> Description of problem:

A special corner case failure exists for authorization if: 
 - it is invoked from one of the cluster nodes
 - that cluster node is not included in the authorization list
 - other nodes already do have a tokens/pcs_users file present


Let's have 4 nodes:

[root@virt-142 ~]# pcs status nodes corosync
Corosync Nodes:
 Online: virt-142 virt-143 virt-144 virt-145 
 Offline: 

Remove tokens from all nodes:

[root@virt-142 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
[root@virt-143 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
[root@virt-144 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
[root@virt-145 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf

First pass goes through - running on virt-142 however virt-142 itself will not be authed:

[root@virt-142 ~]# pcs cluster auth virt-143 virt-144 virt-145 -uhacluster -ppassword
virt-143: Authorized
virt-145: Authorized
virt-144: Authorized
Error: Unable to synchronize and save tokens on nodes: virt-142. Are they authorized?

Running the same thing second time fails:

[root@virt-142 ~]# pcs cluster auth virt-143 virt-144 virt-145 -uhacluster -ppassword
Error: Some nodes had a newer tokens than the local node. Local node's tokens were updated. Please repeat the authentication if needed.
Error: Unable to communicate with pcsd


> Version-Release number of selected component (if applicable):

pcs-0.9.143-11.el7.x86_64


> Workaround:

Exists, just add the local node to the list of nodes to be authorized.