[Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication

[Jones, Bruce E]

Bug https://bugs.launchpad.net/starlingx/+bug/1848280 filed for this issue.

       brucej

-----Original Message-----
From: Liu, Tao [mailto:Tao.Liu at windriver.com] 
Sent: Tuesday, October 15, 2019 2:43 PM
To: Cordoba Malibran, Erich <erich.cordoba.malibran at intel.com>; starlingx-discuss at lists.starlingx.io
Subject: Re: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication

Hi Erich

The fmClientCli is not a customer interface and it does not require authentication.  This tool is mainly used for debugging/testing and it requires access to a shell session.  
It is debatable whether this tool should be packaged in the load.

The fm cli (from python-fmclient) that requires authentication is the fm shell and it supports the following subcommands:
    alarm-delete        Delete an active alarm.
    alarm-list          List all active alarms.
    alarm-show          Show an active alarm.
    alarm-summary       Show a summary of active alarms.
    event-list          List event logs.
    event-show          Show an event log.
    event-suppress      Suppress specified Event ID's.
    event-suppress-list
                        List Suppressed Event ID's
    event-unsuppress    Unsuppress specified Event ID's.
    event-unsuppress-all
                        Unsuppress all Event ID's.

Tao

-----Original Message-----
From: Cordoba Malibran, Erich [mailto:erich.cordoba.malibran at intel.com]
Sent: Tuesday, October 15, 2019 5:00 PM
To: starlingx-discuss at lists.starlingx.io
Subject: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication

Hi,

I was playing around with fault components and I noticed that I'm able to query, create and delete alarms with fmClientCli and the fm_core python module.

As I understand the `fm` cli (from python-fmclient) creates a request to keystone before connecting to the fm-rest-api to perform the operation. However this is not the case for fmClientCli, I can create an alarm with the following command. 

$ fmClientCli -c "blabla###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.5432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###"

and delete it with:

$ fmClientCli -d "###100.114###host=controller-0.ntp"

This without doing the `source /etc/platform/openrc`, I'm even allowed to create alarms from a non sysadmin user.

The same case with the `fm_core` python module, which links with libfmcommon as fmClientCli does.

>>> fm_core.get_by_eid("host=controller-0")
['c0d94f45-bc6d-4709-9cc6-6a937659c593###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.005432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###']


So, I'm wondering if this an expected behavior or something is missing in libfmcommon to enable authentication.

Also, do you know if the fmClientCli tool is really used?

Thanks!

-Erich




_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss at lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss at lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss