[ovirt-users] ovirtvm-console : Failed to execute login on behalf - for user
Nathanaël Blanchet
blanchet at abes.fr
Tue Mar 28 15:50:43 UTC 2017
Hi,
I was trying 4.1 beta on a dev plateform in january when I first wrote
about this bug.
I'm now in 4.1 production, and the bug becomes really annoying with
serial console. Fortunately I can successfully continue to log into
webadmin with the same login.
ssh -vvv tells me the authentication succeeded, so it is nothing to do
with any special character in my password.
Here are my credentials:
[oVirt shell (connected)]# list users --show-all --kwargs
"last_name=*Blanchet"
id : aa47e979-713b-421b-bee2-8c547c1ca57f
name : Nathanaël
domain-id : 616265732E66722D617574687A
domain-name : abes.fr-authz
domain_entry_id : 4634733074656957673061686946612B6E58416939773D3D
email : blanchet at abes.fr
last_name : Blanchet
namespace : DC=levant,DC=abes,DC=fr
principal : sblanchet at levant.abes.fr
user_name : sblanchet at levant.abes.fr@abes.fr-authz
They are exaclty the same as my colleague who succeeds to authenticate
with ssh
[oVirt shell (connected)]# list users --show-all --kwargs "last_name=Couren"
id : 53c70b4a-e8e3-4fd3-b8db-cd518fc1a372
name : Michaël
domain-id : 616265732E66722D617574687A
domain-name : abes.fr-authz
domain_entry_id : 497338714735756636554F684255526544384F7476673D3D
email : couren at abes.fr
last_name : Couren
namespace : DC=levant,DC=abes,DC=fr
principal : scouren at levant.abes.fr
user_name : scouren at levant.abes.fr@abes.fr-auth
Is there anything new?
Le 02/03/2017 à 12:21, Eduardo Mayoral a écrit :
>
> Hi,
>
> I am getting exactly the same issue here with 4.1 , when trying to
> log in to the serial console over SSH.
>
>
> The user with domain is "emayoral_adm at arsyslan.es" (please note
> mailman may translate the "at" character to a textual "_at_"). The
> First name and last name as read from active directory is "Eduardo
> Mayoral" (with no quotes)
>
> The password is: 08.HJYqoce,nrW (OK, this is not the real password,
> but it has the same special characters and approximate structure and
> length)
>
> This is the engine.log output.
>
> 2017-03-02 11:13:31,917Z INFO
> [org.ovirt.engine.core.bll.aaa.LoginOnBehalfCommand] (default task-25)
> [5d9b7d18] Running command: LoginOnBehalfCommand internal: true.
> 2017-03-02 11:13:31,938Z ERROR
> [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-33) []
> OAuthException server_error: java.text.ParseException: Invalid
> character ' ' encountered.
> 2017-03-02 11:13:31,939Z ERROR
> [org.ovirt.engine.core.bll.aaa.LoginOnBehalfCommand] (default task-25)
> [5d9b7d18] Unable to create engine session: EngineException: user
> emayoral_adm at arsyslan.es in domain 'arsyslan.es-authz (Failed with
> error PRINCIPAL_NOT_FOUND and code 5200)
> 2017-03-02 11:13:31,945Z ERROR
> [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector]
> (default task-25) [5d9b7d18] EVENT_ID:
> USER_LOGIN_ON_BEHALF_FAILED(1,402), Correlation ID: 5d9b7d18, Call
> Stack: null, Custom Event ID: -1, Message: Failed to execute login on
> behalf - for user emayoral_adm at arsyslan.es.
> 2017-03-02 11:13:31,945Z ERROR
> [org.ovirt.engine.core.services.VMConsoleProxyServlet] (default
> task-25) [5d9b7d18] Error processing request: :
> java.lang.RuntimeException: Unable to create session using LoginOnBehalf
> at
> org.ovirt.engine.core.services.VMConsoleProxyServlet.availableConsoles(VMConsoleProxyServlet.java:102)
> [services.jar:]
> at
> org.ovirt.engine.core.services.VMConsoleProxyServlet.produceContentFromParameters(VMConsoleProxyServlet.java:177)
> [services.jar:]
> at
> org.ovirt.engine.core.services.VMConsoleProxyServlet.doPost(VMConsoleProxyServlet.java:213)
> [services.jar:]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
> [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]
> at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> org.ovirt.engine.core.utils.servlet.LocaleFilter.doFilter(LocaleFilter.java:66)
> [utils.jar:]
> at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
> [undertow-servlet-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805)
> [undertow-core-1.4.0.Final.jar:1.4.0.Final]
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> [rt.jar:1.8.0_121]
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> [rt.jar:1.8.0_121]
> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_121]
>
> Did you find the cause for this and possible fixes or workarounds?
>
>
> --
> Eduardo Mayoral Jimeno (emayoral at arsys.es)
> Administrador de sistemas. Departamento de Plataformas. Arsys internet.
> +34 941 620 145 ext. 5153
--
Nathanaël Blanchet
Supervision réseau
Pôle Infrastrutures Informatiques
227 avenue Professeur-Jean-Louis-Viala
34193 MONTPELLIER CEDEX 5
Tél. 33 (0)4 67 54 84 55
Fax 33 (0)4 67 54 84 14
blanchet at abes.fr
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ovirt.org/pipermail/users/attachments/20170328/ddedcf8a/attachment-0001.html>
More information about the Users
mailing list