Bug 1202457

Summary: Referencing a non-existent ACL role should error out more gracefully
Product: Red Hat Enterprise Linux 7 Reporter: Radek Steiger <rsteiger>
Component: pcsAssignee: Tomas Jelinek <tojeline>
Status: CLOSED ERRATA QA Contact: cluster-qe <cluster-qe>
Severity: unspecified Docs Contact:
Priority: medium    
Version: 7.1CC: cluster-maint, tojeline
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: pcs-0.9.140-1.el7 Doc Type: Bug Fix
Doc Text:
Cause: User runs a 'pcs acl user create' or 'pcs acl group create' command and specifies a non-existent acl role in it. Consequence: pcs dumps an invalid CIB to a terminal. Fix: Verify the acl role exists. Result: Pcs informs the user that the acl role does not exist.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2015-11-19 09:36:17 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
proposed fix none

Description Radek Steiger 2015-03-16 16:34:08 UTC 
> Description of problem:

When a non-existent ACL role is referenced within creating a user/group, pcs errors out with invalid CIB. 

[root@virt-041 ~]# pcs acl user create MyUser TestRole
Error: Unable to update cib
Call cib_replace failed (-203): Update does not conform to the configured schema
<cib crm_feature_set="3.0.9" validate-with="pacemaker-2.3" epoch="344" num_updates="0" admin_epoch="0" cib-last-written="Mon Mar 16 17:25:35 2015" have-quorum="1" dc-uuid="2">
...

[root@virt-041 ~]# pcs acl group create MyGroup TestRole
Error: Unable to update cib
Call cib_replace failed (-203): Update does not conform to the configured schema
<cib crm_feature_set="3.0.9" validate-with="pacemaker-2.3" epoch="345" num_updates="0" admin_epoch="0" cib-last-written="Mon Mar 16 17:32:51 2015" have-quorum="1" dc-uuid="2">
...

The relevant ACL part, where role definition is missing:

...
<acls>
  <acl_target id="MyUser">
    <role id="TestRole"/>
  </acl_target>
</acls>
...

We should check if the role exists before adding a user.


> Version-Release number of selected component (if applicable):
pcs-0.9.137-13.el7.x86_64
pacemaker-1.1.12-22.el7.x86_64
Comment 2 Tomas Jelinek 2015-04-17 14:22:50 UTC 
Created attachment 1015613 [details]
proposed fix
Comment 4 Tomas Jelinek 2015-06-04 14:48:41 UTC 
Before Fix:
[root@rh71-node1 ~]# rpm -q pcs
pcs-0.9.137-13.el7_1.2.x86_64
[root@rh71-node1:~]# pcs acl
ACLs are disabled, run 'pcs acl enable' to enable

[root@rh71-node1:~]# pcs acl user create MyUser TestRole
Error: Unable to update cib
Call cib_replace failed (-203): Update does not conform to the configured schema
...
[root@rh71-node1:~]# pcs acl group create MyGroup TestRole
Error: Unable to update cib
Call cib_replace failed (-203): Update does not conform to the configured schema
...



After Fix:
[root@rh71-node1:~]# rpm -q pcs
pcs-0.9.140-1.el6.x86_64
[root@rh71-node1:~]# pcs acl
ACLs are disabled, run 'pcs acl enable' to enable

[root@rh71-node1:~]# pcs acl user create MyUser TestRole
Error: cannot find acl role: TestRole
[root@rh71-node1:~]# echo $?
1
[root@rh71-node1:~]# pcs acl group create MyGroup TestRole
Error: cannot find acl role: TestRole
[root@rh71-node1:~]# echo $?
1
Comment 8 errata-xmlrpc 2015-11-19 09:36:17 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2290.html