Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
> Description of problem:
A special corner case failure exists for authorization if:
- it is invoked from one of the cluster nodes
- that cluster node is not included in the authorization list
- other nodes already do have a tokens/pcs_users file present
Let's have 4 nodes:
[root@virt-142 ~]# pcs status nodes corosync
Corosync Nodes:
Online: virt-142 virt-143 virt-144 virt-145
Offline:
Remove tokens from all nodes:
[root@virt-142 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
[root@virt-143 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
[root@virt-144 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
[root@virt-145 ~]# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
First pass goes through - running on virt-142 however virt-142 itself will not be authed:
[root@virt-142 ~]# pcs cluster auth virt-143 virt-144 virt-145 -uhacluster -ppassword
virt-143: Authorized
virt-145: Authorized
virt-144: Authorized
Error: Unable to synchronize and save tokens on nodes: virt-142. Are they authorized?
Running the same thing second time fails:
[root@virt-142 ~]# pcs cluster auth virt-143 virt-144 virt-145 -uhacluster -ppassword
Error: Some nodes had a newer tokens than the local node. Local node's tokens were updated. Please repeat the authentication if needed.
Error: Unable to communicate with pcsd
> Version-Release number of selected component (if applicable):
pcs-0.9.143-11.el7.x86_64
> Workaround:
Exists, just add the local node to the list of nodes to be authorized.
I can confirm the issue, but workaround doesn't work for me:
# pcs cluster auth node1 node2 node3 -u hacluster -p hauser --force
node1: Authorized
node2: Authorized
node3: Authorized
Error: Unable to synchronize and save tokens on nodes: 172.20.11.131, 172.20.11.141, 172.20.11.121. Are they authorized?
# rm -f /var/lib/pcsd/tokens /var/lib/pcsd/pcs_users.conf
# pcs cluster auth node1 node2 node3 -u hacluster -p hauser --force
node1: Authorized
node2: Authorized
node3: Authorized
Error: Unable to synchronize and save tokens on nodes: 172.20.11.131, 172.20.11.141, 172.20.11.121. Are they authorized?
pcs-0.9.143-15.el7.x86_64
corosync-2.3.4-7.el7_2.1.x86_64
This has already been fixed in RHEL 8: bz1554953
Due to the availability of a workaround and the current RHEL 7 life cycle stage, there will be no fix for RHEL 7.