[Users] Authentication for REST APIs?

Wed Oct 3 03:40:18 UTC 2012

The "error: 'str' object has no attribute 'product_info'" was a red herring (mistyped url). The 401 errors for non-admins though is still quite real.

Detailed response inside ...

On Oct 2, 2012, at 1:48 PM, Michael Pasternak wrote:

> Hi Brian,
> 
> On 10/02/2012 05:52 PM, Brian Vetter wrote:
>> I also tried a simple connect to the home of the ovirt server in the ovirt-shell:
>> 
>>    [oVirt shell (disconnected)]# connect https://ovirtserver <user> <pass>
>> 
>>    error: 'str' object has no attribute 'product_info'
> 
> this could happen if you trying connect to SSL site via HTTP protocol,
> btw what sdk/cli version you're using [1]? latest sdk/cli protects against
> this.
> 
> [1] run 'info' command in cli

As this turned out, the problem was due to a bad url (transposed characters). Once fixed, I'm back to the 401 error condition.

>> As to your question:
>> 
>>>    i think you should get an empty list and not a 401 in any case, but just to make sure - you have the user role on a specific VM and you don't see it?
>> 
>> 
>> Yes, I believe this is true. If the same user logs into the user portal, he can see the VM and start/stop it. From the ovirt admin portal, I see the following permissions
>> for the VM:
> 
> does this user has any other role/s besides UserRole?

No, the only role it is given is UserRole. Here is how it was applied:

1) The user was created in my directory server (that was added to the ovirt manager during setup).
2) After creating a new desktop VM, I selected the VM, selected its Permissions tab, and then added the user with the role 'UserRole' to the VM. This was all done in the ovirt-manager web app.
3) I then login to the user portal with that user account name. After refreshing the VM list (a very minor bug), I see the VM that was assigned to the user.
4) When using the ovirt-shell command, the connect command fails with an error 401 as in the following text:

[oVirt shell (disconnected)]# connect https://ovirt-serveri/ 'xxx at yyyy' 'pword'

error: Unauthorized, [Errno: 401]
5) If I add the "DatacenterAdmin" role, the connect command works.
6) Similarly, if I use curl, I get the same HTTPS Status 401 error.

# curl --cacert $CA_FILE -X GET -H "Filter: true" -u xxx at yyyy:pword https://ovirtserver/api/vms > uservms.xml 
# cat uservms.xml
<html><head><title>JBoss Web/7.0.0.SNAPSHOT - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 401 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>This request requires HTTP authentication ().</u></p><HR size="1" noshade="noshade"><h3>JBoss Web/7.0.0.SNAPSHOT</h3></body></html>[bjv at eos ~]$

7) I see the following when I use ovirt -d and do the connect:

send: 'GET /api HTTP/1.1\r\nHost: eos.testcloud.com\r\nAccept-Encoding: identity\r\nPrefer: persistent-auth\r\nContent-type: application/xml\r\nAuthorization: Basic Ymp2ZXR0ZXJAZHJvaWRjbG91ZC5tb2JpOmxvc3QrZm91bmQ=\r\n\r\n'
reply: 'HTTP/1.1 401 Unauthorized\r\n'
header: Date: Wed, 03 Oct 2012 03:24:53 GMT
header: Set-Cookie: JSESSIONID=n3Ex3mxsvzTEM3rlkiHa85mP.undefined; Path=/api; Secure
header: WWW-Authenticate: Basic realm="ENGINE"
header: Content-Type: text/html;charset=utf-8
header: Content-Length: 962
header: Connection: close

Clearly, the ovirt-shell and curl are making the same request and getting the same error response.

The engine.log file in /var/log/ovirt-engine has the following after I try to connect:

2012-10-02 22:28:37,489 INFO  [org.ovirt.engine.core.bll.LoginAdminUserCommand] (ajp--0.0.0.0-8009-3) Checking if user bjvetter is an admin, result false
2012-10-02 22:28:37,490 WARN  [org.ovirt.engine.core.bll.LoginAdminUserCommand] (ajp--0.0.0.0-8009-3) CanDoAction of action LoginAdminUser failed. Reasons:USER_NOT_AUTHORIZED_TO_PERFORM_ACTION
2012-10-02 22:28:37,491 INFO  [org.ovirt.engine.api.restapi.security.auth.LoginValidator] (ajp--0.0.0.0-8009-3) Login failure, user: bjvetter domain: my.testcloud.com reason: [USER_NOT_AUTHORIZED_TO_PERFORM_ACTION]

So based upon what I see in this log file, it would seem that the connect API wants to make sure that I am an admin and not a regular user.

Which gets me back to my original question: Do the REST API and the ovirt-shell require admin privileges or is there a separate uri namespace for regular users to make requests? Or perhaps more direct, should https://$ovirt-server/api/vms be accessible to non-admins or is there a different url a non-admin should use?

Brian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ovirt.org/pipermail/users/attachments/20121002/b6a6da3b/attachment-0001.html>