On 10/03/2012 05:40 AM, Brian Vetter wrote:
The "error: 'str' object has no attribute 'product_info'" was a red herring (mistyped url). The 401 errors for non-admins though is still quite real.
Detailed response inside ...
On Oct 2, 2012, at 1:48 PM, Michael Pasternak wrote:
Hi Brian,
On 10/02/2012 05:52 PM, Brian Vetter wrote:
I also tried a simple connect to the home of the ovirt server in the ovirt-shell:
[oVirt shell (disconnected)]# connect https://ovirtserver <user> <pass>
error: 'str' object has no attribute 'product_info'
this could happen if you trying connect to SSL site via HTTP protocol, btw what sdk/cli version you're using [1]? latest sdk/cli protects against this.
[1] run 'info' command in cli
As this turned out, the problem was due to a bad url (transposed characters). Once fixed, I'm back to the 401 error condition.
As to your question:
i think you should get an empty list and not a 401 in any case, but just to make sure - you have the user role on a specific VM and you don't see it?
Yes, I believe this is true. If the same user logs into the user portal, he can see the VM and start/stop it. From the ovirt admin portal, I see the following permissions for the VM:
does this user has any other role/s besides UserRole?
No, the only role it is given is UserRole. Here is how it was applied:
1) The user was created in my directory server (that was added to the ovirt manager during setup). 2) After creating a new desktop VM, I selected the VM, selected its Permissions tab, and then added the user with the role 'UserRole' to the VM. This was all done in the ovirt-manager web app. 3) I then login to the user portal with that user account name. After refreshing the VM list (a very minor bug), I see the VM that was assigned to the user. 4) When using the ovirt-shell command, the connect command fails with an error 401 as in the following text:
[oVirt shell (disconnected)]# connect https://ovirt-serveri/ 'xxx@yyyy' 'pword'
error: Unauthorized, [Errno: 401]
5) If I add the "DatacenterAdmin" role, the connect command works. 6) Similarly, if I use curl, I get the same HTTPS Status 401 error.
# curl --cacert $CA_FILE -X GET -H "Filter: true" -u xxx@yyyy:pword https://ovirtserver/api/vms > uservms.xml
# cat uservms.xml <html><head><title>JBoss Web/7.0.0.SNAPSHOT - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 401 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>This request requires HTTP authentication ().</u></p><HR size="1" noshade="noshade"><h3>JBoss Web/7.0.0.SNAPSHOT</h3></body></html>[bjv@eos ~]$
7) I see the following when I use ovirt -d and do the connect:
send: 'GET /api HTTP/1.1\r\nHost: eos.testcloud.com <http://eos.testcloud.com>\r\nAccept-Encoding: identity\r\nPrefer: persistent-auth\r\nContent-type: application/xml\r\nAuthorization: Basic Ymp2ZXR0ZXJAZHJvaWRjbG91ZC5tb2JpOmxvc3QrZm91bmQ=\r\n\r\n' reply: 'HTTP/1.1 401 Unauthorized\r\n' header: Date: Wed, 03 Oct 2012 03:24:53 GMT header: Set-Cookie: JSESSIONID=n3Ex3mxsvzTEM3rlkiHa85mP.undefined; Path=/api; Secure header: WWW-Authenticate: Basic realm="ENGINE" header: Content-Type: text/html;charset=utf-8 header: Content-Length: 962 header: Connection: close
Clearly, the ovirt-shell and curl are making the same request and getting the same error response.
The engine.log file in /var/log/ovirt-engine has the following after I try to connect:
2012-10-02 22:28:37,489 INFO [org.ovirt.engine.core.bll.LoginAdminUserCommand] (ajp--0.0.0.0-8009-3) *Checking if user bjvetter is an admin, result false* 2012-10-02 22:28:37,490 WARN [org.ovirt.engine.core.bll.LoginAdminUserCommand] (ajp--0.0.0.0-8009-3) CanDoAction of action LoginAdminUser failed. Reasons:USER_NOT_AUTHORIZED_TO_PERFORM_ACTION 2012-10-02 22:28:37,491 INFO [org.ovirt.engine.api.restapi.security.auth.LoginValidator] (ajp--0.0.0.0-8009-3) Login failure, user: bjvetter domain: my.testcloud.com <http://my.testcloud.com> reason: [USER_NOT_AUTHORIZED_TO_PERFORM_ACTION]
So based upon what I see in this log file, it would seem that the connect API wants to make sure that I am an admin and not a regular user.
Which gets me back to my original question: Do the REST API and the ovirt-shell require admin privileges or is there a separate uri namespace for regular users to make requests? Or perhaps more direct, should https://$ovirt-server/api/vms be accessible to non-admins or is there a different url a non-admin should use?
Brian
which version of the sdk are you using? michael - maybe user level api made it into upstream post ovirt 3.1 feature freeze (brian, in that case, it will be in ovirt 3.2, slated for freeze in novemeber/release in december)