<div dir="ltr"><div>BZ994604 (<a href="https://bugzilla.redhat.com/show_bug.cgi?id=994604">https://bugzilla.redhat.com/show_bug.cgi?id=994604</a>) has been opened.<br></div>- DHC<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Wed, Aug 7, 2013 at 5:35 AM, Itamar Heim <span dir="ltr"><<a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5">On 08/07/2013 12:10 AM, Dead Horse wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
I have found some steps to reproduce this easily.<br>
<br>
Start the engine bound to an AD for authentication<br>
log in to the user portal as an AD user which has been granted a Role (I<br>
used PowerUserRole)<br>
<br>
Result: Login will succeed<br>
Data from engine.log:<br>
2013-08-06 15:54:10,088 INFO<br>
[org.ovirt.engine.core.bll.<u></u>LoginUserCommand] (ajp--127.0.0.1-8702-10)<br>
Running command: LoginUserCommand internal: false.<br>
2013-08-06 15:54:10,139 INFO<br>
[org.ovirt.engine.core.dal.<u></u>dbbroker.auditloghandling.<u></u>AuditLogDirector]<br>
(ajp--127.0.0.1-8702-10) Correlation ID: 23c4709, Call Stack: null,<br>
Custom Event ID: -1, Message: User ovirttest logged in.<br>
<br>
log out of the user portal<br>
Result: log out succeeds<br>
Data from engine.log:<br>
2013-08-06 15:54:12,448 INFO<br>
[org.ovirt.engine.core.bll.<u></u>LogoutUserCommand] (ajp--127.0.0.1-8702-2)<br>
Running command: LogoutUserCommand internal: false.<br>
2013-08-06 15:54:12,474 INFO<br>
[org.ovirt.engine.core.dal.<u></u>dbbroker.auditloghandling.<u></u>AuditLogDirector]<br>
(ajp--127.0.0.1-8702-2) Correlation ID: 52a89e7d, Call Stack: null,<br>
Custom Event ID: -1, Message: User ovirttest logged out.<br>
<br>
As the same user log in to the user portal again but this purposely<br>
input the wrong password.<br>
Result: log in will fail<br>
Data from engine.log:<br>
2013-08-06 15:54:20,830 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>GSSAPIDirContextAuthentication<u></u>Strategy]<br>
(ajp--127.0.0.1-8702-7) Kerberos error: Pre-authentication information<br>
was invalid (24)<br>
2013-08-06 15:54:20,832 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>GSSAPIDirContextAuthentication<u></u>Strategy]<br>
(ajp--127.0.0.1-8702-7) Authentication Failed. Please verify the<br>
username and password.<br>
2013-08-06 15:54:20,843 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.DirectorySearcher]<br>
(ajp--127.0.0.1-8702-7) Failed ldap search server<br></div></div>
LDAP://<a href="http://foodc02.foo.test.com:389" target="_blank">foodc02.foo.test.com:<u></u>389</a> <<a href="http://foodc02.foo.test.com:389" target="_blank">http://foodc02.foo.test.com:<u></u>389</a>> using<br>
user <a href="mailto:ovirttest@FOO.TEST.COM" target="_blank">ovirttest@FOO.TEST.COM</a> <mailto:<a href="mailto:ovirttest@FOO.TEST.COM" target="_blank">ovirttest@FOO.TEST.COM</a><u></u>> due to<div class="im"><br>
Authentication Failed. Please verify the username and password.. We<br>
should not try the next server<br>
2013-08-06 15:54:20,850 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>GSSAPIDirContextAuthentication<u></u>Strategy]<br>
(ajp--127.0.0.1-8702-7) Kerberos error: Pre-authentication information<br>
was invalid (24)<br>
2013-08-06 15:54:20,851 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>GSSAPIDirContextAuthentication<u></u>Strategy]<br>
(ajp--127.0.0.1-8702-7) Authentication Failed. Please verify the<br>
username and password.<br>
2013-08-06 15:54:20,852 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.DirectorySearcher]<br>
(ajp--127.0.0.1-8702-7) Failed ldap search server<br></div>
LDAP://<a href="http://foodc01.foo.test.com:389" target="_blank">foodc01.foo.test.com:<u></u>389</a> <<a href="http://foodc01.foo.test.com:389" target="_blank">http://foodc01.foo.test.com:<u></u>389</a>> using<br>
user <a href="mailto:ovirttest@FOO.TEST.COM" target="_blank">ovirttest@FOO.TEST.COM</a> <mailto:<a href="mailto:ovirttest@FOO.TEST.COM" target="_blank">ovirttest@FOO.TEST.COM</a><u></u>> due to<div class="im"><br>
Authentication Failed. Please verify the username and password.. We<br>
should not try the next server<br>
2013-08-06 15:54:20,853 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>LdapAuthenticateUserCommand]<br>
(ajp--127.0.0.1-8702-7) Failed authenticating user: ovirttest to domain<br>
</div><a href="http://gso.med.ge.com" target="_blank">gso.med.ge.com</a> <<a href="http://gso.med.ge.com" target="_blank">http://gso.med.ge.com</a>>. Ldap Query Type is getUserByName<div class="im"><br>
2013-08-06 15:54:20,854 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>LdapAuthenticateUserCommand]<br>
(ajp--127.0.0.1-8702-7) Authentication Failed. Please verify the<br>
username and password.<br>
2013-08-06 15:54:20,855 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>LoginUserCommand] (ajp--127.0.0.1-8702-7)<br>
USER_FAILED_TO_AUTHENTICATE_<u></u>WRONG_USERNAME_OR_PASSWORD : ovirttest<br>
2013-08-06 15:54:20,856 WARN<br>
[org.ovirt.engine.core.bll.<u></u>LoginUserCommand] (ajp--127.0.0.1-8702-7)<br>
CanDoAction of action LoginUser failed.<br>
Reasons:USER_FAILED_TO_<u></u>AUTHENTICATE_WRONG_USERNAME_<u></u>OR_PASSWORD<br>
<br>
Try again to log in as the same user this time typing the correct password.<br>
Result: Login fails!<br>
Data from engine.log:<br>
2013-08-06 15:54:25,186 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>LdapAuthenticateUserCommand]<br>
(ajp--127.0.0.1-8702-7) Failed authenticating user: ovirttest to domain<br>
</div><a href="http://gso.med.ge.com" target="_blank">gso.med.ge.com</a> <<a href="http://gso.med.ge.com" target="_blank">http://gso.med.ge.com</a>>. Ldap Query Type is getUserByName<div class="im"><br>
2013-08-06 15:54:25,187 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>LoginUserCommand] (ajp--127.0.0.1-8702-7)<br>
USER_FAILED_TO_AUTHENTICATE : ovirttest<br>
2013-08-06 15:54:25,187 WARN<br>
[org.ovirt.engine.core.bll.<u></u>LoginUserCommand] (ajp--127.0.0.1-8702-7)<br>
CanDoAction of action LoginUser failed. Reasons:USER_FAILED_TO_<u></u>AUTHENTICATE<br>
<br>
Try again with another AD user.<br>
Result: Login fails!<br>
Data from engine.log:<br>
2013-08-06 15:54:38,056 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>LdapAuthenticateUserCommand]<br>
(ajp--127.0.0.1-8702-5) Failed authenticating user: ovirtadmin to domain<br>
</div><a href="http://gso.med.ge.com" target="_blank">gso.med.ge.com</a> <<a href="http://gso.med.ge.com" target="_blank">http://gso.med.ge.com</a>>. Ldap Query Type is getUserByName<div class="im"><br>
2013-08-06 15:54:38,057 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>LoginUserCommand] (ajp--127.0.0.1-8702-5)<br>
USER_FAILED_TO_AUTHENTICATE : ovirtadmin<br>
2013-08-06 15:54:38,058 WARN<br>
[org.ovirt.engine.core.bll.<u></u>LoginUserCommand] (ajp--127.0.0.1-8702-5)<br>
CanDoAction of action LoginUser failed. Reasons:USER_FAILED_TO_<u></u>AUTHENTICATE<br>
<br>
Logging into the admin portal as the admin@internal user will yield that<br>
engine seems to have forgotten about and can no longer enumerate AD<br>
users and groups.<br>
engine stays in this state until it has been restarted.<br>
<br>
I also note the two following errors in the engine log file as well:<br>
2013-08-06 15:53:41,098 ERROR<br>
[org.ovirt.engine.core.dal.<u></u>dbbroker.generic.<u></u>DBConfigUtils] (MSC service<br>
thread 1-9) Could not parse option AutoRecoveryAllowedTypes value.<br>
2013-08-06 15:53:41,161 ERROR<br>
[org.ovirt.engine.core.dal.<u></u>dbbroker.generic.<u></u>DBConfigUtils] (MSC service<br>
thread 1-9) Failed to decrypt value for property<br>
AttestationTruststorePass will be used encrypted value:<br>
javax.crypto.<u></u>BadPaddingException: Data must start with zero<br>
<br>
- DHC<br>
<br>
<br>
<br>
On Tue, Aug 6, 2013 at 1:31 PM, Dead Horse<br></div>
<<a href="mailto:deadhorseconsulting@gmail.com" target="_blank">deadhorseconsulting@gmail.com</a> <mailto:<a href="mailto:deadhorseconsulting@gmail.com" target="_blank">deadhorseconsulting@<u></u>gmail.com</a>>><div class="im">
<br>
wrote:<br>
<br>
Really attaching logs from other install.<br>
- DHC<br>
<br>
<br>
On Tue, Aug 6, 2013 at 1:30 PM, Dead Horse<br>
<<a href="mailto:deadhorseconsulting@gmail.com" target="_blank">deadhorseconsulting@gmail.com</a><br></div><div class="im">
<mailto:<a href="mailto:deadhorseconsulting@gmail.com" target="_blank">deadhorseconsulting@<u></u>gmail.com</a>>> wrote:<br>
<br>
Also I note that he login does succeed in the AD servers logs as<br>
well as the engine also acknowledges the same. However the login<br>
ends up in either the user logging in and the dialog sitting in<br>
space forever and/or the engine no longer enumerating the AD<br>
users/groups.<br>
<br>
Attached are logs from another install seeing the same thing.<br>
-DHC<br>
<br>
<br>
On Tue, Aug 6, 2013 at 1:20 PM, Dead Horse<br>
<<a href="mailto:deadhorseconsulting@gmail.com" target="_blank">deadhorseconsulting@gmail.com</a><br></div><div class="im">
<mailto:<a href="mailto:deadhorseconsulting@gmail.com" target="_blank">deadhorseconsulting@<u></u>gmail.com</a>>> wrote:<br>
<br>
<br>
Seeing and issue where users are not able to log in. Also<br>
for some reason the engine is seemingly forgeting about AD<br>
users. Removing the AD domain via engine-manage-domains and<br>
re-adding it works for enumerating the users, however the<br>
first attempt to login as a user results in the engine no<br>
longer enumerating the users nor allowing logins.<br>
Attached are the pertinent logs.<br>
<br>
Engine is built and running from current master as of this<br>
morning, and was installed/built and upgraded via RPMs<br>
yum/engine-upgrade<br>
<br>
- DHC<br>
<br>
<br>
<br>
<br>
<br>
<br></div>
______________________________<u></u>_________________<br>
Engine-devel mailing list<br>
<a href="mailto:Engine-devel@ovirt.org" target="_blank">Engine-devel@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/engine-devel" target="_blank">http://lists.ovirt.org/<u></u>mailman/listinfo/engine-devel</a><br>
<br>
</blockquote>
<br>
thanks for reproducing with such clear steps. can you please open a bug?<br>
yair - can you try and reproduce as well (I tried on an older rhev 3.2 i have and couldn't with the IPA provider) <br>
</blockquote></div><br></div>