Let me know if you need any additional logs/testing.

Jason Hansen wrote:

Let me know if you need any additional logs/testing.

Can you describe how you run your puppetmaster (ie webrick, mongrel + apache, or anything else…)?

Basically the error you are seeing is that the master denies access to the plugins because your client is not authenticated (ie the master is not aware this client connection has been authenticated). In 0.25 we introduced an authorization system which installs sane defaults if no auth.conf file are found. It can happen you’re running a setup for which those sane rules are not sane anymore.

Jason Hansen wrote:

Brice Figureau wrote:

Can you describe how you run your puppetmaster (ie webrick, mongrel + apache, or anything else…)?

Basically the error you are seeing is that the master denies access to the plugins because your client is not authenticated (ie the master is not aware this client connection has been authenticated). In 0.25 we introduced an authorization system which installs sane defaults if no auth.conf file are found. It can happen you’re running a setup for which those sane rules are not sane anymore.

The production server is apache + passenger (2.2.5). I have the same problem while running with webrick, which produced the logs and traces attached to this ticket.

Authentication does seem to be the problem, if I change entries in auth.conf to ‘auth any’ the puppet client is able to proceed further.

I’ve attached the auth.conf file that I’m using (which is very close to the shipped auth.conf example). The only modification was the addition of: […]

While I was attempting to track down this permissions issue.

I could reproduce the issue and it is what I thought: permissions and shipped auth.conf is really fine. It’s just that this specific client fails to authenticate to the server because it lacks the $ssldir/certs/ca.pem file.

To me it’s the exact same issue as #2617, and the exact same one that has been reported to puppet-user several times.

Steps to reproduce:

checkout 0.24.8¶

launch the master once in a fresh env so that it creates its ssldir: ruby bin/puppetmasterd —debug —trace —no-daemonize —confdir /tmp/master —vardir /tmp/master —certname localhost¶

kill it (CTRL-C)¶

checkout 0.25.0¶

relaunch the master in this env: ruby sbin/puppetmasterd —debug —trace —no-daemonize —confdir /tmp/master —vardir /tmp/master —certname localhost¶

open a new term, in the same checkout, launch a client: sbin/puppetd —test —debug —trace —confdir /tmp/client4 —vardir /tmp/client4 —fqdn pouet3.daysofwonder.com —server localhost¶

it sends its CSR¶

sign the CSR and generate the cert: sbin/puppetca —vardir /tmp/master —confdir /tmp/master —sign pouet3.daysofwonder.com¶

relaunch the client: sbin/puppetd —test —debug —trace —confdir /tmp/client4 —vardir /tmp/client4 —fqdn pouet3.daysofwonder.com —server localhost¶

observe it says: “warning: SSL cert won’t be verified…” this means the Http client has not been initialized with a proper client cert.¶

check that there is no ca.pem in /tmp/client4/ssl/certs¶

Now, let’s try to see why this ca.pem file is not there…

Exact same problem here, fresh installs busted but upgraded ones are fine.

Missing ca.pem on the client, if I copy it in by hand it all works fine.