Bug 1520617

Summary: fog auth errors when openstack project is disabled in provider side
Product: Red Hat CloudForms Management Engine Reporter: Satoe Imaishi <simaishi>
Component: ProvidersAssignee: Marek Aufart <maufart>
Status: CLOSED ERRATA QA Contact: Ola Pavlenko <opavlenk>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.7.0CC: cpelland, gblomqui, jfrey, jhajyahy, jhardy, maufart, niroy, obarenbo
Target Milestone: GA   
Target Release: 5.9.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 5.9.0.12 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1518625 Environment:
Last Closed: 2018-03-01 13:22:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: Openstack Target Upstream Version:
Embargoed:
Bug Depends On: 1518625    
Bug Blocks:    

Comment 2 CFME Bot 2017-12-04 21:39:23 UTC
New commit detected on ManageIQ/manageiq-providers-openstack/gaprindashvili:
https://github.com/ManageIQ/manageiq-providers-openstack/commit/ac257d6c97ea1d393aaf6190dd791a2e11955c0d

commit ac257d6c97ea1d393aaf6190dd791a2e11955c0d
Author:     Samuel Lucidi <mansam.edu>
AuthorDate: Mon Dec 4 10:46:32 2017 -0500
Commit:     Satoe Imaishi <simaishi>
CommitDate: Mon Dec 4 16:33:02 2017 -0500

    Merge pull request #172 from aufi/skip_disabled_tenants
    
    Skip disabled tenants when connecting to OpenStack
    (cherry picked from commit e98c61d1a6cd585d499702800e32d97c6dfe1924)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1520617

 lib/manageiq/providers/openstack/legacy/openstack_handle/handle.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comment 3 Jad Haj Yahya 2018-02-20 15:20:23 UTC
Verified on RHOS 11, 5.9.0.21

Comment 5 Jad Haj Yahya 2018-02-22 11:08:42 UTC
I run below steps and search for the erros on log:

Steps to Reproduce:
1. Add RHOSP8 provider to Cloudforms 
2. Disable a project (on the openstack side) of which the admin user is part of
3. Check for auth errors in cloudforms logs
4. Re-enable the project on the openstack side 
5. The auth errors don't appear after the next provider refresh

I am double checking on another setup

Comment 6 Jad Haj Yahya 2018-02-22 12:27:25 UTC
I found below on other setup( RHOS 12, 5.9.0.21):

root@localhost log]# grep -i '200, 204' evm.log 
[----] W, [2018-02-22T06:32:08.504950 #17027:dfb13c]  WARN -- : MIQ(OpenstackHandle::StorageDelegate#handled_list) Forbidden to read the project: Tenant1, for collection type: directories, in provider: 10.0.0.107. Message=Expected([200, 204]) <=> Actual(403 Forbidden)
[----] W, [2018-02-22T07:04:00.119743 #17027:dfb13c]  WARN -- : MIQ(OpenstackHandle::StorageDelegate#handled_list) Forbidden to read the project: Tenant1, for collection type: directories, in provider: 10.0.0.107. Message=Expected([200, 204]) <=> Actual(403 Forbidden)
[----] W, [2018-02-22T07:15:13.082043 #17027:dfb13c]  WARN -- : MIQ(OpenstackHandle::StorageDelegate#handled_list) Forbidden to read the project: Tenant1, for collection type: directories, in provider: 10.0.0.107. Message=Expected([200, 204]) <=> Actual(403 Forbidden)
[----] W, [2018-02-22T07:18:09.391094 #17027:dfb13c]  WARN -- : MIQ(OpenstackHandle::StorageDelegate#handled_list) Forbidden to read the project: Tenant1, for collection type: directories, in provider: 10.0.0.107. Message=Expected([200, 204]) <=> Actual(403 Forbidden)

Each entry is related to one disable operation. i disabled/enabled tenant2 for 2 times and so for tenant4. As you can see, above errors talk about Tenant1

Errors I put on bug https://bugzilla.redhat.com/show_bug.cgi?id=1531120 are different from above one.

I am not sure now if these above should fail this bug

Comment 10 errata-xmlrpc 2018-03-01 13:22:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:0380