Bug 1526828

Summary: After upgrading to 6.3 hammer credentials are not migrated to new location - Invalid username or password
Product: Red Hat Satellite Reporter: Michal Dekan <mdekan>
Component: InstallationAssignee: Martin Bacovsky <mbacovsk>
Status: CLOSED ERRATA QA Contact: Jitendra Yejare <jyejare>
Severity: high Docs Contact:
Priority: high    
Version: 6.3.0CC: ajambhul, bbuckingham, ehelms, inecas, jyejare, mbacovsk, mdekan
Target Milestone: UnspecifiedKeywords: Triaged
Target Release: Unused   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: katello-installer-base-3.4.5.23-1,katello-installer-base-3.4.5.24-1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-02-21 16:54:17 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
foreman-debug from satellite 6.2.12 prior to upgrade none

Description Michal Dekan 2017-12-17 20:02:55 UTC
Description of problem:

Upgrading 6.2 -> 6.3 public beta does not migrate hammer login credentials from ~/.hammer/cli_config.yml (6.1, 6.2) to ~/.hammer/cli.modules.d/foreman.yml (new location in 6.3) which leads to error

# hammer organization list
Invalid username or password

~/.hammer/cli.modules.d/foreman.yml contained some random string as a password

Version-Release number of selected component (if applicable):

satellite 6.2.12 upgraded to 6.3 public beta

[root@provisioning ~]# rpm -qa | egrep "satellite|hammer"
satellite-cli-6.3.0-21.0.beta.el7sat.noarch
satellite-common-6.3.0-21.0.beta.el7sat.noarch
tfm-rubygem-hammer_cli_foreman_admin-0.0.7-1.el7sat.noarch
tfm-rubygem-hammer_cli_foreman_remote_execution-0.0.6-1.fm1_15.el7sat.noarch
tfm-rubygem-hammer_cli_foreman_bootdisk-0.1.3.3-2.el7sat.noarch
tfm-rubygem-hammer_cli_foreman-0.11.0.3-1.el7sat.noarch
tfm-rubygem-foreman_theme_satellite-1.0.4.11-1.el7sat.noarch
tfm-rubygem-hammer_cli_csv-2.3.0-1.el7sat.noarch
satellite-6.3.0-21.0.beta.el7sat.noarch
tfm-rubygem-hammer_cli_foreman_docker-0.0.6-2.el7sat.noarch
tfm-rubygem-hammer_cli_foreman_discovery-1.0.0-1.el7sat.noarch
satellite-installer-6.3.0.9-1.beta.el7sat.noarch
tfm-rubygem-hammer_cli-0.11.0.1-1.el7sat.noarch
tfm-rubygem-hammer_cli_foreman_openscap-0.1.5-1.fm1_15.el7sat.noarch
tfm-rubygem-hammer_cli_katello-0.11.3.1-1.el7sat.noarch
tfm-rubygem-hammer_cli_foreman_tasks-0.0.12-1.fm1_15.el7sat.noarch
satellite-capsule-6.3.0-21.0.beta.el7sat.noarch
tfm-rubygem-hammer_cli_foreman_virt_who_configure-0.0.3-1.el7sat.noarch


How reproducible:


Steps to Reproduce:
1. Upgrade to 6.3 with stored hammer credentials
2. Run hammer command

Actual results:

# hammer organization list
Invalid username or password

After satellite upgrade


Expected results:

satellite-installer will migrate previously stored login credentials to new location used in 6.3

Comment 4 Ivan Necas 2018-01-10 12:41:14 UTC
@martin: could you have a look at this? I wonder if this could be somehow related to https://community.theforeman.org/t/hammer-username-password-not-working-after-upgrading-to-katello-3-5/7957/9

Comment 5 Martin Bacovsky 2018-01-11 09:31:24 UTC
I was not able to reproduce yet. Do we have the machine at hand? Can I have the foreman-debug or sosreport?

Was the machine upgraded from 6.1 or was it 6.2 fresh install? Any interesting configuration tweaks?

Comment 6 Michal Dekan 2018-01-11 10:50:02 UTC
Created attachment 1379944 [details]
foreman-debug from satellite 6.2.12 prior to upgrade

Comment 7 Martin Bacovsky 2018-01-11 11:15:50 UTC
Thanks for the debug info.

The way to reproduce is
1/ install satellite 6.2
2/ change admin password in the UI
3/ update your hammer config to the new password
4/ upgrade to 6.3 (without specifying the --admin-password on the installer CLI)
5/ run hammer os list and see the error

The problem is that the hammer config changed the location and is created with the admin credentials stored in answer file [1].

Workaround is to run the upgrade with --admin-password <current admin password>
or changing the value in answer file prior the upgrade.

The config is not replaced later by puppet (even not when changed) so this issue is present only during upgrade.

[1] /etc/foreman-installer/scenarios.d/satellite-answers.yaml

Comment 9 Martin Bacovsky 2018-01-11 13:31:56 UTC
Created redmine issue http://projects.theforeman.org/issues/22250 from this bug

Comment 12 Satellite Program 2018-01-26 15:08:03 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/22431 has been resolved.

Comment 15 Jitendra Yejare 2018-02-15 16:18:46 UTC
Verified !

@ Satellite 6.3 snap 35

Steps:

1. Satellite 6.2 with hammer config creds saved under ~/.hammer/cli_config.yml
2. Upgraded to satellite 6.3
3. Verify if hammer commands return results without providing the credentials


Observation:

1. Hammer commands returned correct result of command without providing credentials.
2. No errors were thrown from hammer for invalid creds
3. The cli_config.yml carry forworded to 6.3 from 6.2 as it is, so the hammer is reading credentials from that file only.
4. The new .hammer/cli.modules.d/foreman.yml file is created but its empty.
---
:foreman: {}
5. Hammer auth status post upgrade
# hammer auth status
Using configured credentials for user 'admin'.

Comment 16 Satellite Program 2018-02-21 16:54:17 UTC
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA.
> 
> For information on the advisory, and where to find the updated files, follow the link below.
> 
> If the solution does not work for you, open a new bug report.
> 
> https://access.redhat.com/errata/RHSA-2018:0336