[Starlingx-discuss] <BLOCKING> StarlingX 2.0 Account Locked for User
Hi Team, I have installed StarlingX 2.0 Duplex Bare Metal. I am trying to create 2 VM's and repeating this cycle a number of times. After using the setup for around half and hour, I am not longer able to access the GUI. Ever though I type correct Username/Password, it gives an error of Invalid Credentials. Then, I thought to use the CLI commands by following LOAD CLI section given in link https://docs.starlingx.io/deploy_install_guides/r2_release/openstack/access.... But with this also, I am facing the same error controller-0:~$ export OS_CLOUD=openstack_helm controller-0:~$ openstack endpoint list The account is locked for user: 230578cde382430a8adac399afab1230. (HTTP 401) (Request-ID: req-6da6d59a-2edd-4f2b-a8bf-f13f2e423a77) Earlier this automatically started working after 5-7 mins. But this time, I am completely Blocked. I have also raised a bug regarding the same https://bugs.launchpad.net/starlingx/+bug/1853093 Please suggest some pointers, so that I can unblock and resume my activities. Regards Anirudh Gupta DISCLAIMER: This electronic message and all of its contents, contains information which is privileged, confidential or otherwise protected from disclosure. The information contained in this electronic mail transmission is intended for use only by the individual or entity to which it is addressed. If you are not the intended recipient or may have received this electronic mail transmission in error, please notify the sender immediately and delete / destroy all copies of this electronic mail transmission without disclosing, copying, distributing, forwarding, printing or retaining any part of it. Hughes Systique accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus.
Hi Anirudh, This issue is similar to this LP#1853017 [0], which was triggered the account locking if the password of Openstack user "admin" was changed. In this LP, for unknown reason, "registry-token-server" daemon kept accessing "keystone" on host (not the instance in containers) with obsolete token and led to "admin" account locked after 5 attempts. Right now, I am debugging this issue. Good thing is Cengn build 11/16 seemed not to have such a problem (LP#1853017). You might have a try with this version? BTW: which cengn build were you using? [0] https://bugs.launchpad.net/starlingx/+bug/1853017 regards, Yong On 2019/11/19 6:06 PM, Anirudh Gupta wrote:
Hi Team,
I have installed StarlingX 2.0 Duplex Bare Metal.
I am trying to create 2 VM’s and repeating this cycle a number of times.
After using the setup for around half and hour, I am not longer able to access the GUI.
Ever though I type correct Username/Password, it gives an error of Invalid Credentials.
Then, I thought to use the CLI commands by following LOAD CLI section given in link
https://docs.starlingx.io/deploy_install_guides/r2_release/openstack/access....
But with this also, I am facing the same error
controller-0:~$ export OS_CLOUD=openstack_helm
controller-0:~$ openstack endpoint list
The account is locked for user: 230578cde382430a8adac399afab1230. (HTTP 401) (Request-ID: req-6da6d59a-2edd-4f2b-a8bf-f13f2e423a77)
Earlier this automatically started working after 5-7 mins.
But this time, I am completely Blocked.
I have also raised a bug regarding the same
https://bugs.launchpad.net/starlingx/+bug/1853093
Please suggest some pointers, so that I can unblock and resume my activities.
Regards
Anirudh Gupta
DISCLAIMER: This electronic message and all of its contents, contains information which is privileged, confidential or otherwise protected from disclosure. The information contained in this electronic mail transmission is intended for use only by the individual or entity to which it is addressed. If you are not the intended recipient or may have received this electronic mail transmission in error, please notify the sender immediately and delete / destroy all copies of this electronic mail transmission without disclosing, copying, distributing, forwarding, printing or retaining any part of it. Hughes Systique accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus.
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
On 2019-11-25 12:00 AM, Yong Hu wrote:
Hi Anirudh,
This issue is similar to this LP#1853017 [0], which was triggered the account locking if the password of Openstack user "admin" was changed. In this LP, for unknown reason, "registry-token-server" daemon kept accessing "keystone" on host (not the instance in containers) with obsolete token and led to "admin" account locked after 5 attempts.
If registry token server keeps on accessing keystone with obsolete token, this could be a bug in the token server. Normally if a keystone client get a failed authentication, it should try to retrieve a new token by using username/password. Andy
Right now, I am debugging this issue. Good thing is Cengn build 11/16 seemed not to have such a problem (LP#1853017).
You might have a try with this version? BTW: which cengn build were you using?
[0] https://bugs.launchpad.net/starlingx/+bug/1853017
regards, Yong
On 2019/11/19 6:06 PM, Anirudh Gupta wrote:
Hi Team,
I have installed StarlingX 2.0 Duplex Bare Metal.
I am trying to create 2 VM’s and repeating this cycle a number of times.
After using the setup for around half and hour, I am not longer able to access the GUI.
Ever though I type correct Username/Password, it gives an error of Invalid Credentials.
Then, I thought to use the CLI commands by following LOAD CLI section given in link
https://docs.starlingx.io/deploy_install_guides/r2_release/openstack/access....
But with this also, I am facing the same error
controller-0:~$ export OS_CLOUD=openstack_helm
controller-0:~$ openstack endpoint list
The account is locked for user: 230578cde382430a8adac399afab1230. (HTTP 401) (Request-ID: req-6da6d59a-2edd-4f2b-a8bf-f13f2e423a77)
Earlier this automatically started working after 5-7 mins.
But this time, I am completely Blocked.
I have also raised a bug regarding the same
https://bugs.launchpad.net/starlingx/+bug/1853093
Please suggest some pointers, so that I can unblock and resume my activities.
Regards
Anirudh Gupta
DISCLAIMER: This electronic message and all of its contents, contains information which is privileged, confidential or otherwise protected from disclosure. The information contained in this electronic mail transmission is intended for use only by the individual or entity to which it is addressed. If you are not the intended recipient or may have received this electronic mail transmission in error, please notify the sender immediately and delete / destroy all copies of this electronic mail transmission without disclosing, copying, distributing, forwarding, printing or retaining any part of it. Hughes Systique accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus.
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
-- Andy Ning Cube: 3071 Tel: 613-9631408 (int: 4408) Skype: andy.ning.wr
Hi All, Looking at the tarball for the logs attached by Peng, it looks like after the password was changed in bash.log, there is no more activity from registry-token-server in daemon.log. This leads me to believe that something else must be triggering the locking of the account. There are some activity from token server in daemon.log but that was before the password change. I also tried authenticating to the token server with incorrect credentials on a system without changing the password. This is to try and create an environment where the registry/token server holds incorrect keystone credentials. The admin account did not get locked which means token server does not spam requests at keystone with incorrect credentials until it locks. Thanks, Jerry -----Original Message----- From: Andy Ning <andy.ning@windriver.com> Sent: Monday, November 25, 2019 11:05 AM To: starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] <BLOCKING> StarlingX 2.0 Account Locked for User On 2019-11-25 12:00 AM, Yong Hu wrote:
Hi Anirudh,
This issue is similar to this LP#1853017 [0], which was triggered the account locking if the password of Openstack user "admin" was changed. In this LP, for unknown reason, "registry-token-server" daemon kept accessing "keystone" on host (not the instance in containers) with obsolete token and led to "admin" account locked after 5 attempts.
If registry token server keeps on accessing keystone with obsolete token, this could be a bug in the token server. Normally if a keystone client get a failed authentication, it should try to retrieve a new token by using username/password. Andy
Right now, I am debugging this issue. Good thing is Cengn build 11/16 seemed not to have such a problem (LP#1853017).
You might have a try with this version? BTW: which cengn build were you using?
[0] https://bugs.launchpad.net/starlingx/+bug/1853017
regards, Yong
On 2019/11/19 6:06 PM, Anirudh Gupta wrote:
Hi Team,
I have installed StarlingX 2.0 Duplex Bare Metal.
I am trying to create 2 VM’s and repeating this cycle a number of times.
After using the setup for around half and hour, I am not longer able to access the GUI.
Ever though I type correct Username/Password, it gives an error of Invalid Credentials.
Then, I thought to use the CLI commands by following LOAD CLI section given in link
https://docs.starlingx.io/deploy_install_guides/r2_release/openstack/ access.html#local-cli
But with this also, I am facing the same error
controller-0:~$ export OS_CLOUD=openstack_helm
controller-0:~$ openstack endpoint list
The account is locked for user: 230578cde382430a8adac399afab1230. (HTTP 401) (Request-ID: req-6da6d59a-2edd-4f2b-a8bf-f13f2e423a77)
Earlier this automatically started working after 5-7 mins.
But this time, I am completely Blocked.
I have also raised a bug regarding the same
https://bugs.launchpad.net/starlingx/+bug/1853093
Please suggest some pointers, so that I can unblock and resume my activities.
Regards
Anirudh Gupta
DISCLAIMER: This electronic message and all of its contents, contains information which is privileged, confidential or otherwise protected from disclosure. The information contained in this electronic mail transmission is intended for use only by the individual or entity to which it is addressed. If you are not the intended recipient or may have received this electronic mail transmission in error, please notify the sender immediately and delete / destroy all copies of this electronic mail transmission without disclosing, copying, distributing, forwarding, printing or retaining any part of it. Hughes Systique accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus.
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
-- Andy Ning Cube: 3071 Tel: 613-9631408 (int: 4408) Skype: andy.ning.wr _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
participants (4)
-
Andy Ning
-
Anirudh Gupta
-
Sun, Yicheng (Jerry)
-
Yong Hu