Roger Ondra!

1) su - postgres -c "psql -t engine -c \"delete from users where user_id='7f300f43-9972-4c0e-bfa9-e86df6f1659f';\""

Output:

DELETE 1

2) su - postgres -c "psql -t engine -c \"UPDATE users set domain='internal-authz'  where user_id='fdfc627c-d875-11e0-90f0-83df133b58cc';\""

Output:

ERROR:  duplicate key value violates unique constraint "users_domain_external_id_unique"
DETAIL:  Key (domain, external_id)=(internal-authz, fdfc627c-d875-11e0-90f0-83df133b58cc) already exists.

3) systemctl restart ovirt-engine.service

No login yet :(

Look at this:

ovirt-aaa-jdbc-tool user show admin

Output:
-- User admin(fdfc627c-d875-11e0-90f0-83df133b58cc) --
Namespace: *
Name: admin
ID: fdfc627c-d875-11e0-90f0-83df133b58cc
Display Name:
Email:
First Name: admin
Last Name:
Department:
Title:
Description:
Account Disabled: false
Account Unlocked At: 1970-01-01 00:00:00Z
Account Valid From: 2015-10-01 00:00:00Z
Account Valid To: 2100-01-01 00:00:00Z
Account Without Password: false
Last successful Login At: 2016-06-21 19:15:59Z
Last unsuccessful Login At: 2016-06-20 17:33:24Z
Password Valid To: 2100-01-01 00:00:00Z

su - postgres -c "psql -t engine -c \"select * from users;\""

Output:

 fdfc627c-d875-11e0-90f0-83df133b58cc | admin  |               | internal             | admin    |            |                         |      | t                       | fdfc627c-d875-11e0-90f0-83df133b58cc | 2015-09-19 21:38:44.838161-
05 | 2016-06-18 20:42:18.883738-05 | *
 16f666bb-b4c8-44c9-8264-30c3aff63a6e |        | Administrator | udistritaloas.edu.co | admin    |            |                         |      | f                       | 41cd26a2-0e0a-11e6-aa00-001a4a160159 | 2016-06-19 11:53:39.249812-
05 | 2016-06-19 12:24:41.590162-05 | *
 c01c263a-78c5-4524-a94e-c9aa38141ea9 | Julian | Tete          | internal-authz       | julian   |            | danteconrad14@gmail.com |      | f                       | 1ad3dc19-b15a-493c-9610-2ccdd0dac6af | 2016-06-20 11:22:56.483292-
05 | 2016-06-20 11:23:19.261686-05 | *
 c9dcda67-9b3e-4255-aa9f-d69043a02b2b | admin  |               | internal-authz       | admin    |            |                         |      | f                       | fdfc627c-d875-11e0-90f0-83df133b58cc | 2016-06-21 13:54:07.765767-
05 | 2016-06-21 14:15:59.352697-05 | *


su - postgres -c "psql -t engine -c \"select * from permissions;\""

Output:

 00000004-0004-0004-0004-00000000025e | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000000-0000-0000-0000-000000000000 |              4 |    1447535033
 0000000f-000f-000f-000f-000000000293 | def0000a-0000-0000-0000-def000000010 | eee00000-0000-0000-0000-123456789eee | 0000000e-000e-000e-000e-0000000002d6 |             27 |    1447535033
 00000003-0003-0003-0003-00000000009c | 00000000-0000-0000-0000-000000000001 | fdfc627c-d875-11e0-90f0-83df133b58cc | aaa00000-0000-0000-0000-123456789aaa |              1 |    1447535033
 00000006-0006-0006-0006-0000000000e3 | 00000000-0000-0000-0001-000000000002 | fdfc627c-d875-11e0-90f0-83df133b58cc | aaa00000-0000-0000-0000-123456789aaa |              1 |    1447535033
 00000011-0011-0011-0011-0000000002a9 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000010-0010-0010-0010-0000000001d1 |              4 |    1447535033
 00000013-0013-0013-0013-00000000031e | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000012-0012-0012-0012-0000000001c6 |              4 |    1447535033
 00000015-0015-0015-0015-0000000003b8 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000014-0014-0014-0014-0000000002fd |              4 |    1447535033
 00000017-0017-0017-0017-000000000388 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000016-0016-0016-0016-0000000002b0 |              4 |    1447535033
 00000019-0019-0019-0019-0000000003d5 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 00000018-0018-0018-0018-000000000314 |              4 |    1447535033
 00000027-0027-0027-0027-00000000027e | def00021-0000-0000-0000-def000000015 | eee00000-0000-0000-0000-123456789eee | aaa00000-0000-0000-0000-123456789aaa |              1 |    1447535037
 7a3917ea-b2df-444f-938c-f768feeaee04 | def00009-0000-0000-0000-def000000009 | eee00000-0000-0000-0000-123456789eee | 8fa947f7-c698-4661-aea4-a093bbd0ba0b |              4 |    1457665842
 e8abc833-b860-451c-b580-780c7d1049d4 | def0000a-0000-0000-0000-def00000000f | fdfc627c-d875-11e0-90f0-83df133b58cc | 8fa947f7-c698-4661-aea4-a093bbd0ba0b |              4 |    1457665842
 c4d609ca-f2de-4c13-a9a6-b73e9dd9c34c | def0000a-0000-0000-0000-def00000000b | fdfc627c-d875-11e0-90f0-83df133b58cc | 9881e686-90d0-4da3-85b4-b8a1b3638396 |             19 |    1463161875




2016-06-21 13:30 GMT-05:00 Ondra Machacek <omachace@redhat.com>:
On 06/21/2016 04:54 PM, Julián Tete wrote:
That's right I remove internal properties :/

This is the output of the commands:

 */usr/share/ovirt-engine/bin/o**virt-engine-role.sh --command=add
--user-name=admin --authz-name=internal-authz --role=SuperUser

*
*Output:
*

FATAL: Please specify provider namespace

You don't have to run it, I've just send it for a future reference :)
But if you for example want to add SuperUser permissions to user 'julian', you can run:

  /usr/share/ovirt-engine/bin/ovirt-engine-role.sh --command=add --principal-id='c01c263a-78c5-4524-a94e-c9aa38141ea9' --role=SuperUser --user-name=julian --authz-name=internal-authz --principal-namespace=*

And you don't need admin@internal-authz user.


*su - postgres -c "psql -t engine -c \"select * from users;\""

*
*Output:*

fdfc627c-d875-11e0-90f0-83df133b58cc | admin  |               |
internal             | admin    |            |
|      | t                       | fdfc627c-d875-11e0-90f0-83df133b58cc
| 2015-09-19 21:38:44.838161-
05 | 2016-06-18 20:42:18.883738-05 | *
 16f666bb-b4c8-44c9-8264-30c3aff63a6e |        | Administrator |
udistritaloas.edu.co <http://udistritaloas.edu.co> | admin
|            |                         |      | f
| 41cd26a2-0e0a-11e6-aa00-001a4a160159 | 2016-06-19 11:53:39.249812-
05 | 2016-06-19 12:24:41.590162-05 | *
 c01c263a-78c5-4524-a94e-c9aa38141ea9 | Julian | Tete          |
internal-authz       | julian   |            | danteconrad14@gmail.com
 <mailto:danteconrad14@gmail.com> |      | f                       |
1ad3dc19-b15a-493c-9610-2ccdd0dac6af | 2016-06-20 11:22:56.483292-
05 | 2016-06-20 11:23:19.261686-05 | *
 7f300f43-9972-4c0e-bfa9-e86df6f1659f | admin  |               |
internal-authz       | admin    |            |
|      | f                       | fdfc627c-d875-11e0-90f0-83df133b58cc
| 2016-06-19 11:43:51.644981-
05 | 2016-06-20 16:06:49.138862-05 | *
*
su - postgres -c "psql -t engine -c \"select * from permissions;\""

Ok, according to current status I would suggest you to:

 1) remove admin@internal-authz (7f300f43-9972-4c0e-bfa9-e86df6f1659f)
      $ su - postgres -c "psql -t engine -c \"delete from users where user_id='7f300f43-9972-4c0e-bfa9-e86df6f1659f';\""

  2) rename admin@internal to admin@internal-authz
      $ su - postgres -c "psql -t engine -c \"UPDATE users set domain='internal-authz'  where user_id='fdfc627c-d875-11e0-90f0-83df133b58cc;\""

Then restart ovirt-engine and try to login.

The problem here is that it tries to login with admin user which don't have any permissions, and
you have two admin users, because you have removed internal-*properties files, so it added
another one.


*
*Otput:
*


 00000004-0004-0004-0004-00000000025e |
def00009-0000-0000-0000-def000000009 |
eee00000-0000-0000-0000-123456789eee |
00000000-0000-0000-0000-000000000000 |              4 |    1447535033
 0000000f-000f-000f-000f-000000000293 |
def0000a-0000-0000-0000-def000000010 |
eee00000-0000-0000-0000-123456789eee |
0000000e-000e-000e-000e-0000000002d6 |             27 |    1447535033
 00000003-0003-0003-0003-00000000009c |
00000000-0000-0000-0000-000000000001 |
fdfc627c-d875-11e0-90f0-83df133b58cc |
aaa00000-0000-0000-0000-123456789aaa |              1 |    1447535033
 00000006-0006-0006-0006-0000000000e3 |
00000000-0000-0000-0001-000000000002 |
fdfc627c-d875-11e0-90f0-83df133b58cc |
aaa00000-0000-0000-0000-123456789aaa |              1 |    1447535033
 00000011-0011-0011-0011-0000000002a9 |
def00009-0000-0000-0000-def000000009 |
eee00000-0000-0000-0000-123456789eee |
00000010-0010-0010-0010-0000000001d1 |              4 |    1447535033
 00000013-0013-0013-0013-00000000031e |
def00009-0000-0000-0000-def000000009 |
eee00000-0000-0000-0000-123456789eee |
00000012-0012-0012-0012-0000000001c6 |              4 |    1447535033
 00000015-0015-0015-0015-0000000003b8 |
def00009-0000-0000-0000-def000000009 |
eee00000-0000-0000-0000-123456789eee |
00000014-0014-0014-0014-0000000002fd |              4 |    1447535033
 00000017-0017-0017-0017-000000000388 |
def00009-0000-0000-0000-def000000009 |
eee00000-0000-0000-0000-123456789eee |
00000016-0016-0016-0016-0000000002b0 |              4 |    1447535033
 00000019-0019-0019-0019-0000000003d5 |
def00009-0000-0000-0000-def000000009 |
eee00000-0000-0000-0000-123456789eee |
00000018-0018-0018-0018-000000000314 |              4 |    1447535033
 00000027-0027-0027-0027-00000000027e |
def00021-0000-0000-0000-def000000015 |
eee00000-0000-0000-0000-123456789eee |
aaa00000-0000-0000-0000-123456789aaa |              1 |    1447535037
 7a3917ea-b2df-444f-938c-f768feeaee04 |
def00009-0000-0000-0000-def000000009 |
eee00000-0000-0000-0000-123456789eee |
8fa947f7-c698-4661-aea4-a093bbd0ba0b |              4 |    1457665842
 e8abc833-b860-451c-b580-780c7d1049d4 |
def0000a-0000-0000-0000-def00000000f |
fdfc627c-d875-11e0-90f0-83df133b58cc |
8fa947f7-c698-4661-aea4-a093bbd0ba0b |              4 |    1457665842
 c4d609ca-f2de-4c13-a9a6-b73e9dd9c34c |
def0000a-0000-0000-0000-def00000000b |
fdfc627c-d875-11e0-90f0-83df133b58cc |
9881e686-90d0-4da3-85b4-b8a1b3638396 |             19 |    1463161875


2016-06-21 9:18 GMT-05:00 Ondra Machacek <omachace@redhat.com
<mailto:omachace@redhat.com>>:


    On 06/20/2016 08:33 PM, Julián Tete wrote:

        Thanks Ondra :)

        With the command:

        su - postgres -c "psql -t engine -c \"insert into permissions values
        ('0000001b-001b-001b-001b-00000000029f',
        '00000000-0000-0000-0000-000000000001',
        'fdfc627c-d875-11e0-90f0-83df133b58cc',
        'aaa00000-0000-0000-0000-123456789aaa', 1);\""


    I've just remembered, that there is bash script for it:

     /usr/share/ovirt-engine/bin/ovirt-engine-role.sh

    You can use it as follows:

     /usr/share/ovirt-engine/bin/ovirt-engine-role.sh --command=add
    --user-name=admin --authz-name=internal-authz --role=SuperUser

    But, as per your output above, obviously your problem is not missing
    permissions.
    I think the problem is that you removed internal*.properties files
    and then re-add it.
    Can you please send output of users table and permissions table. Thanks.

     su - postgres -c "psql -t engine -c \"select * from users;\""
     su - postgres -c "psql -t engine -c \"select * from permissions;\""

        I get:

        ERROR:  duplicate key value violates unique constraint
        "idx_combined_ad_role_object"
        DETAIL:  Key (ad_element_id, role_id,
        object_id)=(fdfc627c-d875-11e0-90f0-83df133b58cc,
        00000000-0000-0000-0000-000000000001,
        aaa00000-0000-0000-0000-123456789aaa) already exists.

        History

          261  yum install ovirt-engine-extension-aaa-ldap
          262  cp -r
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/ad/aaa/profile1.properties
        /etc/ovirt-engine/
          263  cd /etc/ovirt-engine/
          264  ll
          265  vim profile1.properties
          266  ll
          267  cd cp
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/*
        /etc/ovirt-engine/extensions.d/
          268  cd cp /usr/share/ovirt-engine-extension-aaa-ldap/examples/
          269  cd
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/
          270  ll
          271  cp
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/*
        /etc/ovirt-engine/extensions.d/
          272  cd /etc/ovirt-engine/extensions.d/
          273  ll
          274  find / -type f -iname profile1.properties
          275  cp -r
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/ad/aaa/profile1.properties
        /etc/ovirt-engine/aaa/
          276  find / -type f -iname profile1.properties
          277  vim /etc/ovirt-engine/aaa/profile1.properties
          278  chown ovirt:ovirt /etc/ovirt-engine/aaa/profile1.properties
          279  chmod 600 /etc/ovirt-engine/aaa/profile1.properties
          280  systemctl restart ovirt-engine
          281  vim /etc/ovirt-engine/extensions.d/profile1-authn.properties
          282  cd /usr/share/
          283  ls
          284  cd ovirt-engine-aaa-ldap
          285  ls
          286  cd ovirt-engine-extension-aaa-ldap/
          287  ls
          288  cd examples/
          289  ls
          290  cd ad
          291  ls
          292  cd extensions.d/
          293  ls
          294  vim profile1-authn.properties
          295  pwd
          296  cd ..
          297  pwd
          298  cd ..
          299  ls
          300  cd simple
          301  ls
          302  cd aaa/
          303  ls
          304  vim profile1.properties
          305  pwd
          306  rm -rf /etc/ovirt-engine/aaa/profile1.properties
          307  cp -r
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/aaa/profile1.properties
        /etc/ovirt-engine/aaa/
          308  vim /etc/ovirt-engine/aaa/profile1.properties
          309  history
          310  chown ovirt:ovirt /etc/ovirt-engine/aaa/profile1.properties
          311  chmod 600 /etc/ovirt-engine/aaa/profile1.properties
          312  systemctl restart ovirt-engine
          313  updatedb
          314  locate domain1-authn.properties
          315  history
          316  cd
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/aaa/
          317  ll
          318  cd
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/
          319  ls
          320  cd extensions.d/
          321  ls
          322  pwd
          323  cd /etc/ovirt-engine/extensions.d/
          324  ls
          325  cp -r
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/
        /etc/ovirt-engine/extensions.d/
          326   cp -r
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/*
        /etc/ovirt-engine/extensions.d/
          327  rm -rf
        /etc/ovirt-engine/extensions.d/profile1-authn.properties
          328  rm -rf
        /etc/ovirt-engine/extensions.d/profile1-authz.properties
          329   cp -r
        /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/extensions.d/*
        /etc/ovirt-engine/extensions.d/
          330  ll
          331  history
          332  chown ovirt:ovirt /etc/ovirt-engine/extensions.d/*
          333  chmod 600 /etc/ovirt-engine/extensions.d/*
          334  ll
          335  cd extensions.d/
          336  ll
          337  cd
          338  engine-config -s SASL_QOP=auth
          339  systemctl restart ovirt-engine
          340  engine-manage-domains add --domain=udistritaloas.edu.co
        <http://udistritaloas.edu.co>
        <http://udistritaloas.edu.co> --provider=ipa --user=admin
        --ldap-servers=freeipa.udistritaloas.edu.co
        <http://freeipa.udistritaloas.edu.co>
        <http://freeipa.udistritaloas.edu.co>
          341  systemctl restart ovirt-engine
          342  engine-manage-domains list
          343  history
          344  cd /etc/ovirt-engine/extensions.d/
          345  ll
          346  rm -rf internal-authn.properties
          347  rm -rf internal-authz.properties
          348  rm -rf profile1-authn.properties
          349  rm -rf profile1-authz.properties
          350  history
          351  cd /etc/ovirt-engine/aaa/
          352  ll
          353  rm -rf profile1.properties
          354  vim internal.properties
          355  systemctl restart ovirt-engine
          356  ovirt-aaa-jdbc-tool user edit admin
        --account-valid-to="2100-01-01 00:00:00Z"
          357  ovirt-aaa-jdbc-tool user password-reset admin
        --password-valid-to="2100-01-01 00:00:00Z"
          358  engine-config -s AdminPassword=interactive
          359  ovirt-aaa-jdbc-tool user password-reset admin
        --password-valid-to="2100-01-01 00:00:00Z"
          360  systemctl restart ovirt-engine
          361  exit
          362  cd /etc/ovirt-engine/aaa/
          363  ll
          364  vim internal.properties
          365  /etc/ovirt-engine/extensions.d/
          366  cd /etc/ovirt-engine/extensions.d/
          367  ll
          368  cd extensions.d/
          369  ll
          370  pwd
          371  ll
          372  cd ..
          373  ll
          374  cd ..
          375  ll
          376  cd /etc/ovirt-engine/extensions.d/
          377  ll
          378  cd extensions.d/
          379  ll
          380  pwd
          381  ll
          382  cd ..
          383  ll
          384  systemctl restart ovirt-engine.service
          385  ovirt-aaa-jdbc-tool user edit admin
        --account-valid-to="2100-01-01 00:00:00Z"
          386  ovirt-aaa-jdbc-tool user password-reset admin
        --password-valid-to="2100-01-01 00:00:00Z"
          387  systemctl restart ovirt-engine.service
          388  ovirt-aaa-jdbc-tool user password-reset admin@internal
        --password-valid-to="2100-01-01 00:00:00Z"
          389  yum install -y ovirt-engine-extension-aaa-jdbc
          390  engine-setup
          391  ovirt-aaa-jdbc-tool user show admin
          392  ovirt-aaa-jdbc-tool settings show
          393  cd /var/log
          394  ll
          395  cd ovirt-engine
          396  ll
          397  tail -f n 100 ui.log
          398  ll
          399  tail -f -n engine.log
          400  tail -f -n 1000 engine.log
          401  tail -n 5000 engine.log | grep admin@internal
          402  ovirt-aaa-jdbc-tool user show admin
          403  ovirt-aaa-jdbc-tool user show admin@internal
          404  ovirt-aaa-jdbc-tool query --what=user
          405  engine-config -s AdminPassword=interactive
          406  vim /etc/ovirt-engine/extension.d/internal-authn.properties
          407  vim /etc/ovirt-engine/extensions.d/internal-authn.properties
          408  cd /etc/ovirt-engine/extensions.d/
          409  ll
          410  vim /etc/ovirt-engine/aaa/internal.properties
          411  cd /etc/ovirt-engine/aaa/
          412  ll
          413  vim internal.properties
          414  pwd
          415  ovirt-aaa-jdbc-tool user add julian
        --attribute=firstName=Julian     --attribute=lastName=Tete
        --attribute=email=danteconrad14@gmail.com
        <mailto:danteconrad14@gmail.com> <mailto:danteconrad14@gmail.com
        <mailto:danteconrad14@gmail.com>>
          416  ovirt-aaa-jdbc-tool user password-reset julian
        --password-valid-to="2025-08-15 10:30:00Z"
          417  history
          418  tail -n 5000 engine.log | grep admin@internal
          419  tail -n 5000 /var/log/ovirt-engine/engine.log | grep
        admin@internal
          420  ovirt-aaa-jdbc-tool user edit admin
        --account-valid-from="2015-10-01 00:00:00Z"
          421  ovirt-aaa-jdbc-tool user password-reset admin --force
        --password-valid-to="2100-01-01 00:00:00Z"
          422  systemctl restart ovirt-engine.service
          423  history
          424  ovirt-aaa-jdbc-tool query --what=user
          425  updatedb
          426  locate internal
          427  yum install -y ovirt-engine-cli
          428  cd /opt
          429  cd /opt/



        2016-06-20 13:24 GMT-05:00 Ondra Machacek <omachace@redhat.com
        <mailto:omachace@redhat.com>
         <mailto:omachace@redhat.com <mailto:omachace@redhat.com>>>:



            On 06/20/2016 06:36 PM, Julián Tete wrote:

                oVirt: 3.6.2

                Trying to use:


        https://github.com/machacekondra/ovirt-engine-kerbldap-migration

                First use:

                engine-manage-domains add --domain=udistritaloas.edu.co
        <http://udistritaloas.edu.co>
                <http://udistritaloas.edu.co>
                <http://udistritaloas.edu.co> --provider=ipa --user=admin
                --ldap-servers=freeipa.udistritaloas.edu.co
        <http://freeipa.udistritaloas.edu.co>
                <http://freeipa.udistritaloas.edu.co>
                <http://freeipa.udistritaloas.edu.co>


                The domain was added, but a I can't access to the
        webadmin portal :/

                I get the message:

                "User is not authorized to perform this action."

                In ovirt-cli

                [401] - Unauthorized

                tail -n 5000 /var/log/ovirt-engine/engine.log | grep
        admin@internal

                2016-06-20 10:52:22,835 ERROR

        [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector]
                (default task-32) [] Correlation ID: null, Call Stack:
        null, Custom
                Event ID: -1, Message: User admin@internal failed to log in.
                2016-06-20 10:52:22,836 WARN
                [org.ovirt.engine.core.bll.aaa.LoginAdminUserCommand]
        (default
                task-32)
                [] CanDoAction of action 'LoginAdminUser' failed for user
                admin@internal. Reasons:
        USER_NOT_AUTHORIZED_TO_PERFORM_ACTION
                2016-06-20 11:00:37,679 ERROR

        [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector]
                (default task-3) [] Correlation ID: null, Call Stack: null,
                Custom Event
                ID: -1, Message: User admin@internal failed to log in.
                2016-06-20 11:00:37,679 WARN
                [org.ovirt.engine.core.bll.aaa.LoginUserCommand]
        (default task-3) []
                CanDoAction of action 'LoginUser' failed for user
        admin@internal.
                Reasons: USER_NOT_AUTHORIZED_TO_PERFORM_ACTION
                2016-06-20 11:01:04,016 ERROR

        [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector]
                (default task-4) [] Correlation ID: null, Call Stack: null,
                Custom Event
                ID: -1, Message: User admin@internal failed to log in.
                2016-06-20 11:01:04,016 WARN
                [org.ovirt.engine.core.bll.aaa.LoginUserCommand]
        (default task-4) []
                CanDoAction of action 'LoginUser' failed for user
        admin@internal.
                Reasons: USER_NOT_AUTHORIZED_TO_PERFORM_ACTION


            I am little bit lost, what was your steps, to get into this
        state,
            but it looks that your admin@internal user was removed SuperUser
            permissions, I am really not sure how could you achieve
        that, but to
            fix it please run following command:

             $ su - postgres -c "psql -t engine -c \"insert into permissions
            values ('0000001b-001b-001b-001b-00000000029f',
            '00000000-0000-0000-0000-000000000001',
            'fdfc627c-d875-11e0-90f0-83df133b58cc',
            'aaa00000-0000-0000-0000-123456789aaa', 1);\""

            This command will add your admin@internal SuperUser
        permissions on
            system.

            Can you please describe what have you done a bit more, so we can
            understand the problem?

            Thanks.


                Properties of Internal domain:

                cat /etc/ovirt-engine/aaa/internal.properties

                ovirt.engine.extension.name
        <http://ovirt.engine.extension.name>
        <http://ovirt.engine.extension.name>
                <http://ovirt.engine.extension.name> =
                internal-authn
                ovirt.engine.extension.bindings.method = jbossmodule
                ovirt.engine.extension.binding.jbossmodule.module =
                org.ovirt.engine.extension.aaa.jdbc
                ovirt.engine.extension.binding.jbossmodule.class =

        org.ovirt.engine.extension.aaa.jdbc.binding.api.AuthnExtension
                ovirt.engine.extension.provides =
                org.ovirt.engine.api.extensions.aaa.Authn
                ovirt.engine.aaa.authn.profile.name
        <http://ovirt.engine.aaa.authn.profile.name>
                <http://ovirt.engine.aaa.authn.profile.name>
                <http://ovirt.engine.aaa.authn.profile.name> = internal
                ovirt.engine.aaa.authn.authz.plugin = internal-authz
                config.datasource.file =
        /etc/ovirt-engine/aaa/internal.properties

                cat /etc/ovirt-engine/extensions.d/internal-authn.properties

                ovirt.engine.extension.name
        <http://ovirt.engine.extension.name>
        <http://ovirt.engine.extension.name>
                <http://ovirt.engine.extension.name> =
                internal-authn
                ovirt.engine.extension.bindings.method = jbossmodule
                ovirt.engine.extension.binding.jbossmodule.module =
                org.ovirt.engine.extension.aaa.jdbc
                ovirt.engine.extension.binding.jbossmodule.class =

        org.ovirt.engine.extension.aaa.jdbc.binding.api.AuthnExtension
                ovirt.engine.extension.provides =
                org.ovirt.engine.api.extensions.aaa.Authn
                ovirt.engine.aaa.authn.profile.name
        <http://ovirt.engine.aaa.authn.profile.name>
                <http://ovirt.engine.aaa.authn.profile.name>
                <http://ovirt.engine.aaa.authn.profile.name> = internal
                ovirt.engine.aaa.authn.authz.plugin = internal-authz
                config.datasource.file =
        /etc/ovirt-engine/aaa/internal.properties

                cat /etc/ovirt-engine/extensions.d/internal-authz.properties

                ovirt.engine.extension.name
        <http://ovirt.engine.extension.name>
        <http://ovirt.engine.extension.name>
                <http://ovirt.engine.extension.name> =

                internal-authz
                ovirt.engine.extension.bindings.method = jbossmodule
                ovirt.engine.extension.binding.jbossmodule.module =
                org.ovirt.engine.extension.aaa.jdbc
                ovirt.engine.extension.binding.jbossmodule.class =

        org.ovirt.engine.extension.aaa.jdbc.binding.api.AuthzExtension
                ovirt.engine.extension.provides =
                org.ovirt.engine.api.extensions.aaa.Authz
                config.datasource.file =
        /etc/ovirt-engine/aaa/internal.properties

                Properties of admin@internal user:

                ovirt-aaa-jdbc-tool user show admin

                -- User admin(fdfc627c-d875-11e0-90f0-83df133b58cc) --
                Namespace: *
                Name: admin
                ID: fdfc627c-d875-11e0-90f0-83df133b58cc
                Display Name:
                Email:
                First Name: admin
                Last Name:
                Department:
                Title:
                Description:
                Account Disabled: false
                Account Unlocked At: 1970-01-01 00:00:00Z
                Account Valid From: 2015-10-01 00:00:00Z
                Account Valid To: 2100-01-01 00:00:00Z
                Account Without Password: false
                Last successful Login At: 2016-06-20 16:01:03Z
                Last unsuccessful Login At: 2016-06-19 16:53:07Z
                Password Valid To: 2100-01-01 00:00:00Z

                ¿ Can I assign privilegies to the user ? ¿ Any idea ?


                _______________________________________________
                Users mailing list
                Users@ovirt.org <mailto:Users@ovirt.org>
        <mailto:Users@ovirt.org <mailto:Users@ovirt.org>>
                http://lists.ovirt.org/mailman/listinfo/users