From f1051a2d445c680caade0321163dac88f084c130 Mon Sep 17 00:00:00 2001 From: Peter Amstutz Date: Tue, 17 Sep 2019 13:28:41 -0400 Subject: [PATCH] 15531: Fix remote token validate to use RemoteHosts.*.Insecure Arvados-DCO-1.1-Signed-off-by: Peter Amstutz --- services/api/app/models/api_client_authorization.rb | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/services/api/app/models/api_client_authorization.rb b/services/api/app/models/api_client_authorization.rb index 55db16a4b5..e84a3d2187 100644 --- a/services/api/app/models/api_client_authorization.rb +++ b/services/api/app/models/api_client_authorization.rb @@ -92,9 +92,11 @@ class ApiClientAuthorization < ArvadosModel uuid_prefix+".arvadosapi.com") end - def self.make_http_client + def self.make_http_client(uuid_prefix:) clnt = HTTPClient.new - if Rails.configuration.TLS.Insecure + + if uuid_prefix && (Rails.configuration.RemoteClusters[uuid_prefix].andand.Insecure || + Rails.configuration.RemoteClusters['*'].andand.Insecure) clnt.ssl_config.verify_mode = OpenSSL::SSL::VERIFY_NONE else # Use system CA certificates @@ -167,7 +169,7 @@ class ApiClientAuthorization < ArvadosModel # by a remote cluster when the token absent or expired in our # database. To begin, we need to ask the cluster that issued # the token to [re]validate it. - clnt = ApiClientAuthorization.make_http_client + clnt = ApiClientAuthorization.make_http_client(uuid_prefix: token_uuid_prefix) host = remote_host(uuid_prefix: token_uuid_prefix) if !host -- 2.30.2