[one-users] Fwd: ACLs and users authentification
Hector Sanjuan
hsanjuan at opennebula.org
Thu Sep 13 08:17:02 PDT 2012
Hey,
have a look to http://dev.opennebula.org/issues/1085... this is most
likely a problem with skewed clocks between the sunstone server and the
computer from which you are accessing. If the difference is > 10 mins the
the cookie expires, along with the information in it, so some things do
not work.
Sorry I realised soo late,
Hector
En Thu, 06 Sep 2012 12:49:43 +0200, Пярн Артур <dekkart at yandex.ru>
escribió:
> Thank you Hector for your reply. I'm using Chrome (last version), also
> tryed Firefox - and still the same.
> Deleting cookies haven't changed the situation. JS log without errors. I
> think I will try reinstall Sunstone later.
> But problem with dissappearing tabs appeared not first time. Some time
> ago dissapeared some tabs in host management. If there will be another
> possibilities to check - I will be glad to hear.
>
> 06.09.2012, 12:30, "Hector Sanjuan" <hsanjuan at opennebula.org>:
>> Hello,
>>
>> Which browser and version are you using? The username is missing on the
>> Welcome: label on top, which indicates there is a problem with the
>> sunstone cookie very possibly. This explains why the chown/chgrp buttons
>> are not showing either.
>>
>> Can you delete cookies and cache and reload? Check that your browser or
>> a
>> plugin of it is not blocking cookies etc. Check the browser console for
>> any errors, specially javascript-related ones. Thanks!
>>
>> Hector
>>
>> En Thu, 06 Sep 2012 09:57:12 +0200, Пярн Артур <dekkart at yandex.ru>
>> escribió:
>>
>>> Hi Carlos,
>>>
>>> Thank you very much, I understood. It seems the problem is that there
>>> is
>>> no
>>> specific tabs in sunstone they should be - to change owner and group
>>> of
>>> specific
>>> resourse (in screenshots). That's what confussed me.
>>>
>>> I found how to do it in CLI, but anyway I don't now why Sunstone
>>> working
>>> not
>>> correctly not showing some tabs. Also Sunstone doesn't show user name
>>> in
>>> greeting field (i made red circles around it)
>>>
>>> I did defualt installation and changed only system settings in
>>> sunstone.conf (ports,
>>> vnc, ip, etc.).
>>>
>>> Screenshots and sunstone log in attach (NO ERRORS FOUND).
>>>
>>> --------------------------------------
>>>
>>> Server configuration
>>>
>>> --------------------------------------
>>>
>>> {:auth=>"sunstone",
>>>
>>> :vnc_proxy_cert=>nil,
>>>
>>> :vnc_proxy_path=>"/srv/cloud/one/share/noVNC/utils/websockify",
>>>
>>> :vnc_proxy_key=>nil,
>>>
>>> :vnc_proxy_support_wss=>false,
>>>
>>> :debug_level=>3,
>>>
>>> :host=>"0.0.0.0",
>>>
>>> :vnc_proxy_base_port=>29876,
>>>
>>> :port=>8888,
>>>
>>> :one_xmlrpc=>"http://localhost:2633/RPC2",
>>>
>>> :core_auth=>"cipher",
>>>
>>> :lang=>"en_US"}
>>>
>>> == Sinatra/1.3.2 has taken the stage on 8888 for development with
>>> backup
>>> from
>>> Thin
>>>
>>> Thu Sep 06 03:24:42 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:42]
>>> "GET /
>>> HTTP/1.1"
>>> 200 1595 0.0075
>>>
>>> Thu Sep 06 03:24:42 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:42] "GET
>>> /favicon.ico
>>> HTTP/1.1" 401 - 0.0010
>>>
>>> Thu Sep 06 03:24:49 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:49]
>>> "POST
>>> /login
>>> HTTP/1.1" 204 - 0.0691
>>>
>>> Thu Sep 06 03:24:49 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:49]
>>> "GET /
>>> HTTP/1.1"
>>> 200 4630 0.0067
>>>
>>> Thu Sep 06 03:24:49 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:49] "GET
>>> /vendor/noVNC/include/plain.css
>>> HTTP/1.1" 404 466 0.0013
>>>
>>> Thu Sep 06 03:24:49 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:49] "GET
>>> /host/monitor?title=graph1&monitor_resources=cpu_usage%2Cused_cpu%2Cmax_$
>>>
>>> Thu Sep 06 03:24:49 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:49] "GET
>>> /host/monitor?title=graph2&monitor_resources=mem_usage%2Cused_mem%2Cmax_$
>>>
>>> Thu Sep 06 03:24:49 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:49] "GET
>>> /vm/monitor?title=graph3&monitor_resources=total%2Cactive%2Cerror&histor$
>>>
>>> Thu Sep 06 03:24:49 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:49] "GET
>>> /config
>>> HTTP/1.1" 200 40 0.0021
>>>
>>> Thu Sep 06 03:24:49 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:49] "GET
>>> /vm/monitor?title=graph4&monitor_resources=net_tx%2Cnet_rx&history_lengt$
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /user?timeout=false
>>> HTTP/1.1" 200 1432 0.0054
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /group?timeout=false
>>> HTTP/1.1" 200 554 0.0042
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /acl?timeout=false
>>> HTTP/1.1" 200 1057 0.0046
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /vm?timeout=false
>>> HTTP/1.1" 200 4255 0.0079
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /vmtemplate?timeout=false
>>> HTTP/1.1" 200 2978 0.0072
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /image?timeout=false
>>> HTTP/1.1" 200 3632 0.0077
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /cluster?timeout=false
>>> HTTP/1.1" 200 27 0.0344
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /host?timeout=false
>>> HTTP/1.1" 200 2498 0.0088
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /datastore?timeout=false
>>> HTTP/1.1" 200 1580 0.0052
>>>
>>> Thu Sep 06 03:24:50 2012 [I]: 10.2.0.3 - - [06/Sep/2012 03:24:50] "GET
>>> /vnet?timeout=false
>>> HTTP/1.1" 200 1406 0.0051
>>>
>>> etc.
>>>
>>> 05.09.2012, 19:20, "Carlos Martín Sánchez" <cmartin at opennebula.org>:
>>>
>>> Hi,
>>>
>>> That's not the normal behaviour, you may have changed some
>>> configuration
>>> during
>>> your tests.
>>>
>>> ACL rules in OpenNebula only add permissions, there is no option to
>>> make
>>> other
>>> resources invisible, because by default they are.
>>>
>>> Users can only list the resources they have USE permissions over. If
>>> your users
>>> can list VMs from other group, it is because you have an ACL that
>>> allows
>>> it, or
>>> because you changed the VM permissions to allow USE to 'others', see
>>> [1].
>>>
>>> If you need more specific help, please include the output of oneacl
>>> list.
>>>
>>> Regards,
>>>
>>> Carlos
>>>
>>> [1] http://opennebula.org/documentation:rel3.6:chmod
>>>
>>> --
>>> Carlos Martín, MSc
>>> Project Engineer
>>> OpenNebula - The Open-source Solution for Data Center Virtualization
>>>
>>> www.OpenNebula.org | cmartin at opennebula.org | @OpenNebula
>>>
>>> On Wed, Sep 5, 2012 at 3:37 PM, Пярн Артур <dekkart at yandex.ru> wrote:
>>>
>>> Hi
>>>
>>> I'm testing opennebula in multi-tenant envirements and found an
>>> upsetting issue.
>>>
>>> When i put users in groups (for example company A and company B
>>> groups),
>>> i can't
>>> find anything in options and in documentation (ACLs, etc.) to make
>>> company A VMs
>>> invisible to company B VMs and opposite.
>>>
>>> They just can't do anything with not their own machines, but the still
>>> see all
>>> the pool of virtual machines. This is not good in such case.
>>>
>>> I will be pleased to hear any advice.
>>>
>>> Thank you in advance.
>>
>> --
>> Hector Sanjuan
>> OpenNebula Developer
>
--
Hector Sanjuan
OpenNebula Developer
More information about the Users
mailing list