8:26 p.m.
Hi guys,
an important change in UI plugins REST API integration landed
in both master [1] and 3.5 [2] branches of oVirt Engine repo.
[1] http://gerrit.ovirt.org/#/c/35185/
[2] http://gerrit.ovirt.org/#/c/35248/
Below is a short overview of this change and how it affects
existing UI plugins. Please refer to commit message for more
details.
Situation before
================
WebAdmin login caused two separate Engine user sessions to
be created: one for WebAdmin GUI itself, one for UI plugins
(using same credentials as entered in WebAdmin login form).
This resulted in two separate "user {user}@{domain} logged"
entries in Engine log.
REST session ID which maps to second Engine user session was
broadcasted to all UI plugins via "RestApiSessionAcquired"
event handler function.
Upon WebAdmin logout, the second Engine user session was not
closed; this was intentional so that any potential 3rd party
systems using above mentioned REST session ID would still work.
Situation after
===============
WebAdmin login causes one Engine user session to be created.
When acquiring REST session for UI plugins, existing Engine
user session is reused via OVIRT-INTERNAL-ENGINE-AUTH-TOKEN
header [3]. There is now only one "user {user}@{domain} logged"
entry in Engine log.
[3] http://gerrit.ovirt.org/#/c/35069/
Acquired REST session ID therefore maps to existing Engine
user session. "RestApiSessionAcquired" API still works as
expected.
The only (possibly breaking) change is that upon WebAdmin
logout, REST session ID previously passed to all UI plugins
(upon last login) will not work anymore. While the physical
session (REST webapp HttpSession) might still be active, the
logical session (Engine user / SessionDataContainer) will be
dead, therefore the physical REST session won't work after
WebAdmin logout.
In other words, usability of REST session ID is now strictly
scoped to GUI user being authenticated. If the user logs in,
(always) new REST session ID will be passed to all UI plugins.
If the user logs out, REST session ID will not work anymore.
This is in line with the general concept of UI plugins where
each plugin is "active" (receives API callbacks) *only* when
the GUI user is authenticated. See [4,5] for details.
[4] http://www.ovirt.org/Features/UIPlugins#Plugin_lifecycle
"Plugin invocation context starts when user logs into WebAdmin and ends when user
logs out."
[5] http://www.ovirt.org/Features/UIPlugins#Application_event_reference
Let me know if you have any questions.
Regards,
Vojtech
9:41 a.m.
On 01/12/14 20:26, Vojtech Szocs wrote:
In other words, usability of REST session ID is now strictly
scoped to GUI user being authenticated. If the user logs in,
(always) new REST session ID will be passed to all UI plugins.
If the user logs out, REST session ID will not work anymore.
What if I use just REST for logging in and doing something
without any GUI interaction at all?
this reads a little like: you always need an open web gui
to be able to use REST, which does not make sense at all.
So I guess I'm misreading this?
--
Mit freundlichen Grüßen / Regards
Sven Kieske
Systemadministrator
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
T: +49-5772-293-100
F: +49-5772-293-333
https://www.mittwald.de
Geschäftsführer: Robert Meyer
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen
9:43 a.m.
New subject: Important change in UI plugins REST API integration
----- Original Message -----
From: "Sven Kieske" <s.kieske(a)mittwald.de>
To: devel(a)ovirt.org
Sent: Tuesday, December 2, 2014 10:41:00 AM
Subject: Re: [ovirt-devel] Important change in UI plugins REST API integration
On 01/12/14 20:26, Vojtech Szocs wrote:
> In other words, usability of REST session ID is now strictly
> scoped to GUI user being authenticated. If the user logs in,
> (always) new REST session ID will be passed to all UI plugins.
> If the user logs out, REST session ID will not work anymore.
What if I use just REST for logging in and doing something
without any GUI interaction at all?
this reads a little like: you always need an open web gui
to be able to use REST, which does not make sense at all.
If you provide your own credentials nothing changed.
The change is only effecting RESTAPI usage within the user interface using the credentials
obtained interactively from the user within login page.
So I guess I'm misreading this?
--
Mit freundlichen Grüßen / Regards
Sven Kieske
Systemadministrator
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
T: +49-5772-293-100
F: +49-5772-293-333
https://www.mittwald.de
Geschäftsführer: Robert Meyer
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen
_______________________________________________
Devel mailing list
Devel(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/devel
6:12 p.m.
New subject: Important change in UI plugins REST API integration
----- Original Message -----
From: "Alon Bar-Lev" <alonbl(a)redhat.com>
To: "Sven Kieske" <s.kieske(a)mittwald.de>
Cc: devel(a)ovirt.org
Sent: Tuesday, December 2, 2014 9:43:18 AM
Subject: Re: [ovirt-devel] Important change in UI plugins REST API integration
----- Original Message -----
> From: "Sven Kieske" <s.kieske(a)mittwald.de>
> To: devel(a)ovirt.org
> Sent: Tuesday, December 2, 2014 10:41:00 AM
> Subject: Re: [ovirt-devel] Important change in UI plugins REST API
> integration
>
>
>
> On 01/12/14 20:26, Vojtech Szocs wrote:
> > In other words, usability of REST session ID is now strictly
> > scoped to GUI user being authenticated. If the user logs in,
> > (always) new REST session ID will be passed to all UI plugins.
> > If the user logs out, REST session ID will not work anymore.
>
> What if I use just REST for logging in and doing something
> without any GUI interaction at all?
This announcement was about UI plugins in WebAdmin. If you use
Engine REST API without any GUI interaction involved, you aren't
affected in any way.
>
> this reads a little like: you always need an open web gui
> to be able to use REST, which does not make sense at all.
Sorry if my email confused you. It should read like: if you're
an author of oVirt UI plugin for WebAdmin, please beware that
REST API session ID (automatically acquired by UI plugin infra
on behalf of all UI plugins) will not work after GUI logout.
If you provide your own credentials nothing changed.
The change is only effecting RESTAPI usage within the user interface using
the credentials obtained interactively from the user within login page.
> So I guess I'm misreading this?
>
> --
> Mit freundlichen Grüßen / Regards
>
> Sven Kieske
>
> Systemadministrator
> Mittwald CM Service GmbH & Co. KG
> Königsberger Straße 6
> 32339 Espelkamp
> T: +49-5772-293-100
> F: +49-5772-293-333
> https://www.mittwald.de
> Geschäftsführer: Robert Meyer
> St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
> Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen
> _______________________________________________
> Devel mailing list
> Devel(a)ovirt.org
> http://lists.ovirt.org/mailman/listinfo/devel
_______________________________________________
Devel mailing list
Devel(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/devel
9:52 a.m.
New subject: Important change in UI plugins REST API integration
Thanks for your clarification!
--
Mit freundlichen Grüßen / Regards
Sven Kieske
Systemadministrator
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
T: +49-5772-293-100
F: +49-5772-293-333
https://www.mittwald.de
Geschäftsführer: Robert Meyer
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen
11:02 a.m.
New subject: Important change in UI plugins REST API integration
Does this affect any 3rd parties that implemented UI plugins?
Will they need to change anything or is this change more a behaviour change only?
Yaniv
----- Original Message -----
From: "Vojtech Szocs" <vszocs(a)redhat.com>
To: "Alon Bar-Lev" <alonbl(a)redhat.com>
Cc: devel(a)ovirt.org
Sent: Tuesday, December 2, 2014 7:12:21 PM
Subject: Re: [ovirt-devel] Important change in UI plugins REST API integration
----- Original Message -----
> From: "Alon Bar-Lev" <alonbl(a)redhat.com>
> To: "Sven Kieske" <s.kieske(a)mittwald.de>
> Cc: devel(a)ovirt.org
> Sent: Tuesday, December 2, 2014 9:43:18 AM
> Subject: Re: [ovirt-devel] Important change in UI plugins REST API
> integration
>
>
>
> ----- Original Message -----
> > From: "Sven Kieske" <s.kieske(a)mittwald.de>
> > To: devel(a)ovirt.org
> > Sent: Tuesday, December 2, 2014 10:41:00 AM
> > Subject: Re: [ovirt-devel] Important change in UI plugins REST API
> > integration
> >
> >
> >
> > On 01/12/14 20:26, Vojtech Szocs wrote:
> > > In other words, usability of REST session ID is now strictly
> > > scoped to GUI user being authenticated. If the user logs in,
> > > (always) new REST session ID will be passed to all UI plugins.
> > > If the user logs out, REST session ID will not work anymore.
> >
> > What if I use just REST for logging in and doing something
> > without any GUI interaction at all?
This announcement was about UI plugins in WebAdmin. If you use
Engine REST API without any GUI interaction involved, you aren't
affected in any way.
> >
> > this reads a little like: you always need an open web gui
> > to be able to use REST, which does not make sense at all.
Sorry if my email confused you. It should read like: if you're
an author of oVirt UI plugin for WebAdmin, please beware that
REST API session ID (automatically acquired by UI plugin infra
on behalf of all UI plugins) will not work after GUI logout.
>
> If you provide your own credentials nothing changed.
>
> The change is only effecting RESTAPI usage within the user interface using
> the credentials obtained interactively from the user within login page.
>
> > So I guess I'm misreading this?
> >
> > --
> > Mit freundlichen Grüßen / Regards
> >
> > Sven Kieske
> >
> > Systemadministrator
> > Mittwald CM Service GmbH & Co. KG
> > Königsberger Straße 6
> > 32339 Espelkamp
> > T: +49-5772-293-100
> > F: +49-5772-293-333
> > https://www.mittwald.de
> > Geschäftsführer: Robert Meyer
> > St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad
> > Oeynhausen
> > Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad
> > Oeynhausen
> > _______________________________________________
> > Devel mailing list
> > Devel(a)ovirt.org
> > http://lists.ovirt.org/mailman/listinfo/devel
> _______________________________________________
> Devel mailing list
> Devel(a)ovirt.org
> http://lists.ovirt.org/mailman/listinfo/devel
_______________________________________________
Devel mailing list
Devel(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/devel
3:56 p.m.
New subject: Important change in UI plugins REST API integration
----- Original Message -----
From: "Yaniv Dary" <ydary(a)redhat.com>
Sent: Wednesday, December 3, 2014 5:02:19 AM
Does this affect any 3rd parties that implemented UI plugins?
this affects any UI plugin that utilizes the rest-api-session *generated
by the ui-plugins infrastructure* outside the context of the client/browser;
I.e., plugins that send the ui-plugins-infra-generated-rest-api-session-id
to some (3rd party) server-side (which is not aware of the client's browser/
web-admin status at all) that performs communication with the engine's rest-
api based on that rest-api-session-id.
Will they need to change anything or is this change more a behaviour
change
only?
for the plugins that I mentioned above: assuming these plugins would like
retain their functionality and have their server-side perform communication
with the engine's rest-api regardless of the current status of the client's
browser/web-admin (active/logged-in/logged-out/...), they will need to change
their code to obtain their own rest-api-session (to be used by the server-
side), rather than rely on the rest-api-session that was obtained by the ui-
plugins infrastructure for them; the latter should be used *only* for the
plugin's *client*-side communication with the engine's rest-api.
if these plugins will not change their code as described above - these
plugins' server-side communication with the engine's rest-api will break
upon web-admin logout (which may be an acceptable 'breakage' for some
plugins - this is really up to each ui-plugin author to make this decision).
all other plugins (i.e. plugins that use the ui-plugins-infra-generated-rest-
api-session only within the client context, plugins that don't use this rest-
api-session at all, etc.) can remain as-is - they will not be affected.
Yaniv
----- Original Message -----
> From: "Vojtech Szocs" <vszocs(a)redhat.com>
> To: "Alon Bar-Lev" <alonbl(a)redhat.com>
> Cc: devel(a)ovirt.org
> Sent: Tuesday, December 2, 2014 7:12:21 PM
> Subject: Re: [ovirt-devel] Important change in UI plugins REST API
> integration
>
>
>
> ----- Original Message -----
> > From: "Alon Bar-Lev" <alonbl(a)redhat.com>
> > To: "Sven Kieske" <s.kieske(a)mittwald.de>
> > Cc: devel(a)ovirt.org
> > Sent: Tuesday, December 2, 2014 9:43:18 AM
> > Subject: Re: [ovirt-devel] Important change in UI plugins REST API
> > integration
> >
> >
> >
> > ----- Original Message -----
> > > From: "Sven Kieske" <s.kieske(a)mittwald.de>
> > > To: devel(a)ovirt.org
> > > Sent: Tuesday, December 2, 2014 10:41:00 AM
> > > Subject: Re: [ovirt-devel] Important change in UI plugins REST API
> > > integration
> > >
> > >
> > >
> > > On 01/12/14 20:26, Vojtech Szocs wrote:
> > > > In other words, usability of REST session ID is now strictly
> > > > scoped to GUI user being authenticated. If the user logs in,
> > > > (always) new REST session ID will be passed to all UI plugins.
> > > > If the user logs out, REST session ID will not work anymore.
> > >
> > > What if I use just REST for logging in and doing something
> > > without any GUI interaction at all?
>
> This announcement was about UI plugins in WebAdmin. If you use
> Engine REST API without any GUI interaction involved, you aren't
> affected in any way.
>
> > >
> > > this reads a little like: you always need an open web gui
> > > to be able to use REST, which does not make sense at all.
>
> Sorry if my email confused you. It should read like: if you're
> an author of oVirt UI plugin for WebAdmin, please beware that
> REST API session ID (automatically acquired by UI plugin infra
> on behalf of all UI plugins) will not work after GUI logout.
>
> >
> > If you provide your own credentials nothing changed.
> >
> > The change is only effecting RESTAPI usage within the user interface
> > using
> > the credentials obtained interactively from the user within login page.
> >
> > > So I guess I'm misreading this?
> > >
> > > --
> > > Mit freundlichen Grüßen / Regards
> > >
> > > Sven Kieske
> > >
> > > Systemadministrator
> > > Mittwald CM Service GmbH & Co. KG
> > > Königsberger Straße 6
> > > 32339 Espelkamp
> > > T: +49-5772-293-100
> > > F: +49-5772-293-333
> > > https://www.mittwald.de
> > > Geschäftsführer: Robert Meyer
> > > St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad
> > > Oeynhausen
> > > Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad
> > > Oeynhausen
> > > _______________________________________________
> > > Devel mailing list
> > > Devel(a)ovirt.org
> > > http://lists.ovirt.org/mailman/listinfo/devel
> > _______________________________________________
> > Devel mailing list
> > Devel(a)ovirt.org
> > http://lists.ovirt.org/mailman/listinfo/devel
> _______________________________________________
> Devel mailing list
> Devel(a)ovirt.org
> http://lists.ovirt.org/mailman/listinfo/devel
_______________________________________________
Devel mailing list
Devel(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/devel
4:54 p.m.
New subject: Important change in UI plugins REST API integration
----- Original Message -----
From: "Einav Cohen" <ecohen(a)redhat.com>
To: "Yaniv Dary" <ydary(a)redhat.com>
Cc: "Vojtech Szocs" <vszocs(a)redhat.com>, devel(a)ovirt.org
Sent: Wednesday, December 3, 2014 3:56:00 PM
Subject: Re: [ovirt-devel] Important change in UI plugins REST API integration
> ----- Original Message -----
> From: "Yaniv Dary" <ydary(a)redhat.com>
> Sent: Wednesday, December 3, 2014 5:02:19 AM
>
> Does this affect any 3rd parties that implemented UI plugins?
this affects any UI plugin that utilizes the rest-api-session *generated
by the ui-plugins infrastructure* outside the context of the client/browser;
I.e., plugins that send the ui-plugins-infra-generated-rest-api-session-id
to some (3rd party) server-side (which is not aware of the client's browser/
web-admin status at all) that performs communication with the engine's rest-
api based on that rest-api-session-id.
To explain a bit about REST integration for UI plugins: right upon each
successful WebAdmin GUI login, WebAdmin's UI plugin infra will acquire
new REST session and pass the REST session ID to all UI plugins through
"RestApiSessionAcquired" callback [1].
[1] http://www.ovirt.org/Features/UIPlugins#REST_API_integration
Any UI plugin can register "RestApiSessionAcquired" callback handler
and be notified of REST session ID. Typically, UI plugin itself can
talk with Engine REST API. I assume this covers the majority of all
UI plugins utilizing the "RestApiSessionAcquired" callback. These
plugins do NOT need to be modified at all.
However, passing this (UI plugin & WebAdmin GUI user specific) REST
session ID to any 3rd party is generally discouraged since as of 3.5
the REST session won't be usable after WebAdmin GUI user logs out [2].
When GUI user logs in again, new REST session ID will be passed to UI
plugins.
[2] http://gerrit.ovirt.org/#/c/35185/
> Will they need to change anything or is this change more a behaviour change
> only?
for the plugins that I mentioned above: assuming these plugins would like
retain their functionality and have their server-side perform communication
with the engine's rest-api regardless of the current status of the client's
browser/web-admin (active/logged-in/logged-out/...), they will need to change
their code to obtain their own rest-api-session (to be used by the server-
side), rather than rely on the rest-api-session that was obtained by the ui-
plugins infrastructure for them; the latter should be used *only* for the
plugin's *client*-side communication with the engine's rest-api.
Yes. In other words, REST session ID obtained via "RestApiSessionAcquired"
callback is scoped to current WebAdmin GUI user. Any 3rd party (outside of
UI plugin context) should manage its "own" REST session.
if these plugins will not change their code as described above - these
plugins' server-side communication with the engine's rest-api will break
upon web-admin logout (which may be an acceptable 'breakage' for some
plugins - this is really up to each ui-plugin author to make this decision).
all other plugins (i.e. plugins that use the ui-plugins-infra-generated-rest-
api-session only within the client context, plugins that don't use this rest-
api-session at all, etc.) can remain as-is - they will not be affected.
>
>
>
> Yaniv
>
> ----- Original Message -----
> > From: "Vojtech Szocs" <vszocs(a)redhat.com>
> > To: "Alon Bar-Lev" <alonbl(a)redhat.com>
> > Cc: devel(a)ovirt.org
> > Sent: Tuesday, December 2, 2014 7:12:21 PM
> > Subject: Re: [ovirt-devel] Important change in UI plugins REST API
> > integration
> >
> >
> >
> > ----- Original Message -----
> > > From: "Alon Bar-Lev" <alonbl(a)redhat.com>
> > > To: "Sven Kieske" <s.kieske(a)mittwald.de>
> > > Cc: devel(a)ovirt.org
> > > Sent: Tuesday, December 2, 2014 9:43:18 AM
> > > Subject: Re: [ovirt-devel] Important change in UI plugins REST API
> > > integration
> > >
> > >
> > >
> > > ----- Original Message -----
> > > > From: "Sven Kieske" <s.kieske(a)mittwald.de>
> > > > To: devel(a)ovirt.org
> > > > Sent: Tuesday, December 2, 2014 10:41:00 AM
> > > > Subject: Re: [ovirt-devel] Important change in UI plugins REST API
> > > > integration
> > > >
> > > >
> > > >
> > > > On 01/12/14 20:26, Vojtech Szocs wrote:
> > > > > In other words, usability of REST session ID is now strictly
> > > > > scoped to GUI user being authenticated. If the user logs in,
> > > > > (always) new REST session ID will be passed to all UI plugins.
> > > > > If the user logs out, REST session ID will not work anymore.
> > > >
> > > > What if I use just REST for logging in and doing something
> > > > without any GUI interaction at all?
> >
> > This announcement was about UI plugins in WebAdmin. If you use
> > Engine REST API without any GUI interaction involved, you aren't
> > affected in any way.
> >
> > > >
> > > > this reads a little like: you always need an open web gui
> > > > to be able to use REST, which does not make sense at all.
> >
> > Sorry if my email confused you. It should read like: if you're
> > an author of oVirt UI plugin for WebAdmin, please beware that
> > REST API session ID (automatically acquired by UI plugin infra
> > on behalf of all UI plugins) will not work after GUI logout.
> >
> > >
> > > If you provide your own credentials nothing changed.
> > >
> > > The change is only effecting RESTAPI usage within the user interface
> > > using
> > > the credentials obtained interactively from the user within login page.
> > >
> > > > So I guess I'm misreading this?
> > > >
> > > > --
> > > > Mit freundlichen Grüßen / Regards
> > > >
> > > > Sven Kieske
> > > >
> > > > Systemadministrator
> > > > Mittwald CM Service GmbH & Co. KG
> > > > Königsberger Straße 6
> > > > 32339 Espelkamp
> > > > T: +49-5772-293-100
> > > > F: +49-5772-293-333
> > > > https://www.mittwald.de
> > > > Geschäftsführer: Robert Meyer
> > > > St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad
> > > > Oeynhausen
> > > > Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad
> > > > Oeynhausen
> > > > _______________________________________________
> > > > Devel mailing list
> > > > Devel(a)ovirt.org
> > > > http://lists.ovirt.org/mailman/listinfo/devel
> > > _______________________________________________
> > > Devel mailing list
> > > Devel(a)ovirt.org
> > > http://lists.ovirt.org/mailman/listinfo/devel
> > _______________________________________________
> > Devel mailing list
> > Devel(a)ovirt.org
> > http://lists.ovirt.org/mailman/listinfo/devel
> _______________________________________________
> Devel mailing list
> Devel(a)ovirt.org
> http://lists.ovirt.org/mailman/listinfo/devel
3424
days inactive
3426
days old
7 comments
5 participants
participants (5)
-
Alon Bar-Lev -
Einav Cohen -
Sven Kieske -
Vojtech Szocs -
Yaniv Dary