[chef] Re: retrieving public keys of knife users

[Alex Howells < >]

On 15 August 2012 15:37, Alex Howells 
<
 >
 wrote:
> On 15 August 2012 15:15, Alex Howells 
> <
 >
>  wrote:
>> But the plot thickens --
>>
>> chef > x = 
>> Chef::REST.new(Chef::Config[:chef_server_url]).get_rest("clients/baa")
>> [Wed, 15 Aug 2012 10:13:11 -0400] INFO: HTTP Request Returned 403
>> Forbidden: You are not the correct node (auth_user name: foo,
>> params[:id]: baa), or are not an API administrator (admin: false).
>
> It doesn't appear that certain attributes of a client are public vs.
> private - the situation is more "Are you the client concerned, if so,
> you can load your data!" vs. "DENIED!" (with admin being the only way
> around it).
>
>     
> https://github.com/opscode/chef/blob/master/chef-server-api/config/router.rb#L51
>     
> https://github.com/opscode/chef/blob/master/chef-server-api/app/controllers/application.rb#L80
>     
> https://github.com/opscode/chef/blob/master/chef-server-api/app/controllers/clients.rb#L28
>
> Things might be different with OPC or OHC, not sure, I have been
> testing things against OSCS.
>
> With a client that is an admin -
>
>     Ohai2u 
> 
 
>     chef > x = 
> Chef::REST.new(Chef::Config[:chef_server_url]).get_rest("clients/baa")
>      => client[baa]
>
> But that's no surprise really :-)

If you particularly want this fixed, the patch is fairly trivial:

    https://gist.github.com/3360740

Then you can:

chef > x = 
Chef::REST.new(Chef::Config[:chef_server_url]).get_rest("clients/baa/key")
 => {"name"=>"baa", "public_key"=>"-----BEGIN RSA PUBLIC
KEY-----\nMIIBCgKCAQEAx4Hzbue5tTQIGRgFNsi0elgbD0UBjo0j279WL0f5pt5rlbHOqs71\nySjAyX42cM7o1ltw6/BiTAPv3iIAY08UuiubqUNx1x32m7Y7gFa5B8BVJZCqlPEd\njeqpE4JaSBbFEhvy14FnLsf+mwRxdQtIqes+6NpL2vU0WDFvwRTOdKW1GSGY41SD\nuxFMitphJ380SEUYfriZbTk3qQQwgNBpJ/PVeSzJVz8sgB1XSfG4MQEbf/LeeyvY\njTYhe1sq1nH8qcqec3Byfoo+YkZiU3pPvRMTvbq89s2o/XQPCdaYlFvxbsmyn/yK\nrPzTBLd1NuIkkItNMhU2VmYodAUB/+DLsQIDAQAB\n-----END
RSA PUBLIC KEY-----\n"}

I can't see how exposing the public key of a client poses any
significant danger :-)

Hope this helps,
 -Alex