The "error: 'str' object has no attribute 'product_info'" was a red herring (mistyped url). The 401 errors for non-admins though is still quite real.
Detailed response inside ... On Oct 2, 2012, at 1:48 PM, Michael Pasternak wrote: > Hi Brian, > > On 10/02/2012 05:52 PM, Brian Vetter wrote: >> I also tried a simple connect to the home of the ovirt server in the >> ovirt-shell: >> >> [oVirt shell (disconnected)]# connect https://ovirtserver <user> <pass> >> >> error: 'str' object has no attribute 'product_info' > > this could happen if you trying connect to SSL site via HTTP protocol, > btw what sdk/cli version you're using [1]? latest sdk/cli protects against > this. > > [1] run 'info' command in cli As this turned out, the problem was due to a bad url (transposed characters). Once fixed, I'm back to the 401 error condition. >> As to your question: >> >>> i think you should get an empty list and not a 401 in any case, but just >>> to make sure - you have the user role on a specific VM and you don't see it? >> >> >> Yes, I believe this is true. If the same user logs into the user portal, he >> can see the VM and start/stop it. From the ovirt admin portal, I see the >> following permissions >> for the VM: > > does this user has any other role/s besides UserRole? No, the only role it is given is UserRole. Here is how it was applied: 1) The user was created in my directory server (that was added to the ovirt manager during setup). 2) After creating a new desktop VM, I selected the VM, selected its Permissions tab, and then added the user with the role 'UserRole' to the VM. This was all done in the ovirt-manager web app. 3) I then login to the user portal with that user account name. After refreshing the VM list (a very minor bug), I see the VM that was assigned to the user. 4) When using the ovirt-shell command, the connect command fails with an error 401 as in the following text: [oVirt shell (disconnected)]# connect https://ovirt-serveri/ 'xxx@yyyy' 'pword' error: Unauthorized, [Errno: 401] 5) If I add the "DatacenterAdmin" role, the connect command works. 6) Similarly, if I use curl, I get the same HTTPS Status 401 error. # curl --cacert $CA_FILE -X GET -H "Filter: true" -u xxx@yyyy:pword https://ovirtserver/api/vms > uservms.xml # cat uservms.xml <html><head><title>JBoss Web/7.0.0.SNAPSHOT - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 401 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>This request requires HTTP authentication ().</u></p><HR size="1" noshade="noshade"><h3>JBoss Web/7.0.0.SNAPSHOT</h3></body></html>[bjv@eos ~]$ 7) I see the following when I use ovirt -d and do the connect: send: 'GET /api HTTP/1.1\r\nHost: eos.testcloud.com\r\nAccept-Encoding: identity\r\nPrefer: persistent-auth\r\nContent-type: application/xml\r\nAuthorization: Basic Ymp2ZXR0ZXJAZHJvaWRjbG91ZC5tb2JpOmxvc3QrZm91bmQ=\r\n\r\n' reply: 'HTTP/1.1 401 Unauthorized\r\n' header: Date: Wed, 03 Oct 2012 03:24:53 GMT header: Set-Cookie: JSESSIONID=n3Ex3mxsvzTEM3rlkiHa85mP.undefined; Path=/api; Secure header: WWW-Authenticate: Basic realm="ENGINE" header: Content-Type: text/html;charset=utf-8 header: Content-Length: 962 header: Connection: close Clearly, the ovirt-shell and curl are making the same request and getting the same error response. The engine.log file in /var/log/ovirt-engine has the following after I try to connect: 2012-10-02 22:28:37,489 INFO [org.ovirt.engine.core.bll.LoginAdminUserCommand] (ajp--0.0.0.0-8009-3) Checking if user bjvetter is an admin, result false 2012-10-02 22:28:37,490 WARN [org.ovirt.engine.core.bll.LoginAdminUserCommand] (ajp--0.0.0.0-8009-3) CanDoAction of action LoginAdminUser failed. Reasons:USER_NOT_AUTHORIZED_TO_PERFORM_ACTION 2012-10-02 22:28:37,491 INFO [org.ovirt.engine.api.restapi.security.auth.LoginValidator] (ajp--0.0.0.0-8009-3) Login failure, user: bjvetter domain: my.testcloud.com reason: [USER_NOT_AUTHORIZED_TO_PERFORM_ACTION] So based upon what I see in this log file, it would seem that the connect API wants to make sure that I am an admin and not a regular user. Which gets me back to my original question: Do the REST API and the ovirt-shell require admin privileges or is there a separate uri namespace for regular users to make requests? Or perhaps more direct, should https://$ovirt-server/api/vms be accessible to non-admins or is there a different url a non-admin should use? Brian
_______________________________________________ Users mailing list [email protected] http://lists.ovirt.org/mailman/listinfo/users
