3.3. Using OAuth Authentication

As an alternative to basic authentication, limited OAuth 1.0 authentication is supported in the API (this is sometimes referred to as 1-legged OAuth in version 1.0a of the protocol).

3.3.1. Configuring OAuth

OAuth is enabled by default in Satellite 6.2. The configuration settings are stored in the /etc/foreman/settings.yaml configuration file and can be viewed in the web UI by going to AdministerSettingsAuth. The OAuth consumer key is the token to be used by all OAuth clients. Certain values in the web UI cannot be changed. These values can only be changed by running the satellite-installer script again with the new options. Note that any manual changes to the file will be lost when upgrading. Enter the following command to see all the OAuth related installer options:
# satellite-installer --full-help | grep oauth
If you want all API requests made using OAuth to be authorized as the built-in anonymous API administrator account, then keep OAuth map users set to false in the /etc/foreman/settings.yaml file. If you want to specify the user under which the request is made, change this configuration option to true. This allows clients to send a FOREMAN-USER header with the login of an existing Foreman user.


The header is not signed in an OAuth request, it can therefore be forged. Anyone with valid consumer key can impersonate any Foreman user.