line number Diff line number Diff line change
Expand Up @@ -74,9 +74,6 @@ def authenticate(self, request):
If basic authentication could not success, remote webserver authentication is considered.
"""
if request.headers.get("Authorization") == "Basic Og==":
return (AnonymousUser, None)

try:
user = super().authenticate(request)
except AuthenticationFailed:
Expand Down

0 comments on commit 32bcee5

Please sign in to comment.