Red Hat Bugzilla – Bug 1202457
Referencing a non-existent ACL role should error out more gracefully
Last modified: 2015-11-19 04:36:17 EST
> Description of problem: When a non-existent ACL role is referenced within creating a user/group, pcs errors out with invalid CIB. [root@virt-041 ~]# pcs acl user create MyUser TestRole Error: Unable to update cib Call cib_replace failed (-203): Update does not conform to the configured schema <cib crm_feature_set="3.0.9" validate-with="pacemaker-2.3" epoch="344" num_updates="0" admin_epoch="0" cib-last-written="Mon Mar 16 17:25:35 2015" have-quorum="1" dc-uuid="2"> ... [root@virt-041 ~]# pcs acl group create MyGroup TestRole Error: Unable to update cib Call cib_replace failed (-203): Update does not conform to the configured schema <cib crm_feature_set="3.0.9" validate-with="pacemaker-2.3" epoch="345" num_updates="0" admin_epoch="0" cib-last-written="Mon Mar 16 17:32:51 2015" have-quorum="1" dc-uuid="2"> ... The relevant ACL part, where role definition is missing: ... <acls> <acl_target id="MyUser"> <role id="TestRole"/> </acl_target> </acls> ... We should check if the role exists before adding a user. > Version-Release number of selected component (if applicable): pcs-0.9.137-13.el7.x86_64 pacemaker-1.1.12-22.el7.x86_64
Created attachment 1015613 [details] proposed fix
Before Fix: [root@rh71-node1 ~]# rpm -q pcs pcs-0.9.137-13.el7_1.2.x86_64 [root@rh71-node1:~]# pcs acl ACLs are disabled, run 'pcs acl enable' to enable [root@rh71-node1:~]# pcs acl user create MyUser TestRole Error: Unable to update cib Call cib_replace failed (-203): Update does not conform to the configured schema ... [root@rh71-node1:~]# pcs acl group create MyGroup TestRole Error: Unable to update cib Call cib_replace failed (-203): Update does not conform to the configured schema ... After Fix: [root@rh71-node1:~]# rpm -q pcs pcs-0.9.140-1.el6.x86_64 [root@rh71-node1:~]# pcs acl ACLs are disabled, run 'pcs acl enable' to enable [root@rh71-node1:~]# pcs acl user create MyUser TestRole Error: cannot find acl role: TestRole [root@rh71-node1:~]# echo $? 1 [root@rh71-node1:~]# pcs acl group create MyGroup TestRole Error: cannot find acl role: TestRole [root@rh71-node1:~]# echo $? 1
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-2290.html