Bug 1347478

Summary: User and admin portal logout after a minute when using console
Product: Red Hat Enterprise Virtualization Manager Reporter: Xiaodai Wang <xiaodwan>
Component: ovirt-engineAssignee: Ravi Nori <rnori>
Status: CLOSED ERRATA QA Contact: Petr Matyáš <pmatyas>
Severity: urgent Docs Contact:
Priority: high    
Version: unspecifiedCC: cfergeau, gklein, juzhou, lsurette, mgoldboi, michal.skrivanek, mperina, mxie, mzhan, oourfali, pstehlik, rbalakri, rduda, rhev-integ, Rhev-m-bugs, srevivo, tzheng, xiaodwan, ykaul
Target Milestone: ovirt-4.0.0-rc3   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-08-23 20:42:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: Infra RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
remote-viewer log
none
ovirt server log
none
ovirt engine log none

Description Xiaodai Wang 2016-06-17 03:24:36 UTC
Description of problem:
Foreign menu doesn't display after connecting to guest in ovirt 4.0

Version-Release number of selected component (if applicable):
libgovirt-0.3.3-3.el7.x86_64
virt-viewer-2.0-8.el7.x86_64
ovirt-engine-4.0.0.4-0.1.el7ev.noarch

How reproducible:
100%

Steps to Reproduce:
1. Make sure there is an ISO domain in RHEVM server and there are several iso files in the domain.
2. Get the ca file from ovirt 4.0 server and run "trust anchor $cafile".
3. Download console.vv of the vm. 
4. Wait 1 min and then connect to the guest before the password becomes invalid by "remote-viewer console.vv"

Actual results:
Connect to guest successfully but "Change CD" menu doesn't display, and there are logs as below.

(remote-viewer:721): libsoup-CRITICAL **: soup_auth_authenticate: assertion 'username != NULL' failed
(remote-viewer:721): remote-viewer-DEBUG: failed to fetch toplevel API object: Unauthorized

Expected results:
"Change CD" menu should display correctly.

Additional info:
1. It looks like sso-token become invalid in a short time.
2. If you connect vv file quickly and make "Change CD" menu display correctly, wait a while and then active some iso menu item in "change cd" menu fails.
(remote-viewer:10715): remote-viewer-DEBUG: Refreshing foreign menu iso list

(remote-viewer:10715): libsoup-CRITICAL **: soup_auth_authenticate: assertion 'username != NULL' failed

(remote-viewer:10715): remote-viewer-WARNING **: failed to fetch files for ISO storage domain: Unauthorized
(remote-viewer:10715): remote-viewer-DEBUG: 'RHEV-toolsSetup_4.0_2.iso' clicked
(remote-viewer:10715): remote-viewer-DEBUG: Updating VM cdrom image to 'RHEV-toolsSetup_4.0_2.iso'

(remote-viewer:10715): libsoup-CRITICAL **: soup_auth_authenticate: assertion 'username != NULL' failed
(remote-viewer:10715): remote-viewer-DEBUG: Finished updating cdrom content

(remote-viewer:10715): remote-viewer-WARNING **: failed to update cdrom resource: Unauthorized
(remote-viewer:10715): remote-viewer-DEBUG: setting OvirtCdrom:file back to 'virt-p2v-1.32.5-2.el7.iso'
3. I am always logged out of web portal in a very short time and have to loggin again and again.

Comment 1 Xiaodai Wang 2016-06-17 03:25:54 UTC
Created attachment 1168897 [details]
remote-viewer log

Comment 2 Tomas Jelinek 2016-06-17 06:38:08 UTC
What do you have set in UserSessionTimeOutInterval?
e.g. 
engine-config -g UserSessionTimeOutInterval

Comment 3 Xiaodai Wang 2016-06-17 06:46:56 UTC
(In reply to Tomas Jelinek from comment #2)
> What do you have set in UserSessionTimeOutInterval?
> e.g. 
> engine-config -g UserSessionTimeOutInterval

# engine-config -g UserSessionTimeOutInterval
UserSessionTimeOutInterval: 1800 version: general

Comment 4 Tomas Jelinek 2016-06-17 07:03:38 UTC
1800 minutes seems a lot, so this is for sure not the problem. 
But it is not the default value either - have you been doing some changes around session timeouts?

> 3. I am always logged out of web portal in a very short time and have to
> loggin again and again.

How much is this very short time? Also about 1 minute of inactivity?
Seems as more generic problem than just with remote-viewer - please attach also the engine and server logs.

Comment 5 Xiaodai Wang 2016-06-17 07:34:37 UTC
(In reply to Tomas Jelinek from comment #4)
> 1800 minutes seems a lot, so this is for sure not the problem. 
> But it is not the default value either - have you been doing some changes
> around session timeouts?

yes, after i noticed this problem, i changed this value from 30 to 1800, then restarted ovirt-engine, but it still has same problem.
> 
> > 3. I am always logged out of web portal in a very short time and have to
> > loggin again and again.
> 
> How much is this very short time? Also about 1 minute of inactivity?
> Seems as more generic problem than just with remote-viewer - please attach
> also the engine and server logs.

1 minute is more than actual time. I didn't calc the accurate time. but sometime i am logged out when i am still doing operation in web portal.

Where to get the engine and server logs?

Comment 6 Tomas Jelinek 2016-06-17 08:16:40 UTC
> Where to get the engine and server logs?

On the machine where the engine is running here:
/var/log/ovirt-engine/engine.log
/var/log/ovirt-engine/server.log

Comment 7 Xiaodai Wang 2016-06-17 08:23:28 UTC
Created attachment 1168971 [details]
ovirt server log

Comment 8 Xiaodai Wang 2016-06-17 08:24:03 UTC
Created attachment 1168973 [details]
ovirt engine log

Comment 9 Tomas Jelinek 2016-06-17 12:26:39 UTC
@Martin, any idea why would the session expire every e.g. 1 minute?

Comment 10 Martin Perina 2016-06-18 08:48:05 UTC
*** Bug 1347706 has been marked as a duplicate of this bug. ***

Comment 11 Martin Perina 2016-06-18 08:50:14 UTC
There is a bug in ovirt-engine SSO implementation, so moving bug to infra

Comment 12 Michal Skrivanek 2016-06-20 07:42:07 UTC
this causes logoff in a minute every time a user opens a console using virt-viewer (which is the default and recommended way now in 4.0 since we removed plugins)

Comment 13 Petr Matyáš 2016-06-22 07:50:56 UTC
Verified on ovirt-engine-4.0.0.6-0.1.el7ev.noarch

Comment 15 errata-xmlrpc 2016-08-23 20:42:55 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-1743.html