[ovirt-users] Disable auth basic in API

[Juan Hernandez]

On 04/11/2014 11:28 PM, Jose Manuel Marquez Alhambra wrote:
> Hi,
> 
> I’m testing a connection broker that uses oVirt's API. At the moment, the connection broker doesn’t work because it doesn’t send the basic authentication to oVirt's API. I contacted the developers and they're investigating the error. While they solve the error, I would like to continue testing the connection broker. Is there any way to disable auth basic in oVirt's API?
> 
> I’m using it in a testing environment (oVirt 3.4 at CentOS 6), so I’m not worried about security risks.
> 
> Thank you.
> 
> Regards,
> 
> Jose


Disabling authentication is very bad practice, but if you really need to
you can use the web server configuration to automatically add the
required "Authorization" header:

1. Compute the basic authentication token from your user name and
password. For example, if your password if your user is "admin at internal"
and your possword is "abcdefg":

# echo -n admin at internal:abcdefg | base64
YWRtaW5AaW50ZXJuYWw6YWJjZGVmZw==

2. Use the mod_headers module to append the authorization header to all
the requests directed to the RESTAPI, creating a file
disable-restapi-auth.conf in the /etc/httpd/conf.d directory, with the
following content:

<Location /ovirt-engine/api>
  RequestHeader set Authorization "Basic YWRtaW5AaW50ZXJuYWw6YWJjZGVmZw=="
</Location>

Make sure that this file is readable only by root, as it contains your
password:

# chmod u=r,g=,o= /etc/httpd/conf.d/disable-restapi-auth.conf

3. Restart the web server:

# service httpd restart

To make this a little bit more secure I would suggest to allow this
unauthenticated access available only to certain client IP addresses.
For example:

<Location /ovirt-engine/api>
  SetEnvIf Remote_Addr 192\.168\.122\.1 Disable_Auth
  RequestHeader set Authorization "Basic
YWRtaW5AaW50ZXJuYWw6cmVkaGF0MTIz" env=Disable_Auth
</Location>

As I said this is a very bad setting from a security point of view, so
remember to revert it as soon as the broker developers fix the error.

-- 
Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, planta
3ºD, 28016 Madrid, Spain
Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 - Red Hat S.L.