Bug 1658089 - Can't connect to vCenter6.7 with non-administrator user by virsh
Summary: Can't connect to vCenter6.7 with non-administrator user by virsh
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libvirt
Version: 7.6
Hardware: x86_64
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Pino Toscano
QA Contact: mxie@redhat.com
URL:
Whiteboard:
Depends On: 1658038
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-12-11 08:44 UTC by mxie@redhat.com
Modified: 2019-03-29 09:53 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1658038
Environment:
Last Closed: 2019-03-29 09:53:39 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description mxie@redhat.com 2018-12-11 08:44:13 UTC
Can reproduce the problem on rhel7 with below builds:

libvirt-4.5.0-10.el7_6.2.x86_64
qemu-kvm-rhev-2.12.0-19.el7_6.2.x86_64


+++ This bug was initially created as a clone of Bug #1658038 +++

Description of problem:
Can't connect to vCenter6.7 with non-administrator user by virsh

Version-Release number of selected component (if applicable):
libvirt-4.5.0-15.module+el8+2285+e990ac42.x86_64
qemu-kvm-2.12.0-44.module+el8+2259+6d80f0a6.x86_64


How reproducible:
100%


Steps to Reproduce:
1.Check virt-v2v manual page about VCenter NON-ADMINISTRATOR ROLE

VCENTER: NON-ADMINISTRATOR ROLE
       Instead of using the vCenter Administrator role, you can create a custom non-
       administrator role to perform the conversion.  You will however need to give
       it a minimum set of permissions as follows:

       1.  Create a custom role in vCenter.

       2.  Enable (check) the following objects:

            Datastore:
             - Browse datastore
             - Low level file operations

            Sessions:
             - Validate session

            Virtual Machine:
              Provisioning:
                - Allow disk access
                - Allow read-only disk access
                - Guest Operating system management by VIX API

2. Create a custom permission role in vsphere 6.7 web client
Log into vsphere client web with administrator account -> open 'Home' interface -> Administrator->select "role" -> click "+" -> select related permission to enable the following objects:
          Datastore:
             - Browse datastore
             - Low level file operations

            Sessions:
             - Validate session

            Virtual Machine:
              Provisioning:
                - Allow disk access
                - Allow read-only disk access
               Interaction:
                - Guest Operating system management by VIX API

3.Add a new user mxie and set password
3.1 From the Home menu, select Administration
3.2 Under Single Sign On, click Users and Groups,on the Users tab, click Add User.
3.3 Enter a user name and password for the new user.

4. Add the user "mxie" to role of step1
4.1 Go to vcenter's permission option, set role of step1 to the user


5.Use virsh to connect to vCenter6.7 with non-administrator user
# virsh -c  vpx://vsphere.local%5cmxie.73.141/data/10.73.75.219/?no_verify=1
Enter vsphere.local\mxie's password for 10.73.73.141:
error: failed to connect to the hypervisor
error: internal error: Could not find datacenter specified in '/data/10.73.75.219/'



Actual results:
As above description

Expected results:
Can connect to vCenter6.7 with non-administrator user by virsh

Additional info:
1.Can connect to vCenter6.7 with administrator user by virsh
2.Can connect to vCenter6.0 with non-administrator user by virsh
3.Can reproduce the problem on rhel7 with below builds:

libvirt-4.5.0-10.el7_6.2.x86_64
qemu-kvm-rhev-2.12.0-19.el7_6.2.x86_64

Comment 2 Pino Toscano 2019-03-29 09:53:39 UTC
As discussed in bug 1658038, the issue was the lack of recursive changes of the roles of the newly created user to all the objects in the VMware installation.

Hence, closing as NOTABUG.


Note You need to log in before you can comment on or make changes to this bug.