Bug 1095420

In my setup (rhevm 3.4 av8.1), I had same problem as well with 2 admin users.
It is not clear from where the second admin users came from.
here's my users table: 

engine=# select name , domain from users ;
   name   |        domain         
----------+-----------------------
 vdcadmin | qa.lab.tlv.redhat.com
 admin    | qa.lab.tlv.redhat.com
 admin    | internal
(3 rows)

engine=# select * from users ;
               user_id                |   name   | surname |        domain         | username |                                                                                                                                              
      groups                                                                                                                                                     | department | role | email | note | last_admin_check_status |              
                                                                                             group_ids                                                                                                           |                    externa
l_id                    | active 
--------------------------------------+----------+---------+-----------------------+----------+----------------------------------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+------+-------+------+-------------------------+--------------
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------------
------------------------+--------
 9b9002d1-ec33-4083-8a7b-31f6b8931648 | vdcadmin |         | qa.lab.tlv.redhat.com | vdcadmin | qa.lab.tlv.redhat.com/QA-All-Users/testGroup,qa.lab.tlv.redhat.com/frodo1-id-21324444,dc.eng.lab.tlv.redhat.com/Users/universe,qa.lab.tlv.red
hat.com/Builtin/Administrators                                                                                                                                   |            |      |       |      | t                       | 00000000-0000
-0000-0000-000000000000,00000000-0000-0000-0000-000000000000,00000000-0000-0000-0000-000000000000,00000000-0000-0000-0000-000000000000                                                                           | \233\220\002\321\3543@\203
\212{1\366\270\223\026H | t
 62e8f0a0-c375-403a-a402-3daa2c384fc5 | admin    |         | qa.lab.tlv.redhat.com | admin    | qa.lab.tlv.redhat.com/QA-All-Users/RDP-Group,qa.lab.tlv.redhat.com/QA-All-Users/LocalAdmins-Group,qa.lab.tlv.redhat.com/QA-All-Users/BlueUser
s,qa.lab.tlv.redhat.com/Builtin/Administrators,qa.lab.tlv.redhat.com/QA-All-Users/QA-Members/QA_Gluster_users,qa.lab.tlv.redhat.com/QA-All-Users/QA-MembersGroup |            |      |       |      | f                       | 00000000-0000
-0000-0000-000000000000,00000000-0000-0000-0000-000000000000,00000000-0000-0000-0000-000000000000,00000000-0000-0000-0000-000000000000,00000000-0000-0000-0000-000000000000,00000000-0000-0000-0000-000000000000 | b\350\360\240\303u@:\244\0
02=\252,8O\305          | t
 fdfc627c-d875-11e0-90f0-83df133b58cc | admin    |         | internal              | admin    |                                                                                                                                              
                                                                                                                                                                 |            |      |       |      | t                       |              
                                                                                                                                                                                                                 | \375\374b|\330u\021\340\22
0\360\203\337\023;X\314 | t
(3 rows)

(In reply to Ilanit Stein from comment #5)
> In my setup (rhevm 3.4 av8.1), I had same problem as well with 2 admin users.
> It is not clear from where the second admin users came from.
> here's my users table: 
> 
> engine=# select name , domain from users ;
>    name   |        domain         
> ----------+-----------------------
>  vdcadmin | qa.lab.tlv.redhat.com
>  admin    | qa.lab.tlv.redhat.com
>  admin    | internal

I see nothing wrong here, as one user is in the "internal" domain, and the other is in the qa.lab.tlv.redhat.com domain.


> (3 rows)
> 
> engine=# select * from users ;
>                user_id                |   name   | surname |        domain  
> | username |                                                                
> 
>       groups                                                                
> | department | role | email | note | last_admin_check_status |              
>                                                                             
> group_ids                                                                   
> |                    externa
> l_id                    | active 
> --------------------------------------+----------+---------+-----------------
> ------+----------+-----------------------------------------------------------
> -----------------------------------------------------------------------------
> ------
> -----------------------------------------------------------------------------
> -----------------------------------------------------------------------------
> -------+------------+------+-------+------+-------------------------+--------
> ------
> -----------------------------------------------------------------------------
> -----------------------------------------------------------------------------
> -------------------------------------------------------+---------------------
> ------
> ------------------------+--------
>  9b9002d1-ec33-4083-8a7b-31f6b8931648 | vdcadmin |         |
> qa.lab.tlv.redhat.com | vdcadmin |
> qa.lab.tlv.redhat.com/QA-All-Users/testGroup,qa.lab.tlv.redhat.com/frodo1-id-
> 21324444,dc.eng.lab.tlv.redhat.com/Users/universe,qa.lab.tlv.red
> hat.com/Builtin/Administrators                                              
> |            |      |       |      | t                       | 00000000-0000
> -0000-0000-000000000000,00000000-0000-0000-0000-000000000000,00000000-0000-
> 0000-0000-000000000000,00000000-0000-0000-0000-000000000000                 
> | \233\220\002\321\3543@\203
> \212{1\366\270\223\026H | t
>  62e8f0a0-c375-403a-a402-3daa2c384fc5 | admin    |         |
> qa.lab.tlv.redhat.com | admin    |
> qa.lab.tlv.redhat.com/QA-All-Users/RDP-Group,qa.lab.tlv.redhat.com/QA-All-
> Users/LocalAdmins-Group,qa.lab.tlv.redhat.com/QA-All-Users/BlueUser
> s,qa.lab.tlv.redhat.com/Builtin/Administrators,qa.lab.tlv.redhat.com/QA-All-
> Users/QA-Members/QA_Gluster_users,qa.lab.tlv.redhat.com/QA-All-Users/QA-
> MembersGroup |            |      |       |      | f                       |
> 00000000-0000
> -0000-0000-000000000000,00000000-0000-0000-0000-000000000000,00000000-0000-
> 0000-0000-000000000000,00000000-0000-0000-0000-000000000000,00000000-0000-
> 0000-0000-000000000000,00000000-0000-0000-0000-000000000000 |
> b\350\360\240\303u@:\244\0
> 02=\252,8O\305          | t
>  fdfc627c-d875-11e0-90f0-83df133b58cc | admin    |         | internal       
> | admin    |                                                                
> 
>                                                                             
> |            |      |       |      | t                       |              
>                                                                             
> | \375\374b|\330u\021\340\22
> 0\360\203\337\023;X\314 | t
> (3 rows)

Created attachment 894384 [details]
engine.log

Gil - can you dump the DB so that Yair and Eli will be able to examine it?

engine=# select user_id, username, external_id from users where username ilike '%admin%';
               user_id                |  username   |                    externa
l_id                    
--------------------------------------+-------------+---------------------------
------------------------
 21d9ca24-bb82-11e0-a1c1-00145e832c40 | admin       | !\331\312$\273\202\021\340
\241\301\000\024^\203,@
 fdfc627c-d875-11e0-90f0-83df133b58cc | admin       | \375\374b|\330u\021\340\22
0\360\203\337\023;X\314
 a5c2b244-80dc-4277-b288-842779950749 | ykadmin     | \245\302\262D\200\334Bw\26
2\210\204'y\225\007I
 97223de4-45c4-11e1-a6f6-001a4a169753 | admin       | \227"=\344E\304\021\341\24
6\366\000\032J\026\227S
 9b9002d1-ec33-4083-8a7b-31f6b8931648 | vdcadmin    | \233\220\002\321\3543@\203
\212{1\366\270\223\026H
 62e8f0a0-c375-403a-a402-3daa2c384fc5 | admin       | b\350\360\240\303u@:\244\0
02=\252,8O\305
 647f6b4f-d3b4-419d-8f80-427048f02c4b | masterAdmin | d\177kO\323\264A\235\217\2
00BpH\360,K
(7 rows)

Created attachment 894413 [details]
engine log from the 3.3->3.4RC upgrade

engine log from the 3.3->3.4RC upgrade

I got an error that I'm not authorised to perdorm the action (login).

engine=> select * from users;
               user_id                | name | surname |  domain  | username | groups | department | role | email | note | last_admin_check_status | group_ids |             external_id              | active 
--------------------------------------+------+---------+----------+----------+--------+------------+------+-------+------+-------------------------+-----------+--------------------------------------+--------
 fdfc627c-d875-11e0-90f0-83df133b58cc |      |         | internal | admin    |        |            |      |       |      | t                       |           | [B@44f595c3                          | f
 26f94ea1-a384-4fb2-a65c-9b6d3aabb33a |      |         | internal | admin    |        |            |      |       |      | f                       |           | fdfc627c-d875-11e0-90f0-83df133b58cc | t
(2 rows)


Note both are internal, external_is for the first is not a GUID and looks like an obect serialization.

What fixed it for me was deleting the second line and updating the remaining extrnal_id to the user_id:
delete from users where user_id='26f94ea1-a384-4fb2-a65c-9b6d3aabb33a';
update users set external_id=user_id;

After this change I've managed to log in.

(In reply to Vered Volansky from comment #12)
> I got an error that I'm not authorised to perdorm the action (login).
> 
> engine=> select * from users;
>                user_id                | name | surname |  domain  | username
> | groups | department | role | email | note | last_admin_check_status |
> group_ids |             external_id              | active 
> --------------------------------------+------+---------+----------+----------
> +--------+------------+------+-------+------+-------------------------+------
> -----+--------------------------------------+--------
>  fdfc627c-d875-11e0-90f0-83df133b58cc |      |         | internal | admin   
> |        |            |      |       |      | t                       |     
> | [B@44f595c3                          | f
>  26f94ea1-a384-4fb2-a65c-9b6d3aabb33a |      |         | internal | admin   
> |        |            |      |       |      | f                       |     
> | fdfc627c-d875-11e0-90f0-83df133b58cc | t
> (2 rows)
> 
> 
> Note both are internal, external_is for the first is not a GUID and looks
> like an obect serialization.
> 
> What fixed it for me was deleting the second line and updating the remaining
> extrnal_id to the user_id:
> delete from users where user_id='26f94ea1-a384-4fb2-a65c-9b6d3aabb33a';
> update users set external_id=user_id;
> 
> After this change I've managed to log in.

Thanks Vered,
However this is not the issue with the QA production environment.

Yair, this was the same issue that happened to me, even if it's not the same as the issue as in this bug it still have to be addressed since it seems to happen to other people as well

The bug is due to the following:
1. The environment has several users with username 'internal' in differnet domains.

2.
the following code:
InternalBrokerUtils.getUserByUPN is called by both the authentication part (authenticateUser) and the authorization part (getUserByName).

Unfortunately, getUserByUPN checks only the user name, and not the domain - thus a wrong user is checked.

This does occur in 3.5/upstream due to the following:
Internal*Command were removed , the Internal authn and authz are properly used (in 3.4 although the classes exist, they were not used).

Suggested fix:
InternalBrokerUtils.getUserByUPN will receive not just the user name, but also the domain  - then we will check the db by both parameters (user name + domain) - this will ensure we will get the proper user.

In order to test the fix (once issued) please add using an ldap domain a user named 'admin'.

(In reply to Tal Nisan from comment #14)
> Yair, this was the same issue that happened to me, even if it's not the same
> as the issue as in this bug it still have to be addressed since it seems to
> happen to other people as well

Tal -
a. Please correct me if I'm wrong - You're working on upstream, not downstream.
b. As I said - different reason. If needed - please open a different bug for that and I will take care. As you can see in my detailed explanation - the code that caused the issue no longer exists at master , so the issue you and Vered saw has to do with some other stuff.

(In reply to Yair Zaslavsky from comment #15)
> The bug is due to the following:
> 1. The environment has several users with username 'internal' in differnet
> domains.
> 
> 2.
> the following code:
> InternalBrokerUtils.getUserByUPN is called by both the authentication part
> (authenticateUser) and the authorization part (getUserByName).
> 
> Unfortunately, getUserByUPN checks only the user name, and not the domain -
> thus a wrong user is checked.
> 
> This does occur in 3.5/upstream due to the following:
> Internal*Command were removed , the Internal authn and authz are properly
> used (in 3.4 although the classes exist, they were not used).
> 
> Suggested fix:
> InternalBrokerUtils.getUserByUPN will receive not just the user name, but
> also the domain  - then we will check the db by both parameters (user name +
> domain) - this will ensure we will get the proper user.
> 
> In order to test the fix (once issued) please add using an ldap domain a
> user named 'admin'.

Correction to myself:

This does occur in 3.5/upstream due to the following: should be
"This doesn't occur".

Additional information:
Removing the additional user, carrying the same name, from users table in DB, resolve the problem.

engine=# select name, domain, user_id from users ;
   name   |        domain         |               user_id                
----------+-----------------------+--------------------------------------
 admin    | internal              | fdfc627c-d875-11e0-90f0-83df133b58cc
 vdcadmin | qa.lab.tlv.redhat.com | 9b9002d1-ec33-4083-8a7b-31f6b8931648
 admin    | qa.lab.tlv.redhat.com | 62e8f0a0-c375-403a-a402-3daa2c384fc5
(3 rows)
engine=# DELETE FROM users where user_id='62e8f0a0-c375-403a-a402-3daa2c384fc5';
DELETE 1

engine=# select name, domain, user_id from users ;
   name   |        domain         |               user_id                
----------+-----------------------+--------------------------------------
 admin    | internal              | fdfc627c-d875-11e0-90f0-83df133b58cc
 vdcadmin | qa.lab.tlv.redhat.com | 9b9002d1-ec33-4083-8a7b-31f6b8931648
(2 rows)

Upgrade succeeded.

I had one admin@domain user and one admin@internal.

#select user_id, name, domain from users;
               user_id                | name  |             domain              
--------------------------------------+-------+---------------------------------
 2f7e212f-744c-4836-87a4-340652e3edb1 | admin | ad2.rhev.lab.eng.brq.redhat.com
 fdfc627c-d875-11e0-90f0-83df133b58cc | admin | internal


after upgrade I am able to login with both users. Moving to verified.

rhevm-3.4.0-0.20.el6ev.noarch

Closing as part of 3.4.0