verifySsl: false in job config has no effect — login connector hardcodes verify_ssl=True

[pmateos-cisco]

Version: v1.8.0 (Windows executable build)

Description:

Setting "verifySsl": false on a controller entry in a job JSON file does not disable TLS certificate verification during login. The login call still fails with SSLCertVerificationError even when the flag is set to false.

Steps to reproduce:

1. Configure a job with a controller whose HTTPS certificate cannot be verified (e.g. signed by an internal/private CA not in CAT's bundled trust store), with "ssl": true and "verifySsl": false.
2. Run the job.
3. Observe the login step still fails with a certificate verification error, identical to what's produced when verifySsl is true.

Actual error:

backend.api.appd.AppDController.ApiError: Cannot connect to host <controller-host>:8181 ssl:True 
[SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: 
unable to get local issuer certificate (_ssl.c:1000)')]

Expected behavior: With verifySsl: false, TLS certificate validation should be skipped for that controller's connection, same as documented/intended by the config option.

Root cause:

In backend/core/Engine.py, the verifySsl value is correctly read from the job config and passed into AuthMethod:

verifySsl=controller.get("verifySsl", True),

But in backend/api/appd/AuthMethod.py, the value is stored on self.verifySSL but never actually used. The aiohttp.TCPConnector used for the login session hardcodes the flag instead:

connector = aiohttp.TCPConnector(
    limit=AsyncioUtils.concurrentConnections, verify_ssl=True)

So certificate verification is always enforced for this connector regardless of the job's verifySsl setting.

Suggested fix:

connector = aiohttp.TCPConnector(
    limit=AsyncioUtils.concurrentConnections, verify_ssl=self.verifySSL)

(self.verifySSL is already set from the constructor argument a few lines above — it just isn't threaded through to the connector.)