Bug 638736 - pulp-admin user delete lets you delete the admin / last user
Summary: pulp-admin user delete lets you delete the admin / last user
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Pulp
Classification: Retired
Component: z_other
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
: ---
Assignee: Jeff Ortel
QA Contact: Preethi Thomas
URL:
Whiteboard:
Depends On:
Blocks: pulp-verified
TreeView+ depends on / blocked
 
Reported: 2010-09-29 19:19 UTC by Preethi Thomas
Modified: 2011-08-16 14:01 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2011-08-16 14:01:45 UTC
Embargoed:


Attachments (Terms of Use)

Description Preethi Thomas 2010-09-29 19:19:32 UTC
Description of problem:


[root@preethi ~]# pulp-admin user delete --deleteusername=preethi
 Successfully deleted User [ preethi ] 
[root@preethi ~]# pulp-admin user list
+-------------------------------------------+
             Available Users                 
+-------------------------------------------+

Login :               	admin                        
Name  :               	None                     

[root@preethi ~]# pulp-admin user delete --deleteusername=admin
 Successfully deleted User [ admin ] 
[root@preethi ~]# pulp-admin user list
"Authorization failed. Check your username and password or your certificate"
[root@preethi ~]# pulp-admin -u admin -p admin user list
"Authorization failed. Check your username and password or your certificate"
[root@preethi ~]# 


[root@preethi ~]# pulp-admin auth
usage: pulp-admin -u <username> -p <password> auth
Supported Actions:
	login          Stores user credentials on this machine
	logout         Removes stored user credentials on this machine


[root@preethi ~]# pulp-admin auth login -u admin -p admin
Traceback (most recent call last):
  File "/usr/bin/pulp-admin", line 30, in <module>
    pulpcli.PulpCore().main()
  File "/usr/lib/python2.6/site-packages/pulp/client/pulpcli.py", line 108, in main
    cmd.main()
  File "/usr/lib/python2.6/site-packages/pulp/client/core/basecore.py", line 151, in main
    self._do_core()
  File "/usr/lib/python2.6/site-packages/pulp/client/core/core_auth.py", line 64, in _do_core
    self._login()
  File "/usr/lib/python2.6/site-packages/pulp/client/core/core_auth.py", line 74, in _login
    cert_dict = self.authconn.admin_certificate()
  File "/usr/lib/python2.6/site-packages/pulp/client/connection.py", line 549, in admin_certificate
    return self.conn.request_get(method)
  File "/usr/lib/python2.6/site-packages/pulp/client/connection.py", line 121, in request_get
    return self._request("GET", method)
  File "/usr/lib/python2.6/site-packages/pulp/client/connection.py", line 109, in _request
    self.validateResponse(response)
  File "/usr/lib/python2.6/site-packages/pulp/client/connection.py", line 117, in validateResponse
    raise RestlibException(response.status, response.read())
pulp.client.connection.RestlibException: 401: "Authorization failed. Check your username and password or your certificate"

[root@preethi ~]# pulp-admin -u admin -p admin user create --newusername=admin --newpassword=admin
"Authorization failed. Check your username and password or your certificate"
[root@preethi ~]#

Comment 1 Pradeep Kilambi 2010-10-06 16:06:49 UTC
scoped for sprint 16. Make sure its checking for atleast one user.

Comment 2 Mike McCune 2010-10-06 16:08:35 UTC
also need to update the check we do upon httpd restart to instead of checking for the existence of the default user it checks to see that there is at least one:


class UserApi(BaseApi):

...

    def _ensure_default_admin(self):
        admin = self.user(self.default_login)
        if (admin is None):
            default_password = config.config.get('server', 'default_password')
            self.create(self.default_login, password=default_password)

update the above code to check for 1 admin vs the default.

Comment 3 Jeff Ortel 2010-10-27 20:52:42 UTC
Fixed: 20146a734471d4e2a68f58106910c02359682707

When fixing this bug I assumed that the 'admin' user and auth stuff will change significantly with RBAC implementation.

The default user should be created with the 'admin' role.  The check when removing users should be in the API instead of WS and should ensure that at least (1) user with admin privileges exists at all times.

Comment 4 Jay Dobies 2010-10-29 16:58:22 UTC
Fixed in 0.77.

Comment 5 Jay Dobies 2010-11-03 19:35:19 UTC
Fixed in build 0.78.

Comment 6 Preethi Thomas 2010-11-08 19:38:11 UTC
[root@preethi ~]# pulp-admin consumer list
+------------------------------------------+
            Consumer Information
+------------------------------------------+

Id                 	10.16.79.206             
Description        	None                     
Subscribed Repos   	/pulp/api/consumers/10.16.79.206/repoids/
Profile            	https://preethi.usersys.redhat.com:443/pulp/api/consumers/10.16.79.206/package_profile/
Additional info    	{}                       


Id                 	preethi.usersys.redhat.com
Description        	None                     
Subscribed Repos   	/pulp/api/consumers/preethi.usersys.redhat.com/repoids/
Profile            	https://preethi.usersys.redhat.com:443/pulp/api/consumers/preethi.usersys.redhat.com/package_profile/
Additional info    	{u'county': u'wake', u'country': u'us', u'country1': u'us1', u'location': u'rdu'}


[root@preethi ~]# pulp-admin user list
+------------------------------------------+
               Available Users
+------------------------------------------+

Login :               	admin                        
Name  :               	None                     


Login :               	pt-admin                     
Name  :               	                         


You have new mail in /var/spool/mail/root
[root@preethi ~]# pulp-admin user delete --help
Usage: pulp-admin <options> user delete <options>

Options:
  -h, --help           show this help message and exit
  --username=USERNAME  username of user you wish to delete (required)
[root@preethi ~]# pulp-admin user delete --username=pt-admin
Successfully deleted User [ pt-admin ]

[root@preethi ~]# pulp-admin user delete --username=admin
User [admin] not deleted

[root@preethi ~]# pulp-admin user create --username=pt-admin
Successfully created user [ pt-admin ] with name [  ]

[root@preethi ~]# pulp-admin user delete --username=admin
User [admin] not deleted

[root@preethi ~]# pulp-admin user list
+------------------------------------------+
               Available Users
+------------------------------------------+

Login :               	admin                        
Name  :               	None                     


Login :               	pt-admin                     
Name  :               	                         


[root@preethi ~]# pulp-admin user create --username=pt-admin
error: operation failed: "A user with the login, pt-admin, already exists"

[root@preethi ~]# pulp-admin user delete --username=pt-admin
Successfully deleted User [ pt-admin ]

[root@preethi ~]# pulp-admin user list
+------------------------------------------+
               Available Users
+------------------------------------------+

Login :               	admin                        
Name  :               	None                     


[root@preethi ~]#

Comment 7 Preethi Thomas 2011-08-16 14:01:45 UTC
Closing with Community Release 15

pulp-0.0.223-4.


Note You need to log in before you can comment on or make changes to this bug.