Bug 1328011 - Engine: internal admin cannot migrate VM (permission issue)
Summary: Engine: internal admin cannot migrate VM (permission issue)
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: ovirt-engine
Classification: oVirt
Component: BLL.Virt
Version: 4.0.0
Hardware: x86_64
OS: Linux
high
high
Target Milestone: ovirt-4.0.0-beta
: 4.0.0
Assignee: Tomas Jelinek
QA Contact: Israel Pinto
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-04-18 08:48 UTC by Yaniv Kaul
Modified: 2016-07-05 07:58 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: migrating a VM using REST API without specifying the target cluster ID failed with "not authorized" error Consequence: to migrate a VM using REST API the target cluster ID had to be specified explicitly even if migrated inside the same cluster. Fix: Made sure that when migrating inside the same cluster the cluster ID does not need to be specified.
Clone Of:
Environment:
Last Closed: 2016-07-05 07:58:47 UTC
oVirt Team: Virt
Embargoed:
rule-engine: ovirt-4.0.0+
rule-engine: blocker+
rule-engine: planning_ack+
michal.skrivanek: devel_ack+
rule-engine: testing_ack+


Attachments (Terms of Use)
engine.log (844.99 KB, text/plain)
2016-04-18 08:49 UTC, Yaniv Kaul
no flags Details


Links
System ID Private Priority Status Summary Last Updated
oVirt gerrit 56287 0 master MERGED core: can not migrate vm using REST 2016-04-18 12:45:09 UTC

Description Yaniv Kaul 2016-04-18 08:48:25 UTC
Description of problem:


Version-Release number of selected component (if applicable):
[root@lago_basic_suite_master_engine ~]# rpm -qa |grep ovirt
ovirt-engine-sdk-python-3.6.5.1-0.1.20160414.git29cc886.el7.centos.noarch
ovirt-image-uploader-4.0.0-0.0.master.20160308123331.gita3e72cd.el7.centos.noarch
ovirt-engine-setup-base-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-websocket-proxy-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-wildfly-10.0.0-1.el7.x86_64
ovirt-vmconsole-proxy-1.0.1-0.0.master.20160309100203.gitdfa3c40.el7.noarch
ovirt-engine-vmconsole-proxy-helper-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-backend-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-lib-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-extensions-api-impl-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-cli-4.0.0.0-0.3.20160406.git96eba69.el7.centos.noarch
ovirt-engine-setup-plugin-ovirt-engine-common-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-wildfly-overlay-10.0.0-1.el7.noarch
ovirt-engine-setup-plugin-vmconsole-proxy-helper-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-webadmin-portal-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-extension-aaa-jdbc-1.1.0-0.0.master.20160413065605.gitb7a9e39.el7.noarch
ovirt-host-deploy-1.5.0-0.2.master.20160412084554.gitdc40d5c.el7.centos.noarch
ovirt-engine-tools-backup-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-host-deploy-java-1.5.0-0.2.master.20160412084554.gitdc40d5c.el7.centos.noarch
ovirt-engine-restapi-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-setup-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-userportal-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-iso-uploader-4.0.0-0.0.master.20160308123344.git98e29da.el7.centos.noarch
ovirt-setup-lib-1.0.2-0.0.master.20160119215211.gita8bd5cb.el7.centos.noarch
ovirt-engine-setup-plugin-websocket-proxy-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-vmconsole-1.0.1-0.0.master.20160309100203.gitdfa3c40.el7.noarch
ovirt-engine-dbscripts-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-setup-plugin-ovirt-engine-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch
ovirt-engine-tools-4.0.0-0.0.master.20160417161401.git1981ea2.el7.centos.noarch

How reproducible:
Few times already in Lago.

Steps to Reproduce:
1. Run Lago sanity.
2.
3.

Actual results:
2016-04-18 04:01:54,616 INFO  [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (DefaultQuartzScheduler_Worker-89) [] Correlation ID: 45e87384, Job ID: 739c1162-8f17-4e5a-8a4b-7a75ca0ce29b, Call Stack: null, Custom Event ID: -1, Message: VM vm0 started on Host lago_basic_suite_master_host0
2016-04-18 04:01:57,145 INFO  [org.ovirt.engine.core.bll.MigrateVmToServerCommand] (default task-18) [f17ab8f] No permission found for user '0000001a-001a-001a-001a-0000000002af' or one of the groups he is member of, when running action 'MigrateVmToServer', Required permissions are: Action type: 'USER' Action group: 'CREATE_VM' Object type: 'Cluster'  Object ID: 'null'.
2016-04-18 04:01:57,145 WARN  [org.ovirt.engine.core.bll.MigrateVmToServerCommand] (default task-18) [f17ab8f] Validation of action 'MigrateVmToServer' failed for user admin@internal-authz. Reasons: VAR__ACTION__MIGRATE,VAR__TYPE__VM,USER_NOT_AUTHORIZED_TO_PERFORM_ACTION
2016-04-18 04:01:57,151 ERROR [org.ovirt.engine.api.restapi.resource.AbstractBackendResource] (default task-18) [] Operation Failed: [User is not authorized to perform this action.]


Expected results:


Additional info:

Comment 1 Yaniv Kaul 2016-04-18 08:49:27 UTC
Created attachment 1148132 [details]
engine.log

Comment 2 Tomas Jelinek 2016-04-18 11:42:54 UTC
regression introduced by https://gerrit.ovirt.org/#/c/53092/2 - fix on the way

Comment 3 Michal Skrivanek 2016-04-18 11:54:47 UTC
workaround is to send target cluster id explicitly, hence decreasing severity

Comment 4 Yaniv Kaul 2016-04-18 11:56:11 UTC
(In reply to Michal Skrivanek from comment #3)
> workaround is to send target cluster id explicitly, hence decreasing severity

Please fix ovirt-system-tests then, or fix the bug.
I'm still unsure how it was not noticed until now.

Comment 5 David Caro 2016-04-18 12:16:37 UTC
I'm testing if the workaround works right now, will notify here

Comment 6 David Caro 2016-04-18 14:56:21 UTC
Adding this to the call did not work (not using the patch):

    migrate_params = params.Action(
        host=params.Host(
            name=sorted(host_names)[1]
        ),
        #TODO: remove once bz1328011 is solved
        cluster=params.Cluster(
            name=TEST_CLUSTER,
        ),
    )

Will try now with latest master with the merged patch

Comment 7 Tomas Jelinek 2016-04-19 06:26:22 UTC
(In reply to David Caro from comment #6)
> Adding this to the call did not work (not using the patch):
> 
>     migrate_params = params.Action(
>         host=params.Host(
>             name=sorted(host_names)[1]
>         ),
>         #TODO: remove once bz1328011 is solved
>         cluster=params.Cluster(
>             name=TEST_CLUSTER,

because only the cluster ID works, not the cluster name. Patch is following soon

>         ),
>     )
> 
> Will try now with latest master with the merged patch

Comment 8 Tomas Jelinek 2016-04-19 07:02:10 UTC
(In reply to Tomas Jelinek from comment #7)
> (In reply to David Caro from comment #6)
> > Adding this to the call did not work (not using the patch):
> > 
> >     migrate_params = params.Action(
> >         host=params.Host(
> >             name=sorted(host_names)[1]
> >         ),
> >         #TODO: remove once bz1328011 is solved
> >         cluster=params.Cluster(
> >             name=TEST_CLUSTER,
> 
> because only the cluster ID works, not the cluster name. Patch is following
> soon

after this is merged also the name will work:
https://gerrit.ovirt.org/#/c/56312/

> 
> >         ),
> >     )
> > 
> > Will try now with latest master with the merged patch

Comment 9 Israel Pinto 2016-06-22 15:00:10 UTC
Verify with:
RHEVM Version: 4.0.0.2-0.1.el7ev 
Hosts:
OS Version:RHEL - 7.2 - 9.el7_2.1
Kernel Version:3.10.0 - 327.22.1.el7.x86_64
KVM Version:2.3.0 - 31.el7_2.15
LIBVIRT Version:libvirt-1.2.17-13.el7_2.5
VDSM Version:vdsm-4.18.3-0.el7ev

Steps:
1. Create VM 
2. Migrate VM in the same cluster via REST API
Results:
VM migrate successfully

Comment 10 Sandro Bonazzola 2016-07-05 07:58:47 UTC
oVirt 4.0.0 has been released, closing current release.


Note You need to log in before you can comment on or make changes to this bug.