On 06/22/2016 05:21 PM, Julián Tete wrote:
S-O-L-V-E-D!!!
You are a Wizard Ondra Machacek!!!
Thank you very much !!! How Apache says: "It works"
Great! You are welcome
A have a question for you
In the command
su - postgres -c "psql -t engine -c \"insert into permissions values ('0000001b-001b-001b-001b-00000000029f', '00000000-0000-0000-0000-000000000001', 'fdfc627c-d875-11e0-90f0-83df133b58cc', 'aaa00000-0000-0000-0000-123456789aaa', 1);\"
What's the meaning of:
0000001b-001b-001b-001b-00000000029f
This one is id of permission. It's auto generated.
00000000-0000-0000-0000-000000000001
This one is id of role. This is id of SuperUser as you can see by running: select * from roles;
aaa00000-0000-0000-0000-123456789aaa
This one is object id, in this case it's id of system.
1
This one represent object type, it is number that represent some object for example 1 represent system object, number 2 represent Vm, number 3 Host... etc
¿?
Thanks again
2016-06-22 5:22 GMT-05:00 Ondra Machacek <omachace@redhat.com <mailto:omachace@redhat.com>>:
On 06/21/2016 09:18 PM, Julián Tete wrote:
Roger Ondra!
1) su - postgres -c "psql -t engine -c \"delete from users where user_id='7f300f43-9972-4c0e-bfa9-e86df6f1659f';\""
Output:
DELETE 1
2) su - postgres -c "psql -t engine -c \"UPDATE users set domain='internal-authz' where user_id='fdfc627c-d875-11e0-90f0-83df133b58cc';\""
Output:
ERROR: duplicate key value violates unique constraint "users_domain_external_id_unique" DETAIL: Key (domain, external_id)=(internal-authz, fdfc627c-d875-11e0-90f0-83df133b58cc) already exists.
OK, this is really strange, because this shouldn't be printed as you removed all contraints in step 1).
So, can you please first stop ovirt-engine, before running steps above? So the steps now would be:
1) service ovirt-engine stop
2) remove admin@internal-authz (c9dcda67-9b3e-4255-aa9f-d69043a02b2b) (note id changed, from last time) If there is more admin users with domain internal-authz, please remove them all. $ su - postgres -c "psql -t engine -c \"delete from users where user_id='c9dcda67-9b3e-4255-aa9f-d69043a02b2b';\""
3) rename admin@internal to admin@internal-authz $ su - postgres -c "psql -t engine -c \"UPDATE users set domain='internal-authz' where user_id='fdfc627c-d875-11e0-90f0-83df133b58cc;\""
4) service ovirt-engine start
3) systemctl restart ovirt-engine.service
No login yet :(
Look at this:
ovirt-aaa-jdbc-tool user show admin
Output: -- User admin(fdfc627c-d875-11e0-90f0-83df133b58cc) -- Namespace: * Name: admin ID: fdfc627c-d875-11e0-90f0-83df133b58cc Display Name: Email: First Name: admin Last Name: Department: Title: Description: Account Disabled: false Account Unlocked At: 1970-01-01 00:00:00Z Account Valid From: 2015-10-01 00:00:00Z Account Valid To: 2100-01-01 00:00:00Z Account Without Password: false Last successful Login At: 2016-06-21 19:15:59Z Last unsuccessful Login At: 2016-06-20 17:33:24Z Password Valid To: 2100-01-01 00:00:00Z
su - postgres -c "psql -t engine -c \"select * from users;\""
Output:
fdfc627c-d875-11e0-90f0-83df133b58cc | admin | | internal | admin | | | | t | fdfc627c-d875-11e0-90f0-83df133b58cc | 2015-09-19 21:38:44.838161- 05 | 2016-06-18 20:42:18.883738-05 | * 16f666bb-b4c8-44c9-8264-30c3aff63a6e | | Administrator | udistritaloas.edu.co <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> | admin | | | | f | 41cd26a2-0e0a-11e6-aa00-001a4a160159 | 2016-06-19 11:53:39.249812- 05 | 2016-06-19 12:24:41.590162-05 <tel:41.590162-05> | * c01c263a-78c5-4524-a94e-c9aa38141ea9 | Julian | Tete | internal-authz | julian | | danteconrad14@gmail.com <mailto:danteconrad14@gmail.com> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com>> | | f | 1ad3dc19-b15a-493c-9610-2ccdd0dac6af | 2016-06-20 11:22:56.483292- 05 | 2016-06-20 11:23:19.261686-05 | * c9dcda67-9b3e-4255-aa9f-d69043a02b2b | admin | | internal-authz | admin | | | | f | fdfc627c-d875-11e0-90f0-83df133b58cc | 2016-06-21 13:54:07.765767- 05 | 2016-06-21 14:15:59.352697-05 | *
su - postgres -c "psql -t engine -c \"select * from permissions;\""
Output:
00000004-0004-0004-0004-00000000025e | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000000-0000-0000-0000-000000000000 | 4 | 1447535033 0000000f-000f-000f-000f-000000000293 | def0000a-0000-0000-0000-def000000010 | eee00000-0000-0000-0000-123456789eee | 0000000e-000e-000e-000e-0000000002d6 | 27 | 1447535033 00000003-0003-0003-0003-00000000009c | 00000000-0000-0000-0000-000000000001 | fdfc627c-d875-11e0-90f0-83df133b58cc | aaa00000-0000-0000-0000-123456789aaa | 1 | 1447535033 00000006-0006-0006-0006-0000000000e3 | 00000000-0000-0000-0001-000000000002 | fdfc627c-d875-11e0-90f0-83df133b58cc | aaa00000-0000-0000-0000-123456789aaa | 1 | 1447535033 00000011-0011-0011-0011-0000000002a9 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000010-0010-0010-0010-0000000001d1 | 4 | 1447535033 00000013-0013-0013-0013-00000000031e | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000012-0012-0012-0012-0000000001c6 | 4 | 1447535033 00000015-0015-0015-0015-0000000003b8 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000014-0014-0014-0014-0000000002fd | 4 | 1447535033 00000017-0017-0017-0017-000000000388 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000016-0016-0016-0016-0000000002b0 | 4 | 1447535033 00000019-0019-0019-0019-0000000003d5 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000018-0018-0018-0018-000000000314 | 4 | 1447535033 00000027-0027-0027-0027-00000000027e | def00021-0000-0000-0000-def000000015 | eee00000-0000-0000-0000-123456789eee | aaa00000-0000-0000-0000-123456789aaa | 1 | 1447535037 7a3917ea-b2df-444f-938c-f768feeaee04 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 8fa947f7-c698-4661-aea4-a093bbd0ba0b | 4 | 1457665842 e8abc833-b860-451c-b580-780c7d1049d4 | def0000a-0000-0000-0000-def00000000f | fdfc627c-d875-11e0-90f0-83df133b58cc | 8fa947f7-c698-4661-aea4-a093bbd0ba0b | 4 | 1457665842 c4d609ca-f2de-4c13-a9a6-b73e9dd9c34c | def0000a-0000-0000-0000-def00000000b | fdfc627c-d875-11e0-90f0-83df133b58cc | 9881e686-90d0-4da3-85b4-b8a1b3638396 | 19 | 1463161875
2016-06-21 13:30 GMT-05:00 Ondra Machacek <omachace@redhat.com <mailto:omachace@redhat.com> <mailto:omachace@redhat.com <mailto:omachace@redhat.com>>>:
On 06/21/2016 04:54 PM, Julián Tete wrote:
That's right I remove internal properties :/
This is the output of the commands:
*/usr/share/ovirt-engine/bin/o**virt-engine-role.sh --command=add --user-name=admin --authz-name=internal-authz --role=SuperUser
* *Output: *
FATAL: Please specify provider namespace
You don't have to run it, I've just send it for a future reference :) But if you for example want to add SuperUser permissions to user 'julian', you can run:
/usr/share/ovirt-engine/bin/ovirt-engine-role.sh --command=add --principal-id='c01c263a-78c5-4524-a94e-c9aa38141ea9' --role=SuperUser --user-name=julian --authz-name=internal-authz --principal-namespace=*
And you don't need admin@internal-authz user.
*su - postgres -c "psql -t engine -c \"select * from users;\""
* *Output:*
fdfc627c-d875-11e0-90f0-83df133b58cc | admin | | internal | admin | | | | t | fdfc627c-d875-11e0-90f0-83df133b58cc | 2015-09-19 21:38:44.838161- 05 | 2016-06-18 20:42:18.883738-05 | * 16f666bb-b4c8-44c9-8264-30c3aff63a6e | | Administrator | udistritaloas.edu.co <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> | admin | | | | f | 41cd26a2-0e0a-11e6-aa00-001a4a160159 | 2016-06-19 11:53:39.249812- 05 | 2016-06-19 12:24:41.590162-05 <tel:41.590162-05> <tel:41.590162-05 <tel:41.590162-05>> | * c01c263a-78c5-4524-a94e-c9aa38141ea9 | Julian | Tete | internal-authz | julian | | danteconrad14@gmail.com <mailto:danteconrad14@gmail.com> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com>> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com>
<mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com>>> | | f | 1ad3dc19-b15a-493c-9610-2ccdd0dac6af | 2016-06-20 11:22:56.483292- 05 | 2016-06-20 11:23:19.261686-05 | * 7f300f43-9972-4c0e-bfa9-e86df6f1659f | admin | | internal-authz | admin | | | | f | fdfc627c-d875-11e0-90f0-83df133b58cc | 2016-06-19 11:43:51.644981- 05 | 2016-06-20 16:06:49.138862-05 | * * su - postgres -c "psql -t engine -c \"select * from permissions;\""
Ok, according to current status I would suggest you to:
1) remove admin@internal-authz (7f300f43-9972-4c0e-bfa9-e86df6f1659f) $ su - postgres -c "psql -t engine -c \"delete from users where user_id='7f300f43-9972-4c0e-bfa9-e86df6f1659f';\""
2) rename admin@internal to admin@internal-authz $ su - postgres -c "psql -t engine -c \"UPDATE users set domain='internal-authz' where user_id='fdfc627c-d875-11e0-90f0-83df133b58cc;\""
Then restart ovirt-engine and try to login.
The problem here is that it tries to login with admin user which don't have any permissions, and you have two admin users, because you have removed internal-*properties files, so it added another one.
* *Otput: *
00000004-0004-0004-0004-00000000025e | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000000-0000-0000-0000-000000000000 | 4 | 1447535033 0000000f-000f-000f-000f-000000000293 | def0000a-0000-0000-0000-def000000010 | eee00000-0000-0000-0000-123456789eee | 0000000e-000e-000e-000e-0000000002d6 | 27 | 1447535033 00000003-0003-0003-0003-00000000009c | 00000000-0000-0000-0000-000000000001 | fdfc627c-d875-11e0-90f0-83df133b58cc | aaa00000-0000-0000-0000-123456789aaa | 1 | 1447535033 00000006-0006-0006-0006-0000000000e3 | 00000000-0000-0000-0001-000000000002 | fdfc627c-d875-11e0-90f0-83df133b58cc | aaa00000-0000-0000-0000-123456789aaa | 1 | 1447535033 00000011-0011-0011-0011-0000000002a9 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000010-0010-0010-0010-0000000001d1 | 4 | 1447535033 00000013-0013-0013-0013-00000000031e | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000012-0012-0012-0012-0000000001c6 | 4 | 1447535033 00000015-0015-0015-0015-0000000003b8 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000014-0014-0014-0014-0000000002fd | 4 | 1447535033 00000017-0017-0017-0017-000000000388 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000016-0016-0016-0016-0000000002b0 | 4 | 1447535033 00000019-0019-0019-0019-0000000003d5 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000018-0018-0018-0018-000000000314 | 4 | 1447535033 00000027-0027-0027-0027-00000000027e | def00021-0000-0000-0000-def000000015 | eee00000-0000-0000-0000-123456789eee | aaa00000-0000-0000-0000-123456789aaa | 1 | 1447535037 7a3917ea-b2df-444f-938c-f768feeaee04 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 8fa947f7-c698-4661-aea4-a093bbd0ba0b | 4 | 1457665842 e8abc833-b860-451c-b580-780c7d1049d4 | def0000a-0000-0000-0000-def00000000f | fdfc627c-d875-11e0-90f0-83df133b58cc | 8fa947f7-c698-4661-aea4-a093bbd0ba0b | 4 | 1457665842 c4d609ca-f2de-4c13-a9a6-b73e9dd9c34c | def0000a-0000-0000-0000-def00000000b | fdfc627c-d875-11e0-90f0-83df133b58cc | 9881e686-90d0-4da3-85b4-b8a1b3638396 | 19 | 1463161875
2016-06-21 9:18 GMT-05:00 Ondra Machacek <omachace@redhat.com <mailto:omachace@redhat.com> <mailto:omachace@redhat.com <mailto:omachace@redhat.com>> <mailto:omachace@redhat.com <mailto:omachace@redhat.com> <mailto:omachace@redhat.com <mailto:omachace@redhat.com>>>>:
On 06/20/2016 08:33 PM, Julián Tete wrote:
Thanks Ondra :)
With the command:
su - postgres -c "psql -t engine -c \"insert into permissions values ('0000001b-001b-001b-001b-00000000029f', '00000000-0000-0000-0000-000000000001', 'fdfc627c-d875-11e0-90f0-83df133b58cc', 'aaa00000-0000-0000-0000-123456789aaa', 1);\""
I've just remembered, that there is bash script for it:
/usr/share/ovirt-engine/bin/ovirt-engine-role.sh
You can use it as follows:
/usr/share/ovirt-engine/bin/ovirt-engine-role.sh --command=add --user-name=admin --authz-name=internal-authz --role=SuperUser
But, as per your output above, obviously your problem is not missing permissions. I think the problem is that you removed internal*.properties files and then re-add it. Can you please send output of users table and permissions table. Thanks.
su - postgres -c "psql -t engine -c \"select * from users;\"" su - postgres -c "psql -t engine -c \"select * from permissions;\""
I get:
ERROR: duplicate key value violates unique constraint "idx_combined_ad_role_object" DETAIL: Key (ad_element_id, role_id, object_id)=(fdfc627c-d875-11e0-90f0-83df133b58cc, 00000000-0000-0000-0000-000000000001, aaa00000-0000-0000-0000-123456789aaa) already exists.
History
261 yum install ovirt-engine-extension-aaa-ldap 262 cp -r
/usr/share/ovirt-engine-extension-aaa-ldap/examples/ad/aaa/profile1.properties /etc/ovirt-engine/ 263 cd /etc/ovirt-engine/ 264 ll 265 vim profile1.properties 266 ll 267 cd cp
/usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/* /etc/ovirt-engine/extensions.d/ 268 cd cp /usr/share/ovirt-engine-extension-aaa-ldap/examples/ 269 cd
/usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/ 270 ll 271 cp
/usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/* /etc/ovirt-engine/extensions.d/ 272 cd /etc/ovirt-engine/extensions.d/ 273 ll 274 find / -type f -iname profile1.properties 275 cp -r
/usr/share/ovirt-engine-extension-aaa-ldap/examples/ad/aaa/profile1.properties /etc/ovirt-engine/aaa/ 276 find / -type f -iname profile1.properties 277 vim /etc/ovirt-engine/aaa/profile1.properties 278 chown ovirt:ovirt /etc/ovirt-engine/aaa/profile1.properties 279 chmod 600 /etc/ovirt-engine/aaa/profile1.properties 280 systemctl restart ovirt-engine 281 vim /etc/ovirt-engine/extensions.d/profile1-authn.properties 282 cd /usr/share/ 283 ls 284 cd ovirt-engine-aaa-ldap 285 ls 286 cd ovirt-engine-extension-aaa-ldap/ 287 ls 288 cd examples/ 289 ls 290 cd ad 291 ls 292 cd extensions.d/ 293 ls 294 vim profile1-authn.properties 295 pwd 296 cd .. 297 pwd 298 cd .. 299 ls 300 cd simple 301 ls 302 cd aaa/ 303 ls 304 vim profile1.properties 305 pwd 306 rm -rf /etc/ovirt-engine/aaa/profile1.properties 307 cp -r
/usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/aaa/profile1.properties /etc/ovirt-engine/aaa/ 308 vim /etc/ovirt-engine/aaa/profile1.properties 309 history 310 chown ovirt:ovirt /etc/ovirt-engine/aaa/profile1.properties 311 chmod 600 /etc/ovirt-engine/aaa/profile1.properties 312 systemctl restart ovirt-engine 313 updatedb 314 locate domain1-authn.properties 315 history 316 cd
/usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/aaa/ 317 ll 318 cd
/usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/ 319 ls 320 cd extensions.d/ 321 ls 322 pwd 323 cd /etc/ovirt-engine/extensions.d/ 324 ls 325 cp -r
/usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/ /etc/ovirt-engine/extensions.d/ 326 cp -r
/usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/* /etc/ovirt-engine/extensions.d/ 327 rm -rf
/etc/ovirt-engine/extensions.d/profile1-authn.properties 328 rm -rf
/etc/ovirt-engine/extensions.d/profile1-authz.properties 329 cp -r
/usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/* /etc/ovirt-engine/extensions.d/ 330 ll 331 history 332 chown ovirt:ovirt /etc/ovirt-engine/extensions.d/* 333 chmod 600 /etc/ovirt-engine/extensions.d/* 334 ll 335 cd extensions.d/ 336 ll 337 cd 338 engine-config -s SASL_QOP=auth 339 systemctl restart ovirt-engine 340 engine-manage-domains add --domain=udistritaloas.edu.co <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> --provider=ipa --user=admin --ldap-servers=freeipa.udistritaloas.edu.co <http://freeipa.udistritaloas.edu.co> <http://freeipa.udistritaloas.edu.co> <http://freeipa.udistritaloas.edu.co> <http://freeipa.udistritaloas.edu.co> 341 systemctl restart ovirt-engine 342 engine-manage-domains list 343 history 344 cd /etc/ovirt-engine/extensions.d/ 345 ll 346 rm -rf internal-authn.properties 347 rm -rf internal-authz.properties 348 rm -rf profile1-authn.properties 349 rm -rf profile1-authz.properties 350 history 351 cd /etc/ovirt-engine/aaa/ 352 ll 353 rm -rf profile1.properties 354 vim internal.properties 355 systemctl restart ovirt-engine 356 ovirt-aaa-jdbc-tool user edit admin --account-valid-to="2100-01-01 00:00:00Z" 357 ovirt-aaa-jdbc-tool user password-reset admin --password-valid-to="2100-01-01 00:00:00Z" 358 engine-config -s AdminPassword=interactive 359 ovirt-aaa-jdbc-tool user password-reset admin --password-valid-to="2100-01-01 00:00:00Z" 360 systemctl restart ovirt-engine 361 exit 362 cd /etc/ovirt-engine/aaa/ 363 ll 364 vim internal.properties 365 /etc/ovirt-engine/extensions.d/ 366 cd /etc/ovirt-engine/extensions.d/ 367 ll 368 cd extensions.d/ 369 ll 370 pwd 371 ll 372 cd .. 373 ll 374 cd .. 375 ll 376 cd /etc/ovirt-engine/extensions.d/ 377 ll 378 cd extensions.d/ 379 ll 380 pwd 381 ll 382 cd .. 383 ll 384 systemctl restart ovirt-engine.service 385 ovirt-aaa-jdbc-tool user edit admin --account-valid-to="2100-01-01 00:00:00Z" 386 ovirt-aaa-jdbc-tool user password-reset admin --password-valid-to="2100-01-01 00:00:00Z" 387 systemctl restart ovirt-engine.service 388 ovirt-aaa-jdbc-tool user password-reset admin@internal --password-valid-to="2100-01-01 00:00:00Z" 389 yum install -y ovirt-engine-extension-aaa-jdbc 390 engine-setup 391 ovirt-aaa-jdbc-tool user show admin 392 ovirt-aaa-jdbc-tool settings show 393 cd /var/log 394 ll 395 cd ovirt-engine 396 ll 397 tail -f n 100 ui.log 398 ll 399 tail -f -n engine.log 400 tail -f -n 1000 engine.log 401 tail -n 5000 engine.log | grep admin@internal 402 ovirt-aaa-jdbc-tool user show admin 403 ovirt-aaa-jdbc-tool user show admin@internal 404 ovirt-aaa-jdbc-tool query --what=user 405 engine-config -s AdminPassword=interactive 406 vim /etc/ovirt-engine/extension.d/internal-authn.properties 407 vim /etc/ovirt-engine/extensions.d/internal-authn.properties 408 cd /etc/ovirt-engine/extensions.d/ 409 ll 410 vim /etc/ovirt-engine/aaa/internal.properties 411 cd /etc/ovirt-engine/aaa/ 412 ll 413 vim internal.properties 414 pwd 415 ovirt-aaa-jdbc-tool user add julian --attribute=firstName=Julian --attribute=lastName=Tete --attribute=email=danteconrad14@gmail.com <mailto:danteconrad14@gmail.com> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com>> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com>>> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com>> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com> <mailto:danteconrad14@gmail.com <mailto:danteconrad14@gmail.com>>>> 416 ovirt-aaa-jdbc-tool user password-reset julian --password-valid-to="2025-08-15 10:30:00Z" 417 history 418 tail -n 5000 engine.log | grep admin@internal 419 tail -n 5000 /var/log/ovirt-engine/engine.log | grep admin@internal 420 ovirt-aaa-jdbc-tool user edit admin --account-valid-from="2015-10-01 00:00:00Z" 421 ovirt-aaa-jdbc-tool user password-reset admin --force --password-valid-to="2100-01-01 00:00:00Z" 422 systemctl restart ovirt-engine.service 423 history 424 ovirt-aaa-jdbc-tool query --what=user 425 updatedb 426 locate internal 427 yum install -y ovirt-engine-cli 428 cd /opt 429 cd /opt/
2016-06-20 13:24 GMT-05:00 Ondra Machacek <omachace@redhat.com <mailto:omachace@redhat.com> <mailto:omachace@redhat.com <mailto:omachace@redhat.com>> <mailto:omachace@redhat.com <mailto:omachace@redhat.com> <mailto:omachace@redhat.com <mailto:omachace@redhat.com>>> <mailto:omachace@redhat.com <mailto:omachace@redhat.com> <mailto:omachace@redhat.com <mailto:omachace@redhat.com>> <mailto:omachace@redhat.com <mailto:omachace@redhat.com> <mailto:omachace@redhat.com <mailto:omachace@redhat.com>>>>>:
On 06/20/2016 06:36 PM, Julián Tete wrote:
oVirt: 3.6.2
Trying to use:
https://github.com/machacekondra/ovirt-engine-kerbldap-migration
First use:
engine-manage-domains add --domain=udistritaloas.edu.co <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> <http://udistritaloas.edu.co> --provider=ipa --user=admin
--ldap-servers=freeipa.udistritaloas.edu.co <http://freeipa.udistritaloas.edu.co> <http://freeipa.udistritaloas.edu.co> <http://freeipa.udistritaloas.edu.co> <http://freeipa.udistritaloas.edu.co> <http://freeipa.udistritaloas.edu.co>
The domain was added, but a I can't access to the webadmin portal :/
I get the message:
"User is not authorized to perform this action."
In ovirt-cli
[401] - Unauthorized
tail -n 5000 /var/log/ovirt-engine/engine.log | grep admin@internal
2016-06-20 10:52:22,835 ERROR
[org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (default task-32) [] Correlation ID: null, Call Stack: null, Custom Event ID: -1, Message: User admin@internal failed to log in. 2016-06-20 10:52:22,836 WARN
[org.ovirt.engine.core.bll.aaa.LoginAdminUserCommand] (default task-32) [] CanDoAction of action 'LoginAdminUser' failed for user admin@internal. Reasons: USER_NOT_AUTHORIZED_TO_PERFORM_ACTION 2016-06-20 11:00:37,679 ERROR
[org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (default task-3) [] Correlation ID: null, Call Stack: null, Custom Event ID: -1, Message: User admin@internal failed to log in. 2016-06-20 11:00:37,679 WARN
[org.ovirt.engine.core.bll.aaa.LoginUserCommand] (default task-3) [] CanDoAction of action 'LoginUser' failed for user admin@internal. Reasons: USER_NOT_AUTHORIZED_TO_PERFORM_ACTION 2016-06-20 11:01:04,016 ERROR
[org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (default task-4) [] Correlation ID: null, Call Stack: null, Custom Event ID: -1, Message: User admin@internal failed to log in. 2016-06-20 11:01:04,016 WARN
[org.ovirt.engine.core.bll.aaa.LoginUserCommand] (default task-4) [] CanDoAction of action 'LoginUser' failed for user admin@internal. Reasons: USER_NOT_AUTHORIZED_TO_PERFORM_ACTION
I am little bit lost, what was your steps, to get into this state, but it looks that your admin@internal user was removed SuperUser permissions, I am really not sure how could you achieve that, but to fix it please run following command:
$ su - postgres -c "psql -t engine -c \"insert into permissions values ('0000001b-001b-001b-001b-00000000029f', '00000000-0000-0000-0000-000000000001', 'fdfc627c-d875-11e0-90f0-83df133b58cc', 'aaa00000-0000-0000-0000-123456789aaa', 1);\""
This command will add your admin@internal SuperUser permissions on system.
Can you please describe what have you done a bit more, so we can understand the problem?
Thanks.
Properties of Internal domain:
cat /etc/ovirt-engine/aaa/internal.properties
ovirt.engine.extension.name <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> = internal-authn ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.jdbc
ovirt.engine.extension.binding.jbossmodule.class =
org.ovirt.engine.extension.aaa.jdbc.binding.api.AuthnExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name <http://ovirt.engine.aaa.authn.profile.name> <http://ovirt.engine.aaa.authn.profile.name> <http://ovirt.engine.aaa.authn.profile.name> <http://ovirt.engine.aaa.authn.profile.name>
<http://ovirt.engine.aaa.authn.profile.name> = internal ovirt.engine.aaa.authn.authz.plugin = internal-authz config.datasource.file = /etc/ovirt-engine/aaa/internal.properties
cat /etc/ovirt-engine/extensions.d/internal-authn.properties
ovirt.engine.extension.name <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> = internal-authn ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.jdbc
ovirt.engine.extension.binding.jbossmodule.class =
org.ovirt.engine.extension.aaa.jdbc.binding.api.AuthnExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name <http://ovirt.engine.aaa.authn.profile.name> <http://ovirt.engine.aaa.authn.profile.name> <http://ovirt.engine.aaa.authn.profile.name> <http://ovirt.engine.aaa.authn.profile.name>
<http://ovirt.engine.aaa.authn.profile.name> = internal ovirt.engine.aaa.authn.authz.plugin = internal-authz config.datasource.file = /etc/ovirt-engine/aaa/internal.properties
cat /etc/ovirt-engine/extensions.d/internal-authz.properties
ovirt.engine.extension.name <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> <http://ovirt.engine.extension.name> =
internal-authz ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.jdbc
ovirt.engine.extension.binding.jbossmodule.class =
org.ovirt.engine.extension.aaa.jdbc.binding.api.AuthzExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authz config.datasource.file = /etc/ovirt-engine/aaa/internal.properties
Properties of admin@internal user:
ovirt-aaa-jdbc-tool user show admin
-- User admin(fdfc627c-d875-11e0-90f0-83df133b58cc) -- Namespace: * Name: admin ID: fdfc627c-d875-11e0-90f0-83df133b58cc Display Name: Email: First Name: admin Last Name: Department: Title: Description: Account Disabled: false Account Unlocked At: 1970-01-01 00:00:00Z Account Valid From: 2015-10-01 00:00:00Z Account Valid To: 2100-01-01 00:00:00Z Account Without Password: false Last successful Login At: 2016-06-20 16:01:03Z Last unsuccessful Login At: 2016-06-19 16:53:07Z Password Valid To: 2100-01-01 00:00:00Z
¿ Can I assign privilegies to the user ? ¿ Any idea ?
_______________________________________________ Users mailing list Users@ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>> <mailto:Users@ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>>> <mailto:Users@ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>> <mailto:Users@ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>>>>