401 Unauthorized

[hit0ri]

Hi. I'm getting 401 Unauthorized with ovirt 4.3.5.4-1.el7.

User prometheus has ReadOnlyAdmin role assigned.

log:

$ ovirt_exporter -api.url https://<REDACTED>/ovirt-engine/api/ -api.username prometheus@internal -api.password <REDACTED> -debug
INFO[0000] Starting oVirt exporter (Version: 0.9.0)      source="main.go:74"
INFO[0000] Listening for /metrics on :9325               source="main.go:103"
ERRO[0002] 401 Unauthorized                              source="vm_collector.go:110"
ERRO[0002] 401 Unauthorized                              source="host_collector.go:85"
ERRO[0003] 401 Unauthorized                              source="vm_collector.go:110"
ERRO[0003] 401 Unauthorized                              source="storagedomain_collector.go:48"
ERRO[0003] 401 Unauthorized                              source="host_collector.go:85"

[hit0ri]

I've been tinkering with this and it looks like that basic authentication doesn't work (curl yields the same result), so I tried to replace basic authentication with sso in ovirt_api.

I'm not that good at programming but maybe the following patch might be useful in implementing sso support in the future if you choose to do so.

ovirt_api-sso.patch

diff --git a/api/client.go b/api/client.go
index 82363d1..f750d64 100644
--- a/api/client.go
+++ b/api/client.go
@@ -2,9 +2,11 @@ package api
 
 import (
 	"crypto/tls"
+	"encoding/json"
 	"encoding/xml"
 	"io/ioutil"
 	"net/http"
+	"net/url"
 	"strings"
 
 	"errors"
@@ -14,18 +16,25 @@ import (
 
 // Client encapsulates communication with the oVirt REST API
 type Client struct {
-	url      string
-	username string
-	password string
-	logger   Logger
-	debug    bool
-	cookie   string
-	client   *http.Client
+	url         string
+	username    string
+	password    string
+	logger      Logger
+	debug       bool
+	accessToken string
+	client      *http.Client
 }
 
 // ClientOption applies options to Client
 type ClientOption func(*Client)
 
+// SSO server response json
+type ssoResponseJSON struct {
+	AccessToken  string `json:"access_token"`
+	SsoError     string `json:"error"`
+	SsoErrorCode string `json:"error_code"`
+}
+
 // WithInsecure disables TLS certificate validation
 func WithInsecure() ClientOption {
 	return func(c *Client) {
@@ -74,23 +83,48 @@ func NewClient(url, username, password string, opts ...ClientOption) (*Client, e
 
 // Auth establishes a SSO session with oVirt API
 func (c *Client) Auth() error {
-	req, err := http.NewRequest("HEAD", c.url, nil)
+	payload := url.Values{}
+
+	payload.Set("grant_type", "password")
+	payload.Set("scope", "ovirt-app-api")
+	payload.Set("username", c.username)
+	payload.Set("password", c.password)
+
+	params := strings.NewReader(payload.Encode())
+	authURL := strings.TrimRight(c.url, "/api/") + "/sso/oauth/token"
+
+	req, err := http.NewRequest("POST", authURL, params)
 	if err != nil {
 		return err
 	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Accept", "application/json")
 
-	req.SetBasicAuth(c.username, c.password)
-	req.Header.Set("Prefer", "persistent-auth")
 	resp, err := c.client.Do(req)
 	if err != nil {
 		return err
 	}
 
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+
+	var ssoResp ssoResponseJSON
+	err = json.Unmarshal(body, &ssoResp)
+	if err != nil {
+		return err
+	}
+
+	if ssoResp.SsoError != "" {
+		return errors.New(ssoResp.SsoError)
+	}
+
 	if resp.StatusCode != 200 {
 		return errors.New(resp.Status)
 	}
 
-	c.cookie = strings.Split(resp.Header.Get("Set-Cookie"), ";")[0]
+	c.accessToken = ssoResp.AccessToken
 	return nil
 }
 
@@ -141,8 +175,8 @@ func (c *Client) sendRequest(path, method string, body io.Reader, reauth bool) (
 	}
 
 	req.Header.Add("Content-Type", "application/xml")
-	req.Header.Set("Prefer", "persistent-auth")
-	req.Header.Set("Cookie", c.cookie)
+	req.Header.Set("Accept", "application/xml")
+	req.Header.Set("Authorization", "Bearer "+c.accessToken)
 
 	resp, err := c.client.Do(req)
 	if err != nil {

[sergsmirnoff]

same issue -

INFO[0000] Starting oVirt exporter (Version: 0.9.0) source="main.go:74"
FATA[0000] 401 Unauthorized source="main.go:90"

when trying to run with

ovirt_exporter -api.insecure-cert -api.username USER -api.password PASS -api.url https://rhv/ovirt-engine/api?rsdl

[sergsmirnoff]

to resolve this you need to specify domain for admin user - default is "internal" - so the user would have full cred - admin@internal

[sagikerner]

The error is still accruing when running the exporter with admin@internal as the user.
I used the admin user and another user I created for a test, the error is still reappearing when you try to get the metrics (curl).

I have the same output:

$ ovirt_exporter -api.url https://<REDACTED>/ovirt-engine/api/ -api.username admin@internal -api.password <REDACTED> -debug
INFO[0000] Starting oVirt exporter (Version: 0.9.0)      source="main.go:74"
INFO[0000] Listening for /metrics on :9325               source="main.go:103"
ERRO[0002] 401 Unauthorized                              source="vm_collector.go:110"
ERRO[0002] 401 Unauthorized                              source="host_collector.go:85"
ERRO[0003] 401 Unauthorized                              source="vm_collector.go:110"
ERRO[0003] 401 Unauthorized                              source="storagedomain_collector.go:48"
ERRO[0003] 401 Unauthorized                              source="host_collector.go:85"

I have another site I tried it on and it worked perfectly, can't really understand what is the issue...

[gatesch]

Hello,

It runs fine until I try to hit the /metrics end point. Then it fails with this error.

./ovirt_exporter -api.url=https://rhevm.example.loc/ovirt-engine/api/ -api.username=admin@internal -api.password=xxxxxxxxxxx -api.insecure-cert -web.listen-address=:9105

INFO[0000] Starting oVirt exporter (Version: 0.9.0) source="main.go:74"
INFO[0000] Listening for /metrics on :9105 source="main.go:103"

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x8ec189]

goroutine 94 [running]:
github.com/czerwonk/ovirt_exporter/disk.Get(0xc00053a1b0, 0x24, 0xc0001b60c0, 0xc00039c7c8, 0x6e61a8, 0xc00002e100)
/root/go/src/github.com/czerwonk/ovirt_exporter/disk/helper.go:20 +0x189
github.com/czerwonk/ovirt_exporter/vm.(*VMCollector).collectForAttachment(0xc0001ca640, 0xc0005003b8, 0x8, 0xc00053a1b0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
/root/go/src/github.com/czerwonk/ovirt_exporter/vm/vm_collector.go:244 +0x97
created by github.com/czerwonk/ovirt_exporter/vm.(*VMCollector).collectDiskMetrics
/root/go/src/github.com/czerwonk/ovirt_exporter/vm/vm_collector.go:235 +0x29f

[FMF2110]

Hi Anyone seen this error before
it's when we import from vmware to ovirt
qemu-kvm: curl: Operation timed out after 2000041 milliseconds with 439224 out of 458752 bytes received
[ 2558.010733] sd 2:0:1:0: [sdb] timing out command, waited 1800s
[ 2558.011752] sd 2:0:1:0: [sdb] FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE cmd_age=1999s
[ 2558.013164] sd 2:0:1:0: [sdb] Sense Key : Aborted Command [current]
[ 2558.014178] sd 2:0:1:0: [sdb] Add. Sense: I/O process terminated
[ 2558.015138] sd 2:0:1:0: [sdb] CDB: Read(10) 28 00 02 19 4c 08 00 02 00 00
[ 2558.016218] blk_update_request: I/O error, dev sdb, sector 35212296
qemu-kvm: curl: The requested URL returned error: 401 Unauthorized
qemu-kvm: curl: The requested URL returned error: 401 Unauthorized
qemu-kvm: curl: The requested URL returned error: 401 Unauthorized
qemu-kvm: curl: The requested URL returned error: 401 Unauthorized
qemu-kvm: curl: The requested URL returned error: 401 Unauthorized