Replies: 5 comments 5 replies
-
|
@Rubueno , I converted this to a Q&A discussion. Not that I do not take it seriously, but as of yet it is too vague to pinpoint a bug, so let’s investigate further.
|
Beta Was this translation helpful? Give feedback.
-
|
Can you try with the Cloud Monkey tool, if it solves your use case and problem |
Beta Was this translation helpful? Give feedback.
-
|
I was able to reproduce the issue with cmk a few months ago, but I do not have the logfiles anymore. If I remember correctly, only the The issue occurred again today, but we have already gone ahead and reset the API keys. When it occurs again in the future I can share more logfiles regarding cmk and Dev's own calls. I can already share today's logs if you wish to see them. |
Beta Was this translation helpful? Give feedback.
-
|
If you can find related issues, please @Rubueno . If no particular issues have been discovered this will require studying logs from the last successful createAccount call to the first failing one …… no guarantees but we can try. The error comes from SpiServer.verifyRequest(..) and I see no logging in it that would help debugging the situation, but your devs can cannibalise the method to create a useful stub for testing. |
Beta Was this translation helpful? Give feedback.
-
|
I'm the dev that calls the Cloudstack API from our application. Today we ran into this issue again. Creating Domain and Account using APIWe have successfully created a new domain using the API with the with the following request : Result: {
"domain": {
"haschild": false,
"id": "42742c35-1681-4940-9772-04862a2cf034",
"level": 3,
"name": "cs21723270",
"parentdomainid": "760d4f82-faaa-438c-8991-66b744253e08",
"parentdomainname": "vps",
"path": "ROOT/ourenv/vps/cs21723270",
"secondarystoragetotal": 0
}
}All good, now we try to create a account in this domain with the request: Result: {
"createaccountresponse": {
"uuidList": [],
"errorcode": 401,
"errortext": "unable to verify user credentials and/or request signature"
}
}Notice: I didn't actually masked the password, we did try this with literally Creating Domain and Account using CloudmonkeyUsing Cloudmonkey we replicated the exact same command with the same result: Result Try from scratch with CloudmonkeyWe also tried this flow freshly on cloudmonkey creating the domain + account: Result {
"domain": {
"haschild": false,
"id": "2adaea80-0594-48e2-bc1f-696e1aa5f9c8",
"level": 3,
"name": "test",
"parentdomainid": "760d4f82-faaa-438c-8991-66b744253e08",
"parentdomainname": "vps",
"path": "ROOT/ourenv/vps/test",
"secondarystoragetotal": 0
}
}All good, now create a account under this domain using CMK: Result: Extra InfoPermissionsThe user that creates the domain and tries to create the account has the Role we try to use when creating accountThe role id we try to set on the exists: Result {
"count": 1,
"role": [
{
"description": "Cloud Customers",
"id": "e8a96c9c-8782-40ea-880a-59ca60029a98",
"isdefault": false,
"ispublic": true,
"name": "customers",
"type": "DomainAdmin"
}
]
} |
Beta Was this translation helpful? Give feedback.
-
|
The plot thickens. We found that createAccount in the UI works fine, but via CMK it does not. The createAccount call will only break after a week or so. Now interestingly, for each createAccount call in CMK it will return "Expired session, missing signature, or missing apiKey -- ignoring request" while each call for listVirtualMachines and listRoles and even deleteAccount works fine. CMK version: This call was made: |
Beta Was this translation helpful? Give feedback.
-
|
@Rubueno Could you please share the cmk output with debug mode ON? You may use |
Beta Was this translation helpful? Give feedback.
-
|
Hey Abhishek, thanks for pointing us to this debug setting. We will share the output of this the next time the issue occurs. We have had to regenerate the API keys due to it being a production environment and the issue was blocking VM deployments for our customers. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @Rubueno |
Beta Was this translation helpful? Give feedback.
-
|
The UI seems to use the same query parameters for createAccount as CMK does |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
problem
I don't know what other category to sort this under, so I selected "Bug". I just need some help figuring out where the issue lies. Our Development team runs integration testing of the CRM with CloudStack. For this, they will do the following using a domain admin account:
Now the issue we encounter is that around once every 2-3 weeks the ONLY call that fails in this workflow is
createAccount. It errors with "unable to verify user credentials and/or request signature" and in the management-server.log I can seeUser signature [xxxx] is not equaled to computed signature [yyyy].However, now the interesting part is that when we generate a new API key and secret, and use these, thecreateAccountcall will succeed. The code to make all the API calls and generate the signature remain unchanged. I just need some help to rack my brain and to help determine where/how it goes wrong, as the API keys are still shown to be the same for this user.Notes from our Dev team:
versions
4.19.3 but the issue has been persistent on older versions
The steps to reproduce the bug
Obscure, unclear how or when to trigger it. It occurs at random about every 3 weeks.
What to do about it?
Help me figure out how to resolve this.
Beta Was this translation helpful? Give feedback.
All reactions