<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>The "error: 'str' object has no attribute 'product_info'" was a red herring (mistyped url). The 401 errors for non-admins though is still quite real.</div><div><br></div>Detailed response inside ...<div><br><div><div>On Oct 2, 2012, at 1:48 PM, Michael Pasternak wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Hi Brian,<br><br>On 10/02/2012 05:52 PM, Brian Vetter wrote:<br><blockquote type="cite">I also tried a simple connect to the home of the ovirt server in the ovirt-shell:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> [oVirt shell (disconnected)]# connect <a href="https://ovirtserver">https://ovirtserver</a> <user> <pass><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> error: 'str' object has no attribute 'product_info'<br></blockquote><br>this could happen if you trying connect to SSL site via HTTP protocol,<br>btw what sdk/cli version you're using [1]? latest sdk/cli protects against<br>this.<br><br>[1] run 'info' command in cli<br></div></blockquote><div><br></div><div>As this turned out, the problem was due to a bad url (transposed characters). Once fixed, I'm back to the 401 error condition.</div></div><div><br><blockquote type="cite"><div><blockquote type="cite">As to your question:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite"> i think you should get an empty list and not a 401 in any case, but just to make sure - you have the user role on a specific VM and you don't see it?<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Yes, I believe this is true. If the same user logs into the user portal, he can see the VM and start/stop it. From the ovirt admin portal, I see the following permissions<br></blockquote><blockquote type="cite">for the VM:<br></blockquote><br>does this user has any other role/s besides UserRole?</div></blockquote><div><br></div><div>No, the only role it is given is UserRole. Here is how it was applied:</div><div><br></div><div>1) The user was created in my directory server (that was added to the ovirt manager during setup).</div><div>2) After creating a new desktop VM, I selected the VM, selected its Permissions tab, and then added the user with the role 'UserRole' to the VM. This was all done in the ovirt-manager web app.</div><div>3) I then login to the user portal with that user account name. After refreshing the VM list (a very minor bug), I see the VM that was assigned to the user.</div><div>4) When using the ovirt-shell command, the connect command fails with an error 401 as in the following text:</div><div><br></div></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><div><div>[oVirt shell (disconnected)]# connect <a href="https://ovirt-serveri/">https://ovirt-serveri/</a> 'xxx@yyyy' 'pword'</div></div></div></div><div><div><div><div><br></div></div></div></div><div><div><div><div>error: Unauthorized, [Errno: 401]</div></div></div></div></blockquote><div><div>5) If I add the "DatacenterAdmin" role, the connect command works.</div><div>6) Similarly, if I use curl, I get the same HTTPS Status 401 error.</div><div><br></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div># curl --cacert $CA_FILE -X GET -H "Filter: true" -u xxx@yyyy:pword <a href="https://ovirtserver/api/vms">https://ovirtserver/api/vms</a> > uservms.xml </div></div></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><div># cat uservms.xml</div></div></div><div><div><div><html><head><title>JBoss Web/7.0.0.SNAPSHOT - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 401 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>This request requires HTTP authentication ().</u></p><HR size="1" noshade="noshade"><h3>JBoss Web/7.0.0.SNAPSHOT</h3></body></html>[bjv@eos ~]$</div></div></div></blockquote><div><br></div><div>7) I see the following when I use ovirt -d and do the connect:</div><div><br></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div>send: 'GET /api HTTP/1.1\r\nHost: <a href="http://eos.testcloud.com">eos.testcloud.com</a>\r\nAccept-Encoding: identity\r\nPrefer: persistent-auth\r\nContent-type: application/xml\r\nAuthorization: Basic Ymp2ZXR0ZXJAZHJvaWRjbG91ZC5tb2JpOmxvc3QrZm91bmQ=\r\n\r\n'</div></div><div><div>reply: 'HTTP/1.1 401 Unauthorized\r\n'</div></div><div><div>header: Date: Wed, 03 Oct 2012 03:24:53 GMT</div></div><div><div>header: Set-Cookie: JSESSIONID=n3Ex3mxsvzTEM3rlkiHa85mP.undefined; Path=/api; Secure</div></div><div><div>header: WWW-Authenticate: Basic realm="ENGINE"</div></div><div><div>header: Content-Type: text/html;charset=utf-8</div></div><div><div>header: Content-Length: 962</div></div><div><div>header: Connection: close</div></div></blockquote><div><br></div><div>Clearly, the ovirt-shell and curl are making the same request and getting the same error response.</div><div><br></div><div>The engine.log file in /var/log/ovirt-engine has the following after I try to connect:</div><div><br></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div>2012-10-02 22:28:37,489 INFO [org.ovirt.engine.core.bll.LoginAdminUserCommand] (ajp--0.0.0.0-8009-3) <font class="Apple-style-span" color="#b61810"><b>Checking if user bjvetter is an admin, result false</b></font></div></div><div><div>2012-10-02 22:28:37,490 WARN [org.ovirt.engine.core.bll.LoginAdminUserCommand] (ajp--0.0.0.0-8009-3) CanDoAction of action LoginAdminUser failed. Reasons:USER_NOT_AUTHORIZED_TO_PERFORM_ACTION</div></div><div><div>2012-10-02 22:28:37,491 INFO [org.ovirt.engine.api.restapi.security.auth.LoginValidator] (ajp--0.0.0.0-8009-3) Login failure, user: bjvetter domain: <a href="http://my.testcloud.com">my.testcloud.com</a> reason: [USER_NOT_AUTHORIZED_TO_PERFORM_ACTION]</div></div></blockquote><div><br></div><div>So based upon what I see in this log file, it would seem that the connect API wants to make sure that I am an admin and not a regular user.</div><div><br></div>Which gets me back to my original question: Do the REST API and the ovirt-shell require admin privileges or is there a separate uri namespace for regular users to make requests? Or perhaps more direct, should <a href="https://$ovirt-server/api/vms">https://$ovirt-server/api/vms</a> be accessible to non-admins or is there a different url a non-admin should use?<div><br></div><div>Brian</div><div><div><br></div></div></body></html>