Bug 1265925 - Authorization fails in a cluster if the local node is omitted from the list and tokens already exist on the other nodes
Authorization fails in a cluster if the local node is omitted from the list a...
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pcs (Show other bugs)
7.2
Unspecified Unspecified
medium Severity low
: rc
: ---
Assigned To: Tomas Jelinek
cluster-qe@redhat.com
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-24 03:33 EDT by Radek Steiger
Modified: 2017-07-21 07:06 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Radek Steiger 2015-09-24 03:33:42 EDT
> Description of problem:

A special corner case failure exists for authorization if: 
 - it is invoked from one of the cluster nodes
 - that cluster node is not included in the authorization list
 - other nodes already do have a tokens/pcs_users file present


Let's have 4 nodes:

[root@virt-142 ~]# pcs status nodes corosync
Corosync Nodes:
 Online: virt-142 virt-143 virt-144 virt-145 
 Offline: 

Remove tokens from all nodes:

[root@virt-142 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
[root@virt-143 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
[root@virt-144 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
[root@virt-145 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf

First pass goes through - running on virt-142 however virt-142 itself will not be authed:

[root@virt-142 ~]# pcs cluster auth virt-143 virt-144 virt-145 -uhacluster -ppassword
virt-143: Authorized
virt-145: Authorized
virt-144: Authorized
Error: Unable to synchronize and save tokens on nodes: virt-142. Are they authorized?

Running the same thing second time fails:

[root@virt-142 ~]# pcs cluster auth virt-143 virt-144 virt-145 -uhacluster -ppassword
Error: Some nodes had a newer tokens than the local node. Local node's tokens were updated. Please repeat the authentication if needed.
Error: Unable to communicate with pcsd


> Version-Release number of selected component (if applicable):

pcs-0.9.143-11.el7.x86_64


> Workaround:

Exists, just add the local node to the list of nodes to be authorized.
Comment 4 Tomas Rusnak 2016-06-13 05:31:31 EDT
I can confirm the issue, but workaround doesn't work for me:
# pcs cluster auth node1 node2 node3 -u hacluster -p hauser --force
node1: Authorized
node2: Authorized
node3: Authorized
Error: Unable to synchronize and save tokens on nodes: 172.20.11.131, 172.20.11.141, 172.20.11.121. Are they authorized?

# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf

# pcs cluster auth node1 node2 node3 -u hacluster -p hauser --force
node1: Authorized
node2: Authorized
node3: Authorized
Error: Unable to synchronize and save tokens on nodes: 172.20.11.131, 172.20.11.141, 172.20.11.121. Are they authorized?

pcs-0.9.143-15.el7.x86_64
corosync-2.3.4-7.el7_2.1.x86_64
Comment 5 Tomas Jelinek 2016-06-13 06:10:58 EDT
Tomas,

Try to run "pcs cluster auth 172.20.11.131, 172.20.11.141, 172.20.11.121" as the error message suggests.

Note You need to log in before you can comment on or make changes to this bug.