Re: [Engine-devel] users cannot log into userportal

On 08/07/2013 12:10 AM, Dead Horse wrote: > I have found some steps to reproduce this easily. > > Start the engine bound to an AD for authentication > log in to the user portal as an AD user which has been granted a Role (I > used PowerUserRole) > > Result: Login will succeed > Data from engine.log: > 2013-08-06 15:54:10,088 INFO > [org.ovirt.engine.core.bll.**LoginUserCommand] (ajp--127.0.0.1-8702-10) > Running command: LoginUserCommand internal: false. > 2013-08-06 15:54:10,139 INFO > [org.ovirt.engine.core.dal.**dbbroker.auditloghandling.** > AuditLogDirector] > (ajp--127.0.0.1-8702-10) Correlation ID: 23c4709, Call Stack: null, > Custom Event ID: -1, Message: User ovirttest logged in. > > log out of the user portal > Result: log out succeeds > Data from engine.log: > 2013-08-06 15:54:12,448 INFO > [org.ovirt.engine.core.bll.**LogoutUserCommand] (ajp--127.0.0.1-8702-2) > Running command: LogoutUserCommand internal: false. > 2013-08-06 15:54:12,474 INFO > [org.ovirt.engine.core.dal.**dbbroker.auditloghandling.** > AuditLogDirector] > (ajp--127.0.0.1-8702-2) Correlation ID: 52a89e7d, Call Stack: null, > Custom Event ID: -1, Message: User ovirttest logged out. > > As the same user log in to the user portal again but this purposely > input the wrong password. > Result: log in will fail > Data from engine.log: > 2013-08-06 15:54:20,830 ERROR > [org.ovirt.engine.core.bll.**adbroker.**GSSAPIDirContextAuthentication** > Strategy] > (ajp--127.0.0.1-8702-7) Kerberos error: Pre-authentication information > was invalid (24) > 2013-08-06 15:54:20,832 ERROR > [org.ovirt.engine.core.bll.**adbroker.**GSSAPIDirContextAuthentication** > Strategy] > (ajp--127.0.0.1-8702-7) Authentication Failed. Please verify the > username and password. > 2013-08-06 15:54:20,843 ERROR > [org.ovirt.engine.core.bll.**adbroker.DirectorySearcher] > (ajp--127.0.0.1-8702-7) Failed ldap search server > LDAP://foodc02.foo.test.com:**389 <http://foodc02.foo.test.com:389> < > http://foodc02.foo.test.com:**389 <http://foodc02.foo.test.com:389>> > using > user ovirttest(a)FOO.TEST.COM <mailto:ovirttest@FOO.TEST.COM**> due to > > Authentication Failed. Please verify the username and password.. We > should not try the next server > 2013-08-06 15:54:20,850 ERROR > [org.ovirt.engine.core.bll.**adbroker.**GSSAPIDirContextAuthentication** > Strategy] > (ajp--127.0.0.1-8702-7) Kerberos error: Pre-authentication information > was invalid (24) > 2013-08-06 15:54:20,851 ERROR > [org.ovirt.engine.core.bll.**adbroker.**GSSAPIDirContextAuthentication** > Strategy] > (ajp--127.0.0.1-8702-7) Authentication Failed. Please verify the > username and password. > 2013-08-06 15:54:20,852 ERROR > [org.ovirt.engine.core.bll.**adbroker.DirectorySearcher] > (ajp--127.0.0.1-8702-7) Failed ldap search server > LDAP://foodc01.foo.test.com:**389 <http://foodc01.foo.test.com:389> < > http://foodc01.foo.test.com:**389 <http://foodc01.foo.test.com:389>> > using > user ovirttest(a)FOO.TEST.COM <mailto:ovirttest@FOO.TEST.COM**> due to > > Authentication Failed. Please verify the username and password.. We > should not try the next server > 2013-08-06 15:54:20,853 ERROR > [org.ovirt.engine.core.bll.**adbroker.**LdapAuthenticateUserCommand] > (ajp--127.0.0.1-8702-7) Failed authenticating user: ovirttest to domain > gso.med.ge.com <http://gso.med.ge.com>;. Ldap Query Type is getUserByName > > 2013-08-06 15:54:20,854 ERROR > [org.ovirt.engine.core.bll.**adbroker.**LdapAuthenticateUserCommand] > (ajp--127.0.0.1-8702-7) Authentication Failed. Please verify the > username and password. > 2013-08-06 15:54:20,855 ERROR > [org.ovirt.engine.core.bll.**LoginUserCommand] (ajp--127.0.0.1-8702-7) > USER_FAILED_TO_AUTHENTICATE_**WRONG_USERNAME_OR_PASSWORD : ovirttest > 2013-08-06 15:54:20,856 WARN > [org.ovirt.engine.core.bll.**LoginUserCommand] (ajp--127.0.0.1-8702-7) > CanDoAction of action LoginUser failed. > Reasons:USER_FAILED_TO_**AUTHENTICATE_WRONG_USERNAME_**OR_PASSWORD > > Try again to log in as the same user this time typing the correct > password. > Result: Login fails! > Data from engine.log: > 2013-08-06 15:54:25,186 ERROR > [org.ovirt.engine.core.bll.**adbroker.**LdapAuthenticateUserCommand] > (ajp--127.0.0.1-8702-7) Failed authenticating user: ovirttest to domain > gso.med.ge.com <http://gso.med.ge.com>;. Ldap Query Type is getUserByName > > 2013-08-06 15:54:25,187 ERROR > [org.ovirt.engine.core.bll.**LoginUserCommand] (ajp--127.0.0.1-8702-7) > USER_FAILED_TO_AUTHENTICATE : ovirttest > 2013-08-06 15:54:25,187 WARN > [org.ovirt.engine.core.bll.**LoginUserCommand] (ajp--127.0.0.1-8702-7) > CanDoAction of action LoginUser failed. Reasons:USER_FAILED_TO_** > AUTHENTICATE > > Try again with another AD user. > Result: Login fails! > Data from engine.log: > 2013-08-06 15:54:38,056 ERROR > [org.ovirt.engine.core.bll.**adbroker.**LdapAuthenticateUserCommand] > (ajp--127.0.0.1-8702-5) Failed authenticating user: ovirtadmin to domain > gso.med.ge.com <http://gso.med.ge.com>;. Ldap Query Type is getUserByName > > 2013-08-06 15:54:38,057 ERROR > [org.ovirt.engine.core.bll.**LoginUserCommand] (ajp--127.0.0.1-8702-5) > USER_FAILED_TO_AUTHENTICATE : ovirtadmin > 2013-08-06 15:54:38,058 WARN > [org.ovirt.engine.core.bll.**LoginUserCommand] (ajp--127.0.0.1-8702-5) > CanDoAction of action LoginUser failed. Reasons:USER_FAILED_TO_** > AUTHENTICATE > > Logging into the admin portal as the admin@internal user will yield that > engine seems to have forgotten about and can no longer enumerate AD > users and groups. > engine stays in this state until it has been restarted. > > I also note the two following errors in the engine log file as well: > 2013-08-06 15:53:41,098 ERROR > [org.ovirt.engine.core.dal.**dbbroker.generic.**DBConfigUtils] (MSC > service > thread 1-9) Could not parse option AutoRecoveryAllowedTypes value. > 2013-08-06 15:53:41,161 ERROR > [org.ovirt.engine.core.dal.**dbbroker.generic.**DBConfigUtils] (MSC > service > thread 1-9) Failed to decrypt value for property > AttestationTruststorePass will be used encrypted value: > javax.crypto.**BadPaddingException: Data must start with zero > > - DHC > > > > On Tue, Aug 6, 2013 at 1:31 PM, Dead Horse > <deadhorseconsulting(a)gmail.com <mailto:deadhorseconsulting@**gmail.com<deadhorseconsulting@gmail.com> > >> > > wrote: > > Really attaching logs from other install. > - DHC > > > On Tue, Aug 6, 2013 at 1:30 PM, Dead Horse > <deadhorseconsulting(a)gmail.com > <mailto:deadhorseconsulting@**gmail.com<deadhorseconsulting@gmail.com>>> > wrote: > > Also I note that he login does succeed in the AD servers logs as > well as the engine also acknowledges the same. However the login > ends up in either the user logging in and the dialog sitting in > space forever and/or the engine no longer enumerating the AD > users/groups. > > Attached are logs from another install seeing the same thing. > -DHC > > > On Tue, Aug 6, 2013 at 1:20 PM, Dead Horse > <deadhorseconsulting(a)gmail.com > <mailto:deadhorseconsulting@**gmail.com<deadhorseconsulting@gmail.com>>> > wrote: > > > Seeing and issue where users are not able to log in. Also > for some reason the engine is seemingly forgeting about AD > users. Removing the AD domain via engine-manage-domains and > re-adding it works for enumerating the users, however the > first attempt to login as a user results in the engine no > longer enumerating the users nor allowing logins. > Attached are the pertinent logs. > > Engine is built and running from current master as of this > morning, and was installed/built and upgraded via RPMs > yum/engine-upgrade > > - DHC > > > > > > > ______________________________**_________________ > Engine-devel mailing list > Engine-devel(a)ovirt.org > http://lists.ovirt.org/**mailman/listinfo/engine-devel<http://lists.ov... > > thanks for reproducing with such clear steps. can you please open a bug? yair - can you try and reproduce as well (I tried on an older rhev 3.2 i have and couldn't with the IPA provider)