"User not authorized" issue for REST #2073

s-kuchi · 2023-05-11T17:52:46Z

s-kuchi
May 11, 2023

I keep getting "User is not authorized" when i test my connection via REST or using password ,although i followed the instructions to set up the read-only account. I tried using credentials file and also using cert authentication. I check the FAQ's for troubleshooting as well.

Any other ideas as to what might be missing?

{"error":{"code":"6691623", "message":"User is not authorized."}}

UUPDNAS::*> security login role show -role all-api
           Role          Command/                                      Access
Vserver    Name          Directory                               Query Level
---------- ------------- --------- ----------------------------------- --------
UUPDNAS    all-api       DEFAULT                                       readonly

UUPDNAS::*> security login show -vserver UUPDNAS -user-or-group-name netapp-harvest -application http

Vserver: UUPDNAS
                                                                 Second
User/Group                 Authentication                 Acct   Authentication
Name           Application Method        Role Name        Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
netapp-harvest http        cert          all-api          -      none
netapp-harvest http        password      all-api          no     none
2 entries were displayed.

UUPDNAS::*> vserver services web access show -role all-api -name rest
Vserver        Type     Service Name     Role  
-------------- -------- ---------------- ----------------
UUPDNAS        admin    rest             all-api

cgrinds · 2023-05-11T18:04:46Z

cgrinds
May 11, 2023
Maintainer

hi @s-kuchi Rest uses a different role than non-Rest. By that I mean, you need to use rest-role instead of role

For example:

umeng-aff300-05-06::> security login rest-role show -role harvest-rest
               Role                                    Access
Vserver        Name            API                     Level
----------     -------------   -------------------     ------
umeng-aff300-05-06
               harvest-rest    /api                    readonly
                               /api/cluster            readonly
2 entries were displayed.

6 replies

cgrinds May 11, 2023
Maintainer

The role looks good. Lets make sure the user that you're trying to auth with has that role and the correct application. Can you run the following command, substituting $user with your user?

security login show -user-or-group-name $user

Vserver: umeng-aff300-05-06
                                                                 Second
User/Group                 Authentication                 Acct   Authentication
Name           Application Method        Role Name        Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
harvest        http        cert          harvest-rest     -      none
harvest        http        password      harvest-rest     no     none
harvest        ontapi      cert          harvest          -      none
harvest        ontapi      password      harvest          no     none
harvestnew     ontapi      password      foople           no     none
5 entries were displayed.

s-kuchi May 11, 2023
Author

UUPDNAS::*> security login show -user-or-group-name netapp-harvest

Vserver: UUPDNAS
                                                                 Second
User/Group                 Authentication                 Acct   Authentication
Name           Application Method        Role Name        Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
netapp-harvest http        cert          all-api          -      none
netapp-harvest http        password      all-api          no     none
netapp-harvest ontapi      password      all-api          no     none

cgrinds May 11, 2023
Maintainer

Looking good. Let's try curling with your netapp-harvest user.

curl --insecure --user netapp-harvest "https://$ip/api/cluster?fields=version"
Enter host password for user 'netapp-harvest':
{
  "version": {
    "full": "NetApp Release 9.9.1P9X3: Tue Apr 19 19:05:24 UTC 2022",
    "generation": 9,
    "major": 9,
    "minor": 1
  },
  "_links": {
    "self": {
      "href": "/api/cluster"
    }
  }
}

s-kuchi May 11, 2023
Author

`[root@pdgllvsanmgt01 cert]# curl --insecure --user netapp-harvest "https://uupdnas.corp.siriusxm.com/api/cluster?fields=version"
Enter host password for user 'netapp-harvest':
{
  "version": {
    "full": "NetApp Release 9.12.1P2: Wed Apr 05 19:57:43 UTC 2023",
    "generation": 9,
    "major": 12,
    "minor": 1
  },
  "_links": {
    "self": {
      "href": "/api/cluster"
    }
  }

}`

cgrinds May 11, 2023
Maintainer

Oh nice! If that worked, Harvest should.
Can you share the matching snippet from your harvest.yml file for this cluster and user? Here's mine that matches the curl I pasted above.

Pollers:
    u2: 
        auth_style: basic_auth
        username: netapp-harvest
        password: foo
        addr: 10.193.48.11
        collectors:
            - Rest
            - Zapi
            - RestPerf
            - ZapiPerf
        exporters:
            - prometheus1

Start this poller in the foreground

bin/poller --poller u2 --promPort 12990 --collectors Rest --objects Status
2023-05-11T15:05:51-04:00 INF ./poller.go:205 > Init Poller=u2 configPath=./harvest.yml logLevel=info version="harvest version 23.05.0807-v23.05.0 (commit 7a247418) (build date 2023-05-08T07:54:53-0400) darwin/amd64\n"
2023-05-11T15:05:51-04:00 INF ./poller.go:242 > started in foreground Poller=u2 pid=86914
2023-05-11T15:05:51-04:00 INF collector/helpers.go:139 > best-fit template Poller=u2 collector=Rest:Status path=conf/rest/9.12.0/status.yaml v=9.9.1
2023-05-11T15:05:51-04:00 INF ./poller.go:382 > Autosupport scheduled. Poller=u2 asupSchedule=24h
2023-05-11T15:05:51-04:00 INF ./poller.go:391 > poller start-up complete Poller=u2
2023-05-11T15:05:51-04:00 INF prometheus/httpd.go:29 > http server listen Poller=u2 addr=localhost exporter=prometheus1 port=12990
2023-05-11T15:05:51-04:00 INF ./poller.go:539 > updated status, up collectors: 1 (of 1), up exporters: 1 (of 1) Poller=u2
2023-05-11T15:05:51-04:00 INF collector/collector.go:484 > Collected Poller=u2 apiMs=93 calcMs=0 collector=Rest:Status instances=1 metrics=1 parseMs=0 pluginMs=0

In separate terminal, curl the poller's Prometheus endpoint

curl -s 'http://localhost:12990/metrics' | grep -Ev "#|metadata_" | sort
cluster_new_status{cluster="umeng-aff300-05-06",datacenter="dc-1",status="ok"} 1

s-kuchi · 2023-05-11T19:23:27Z

s-kuchi
May 11, 2023
Author

Defaults:
    collectors:
#        - Zapi
#        - ZapiPerf
        - Ems
        - Rest
        - RestPerf
    use_insecure_tls: true
Pollers:
    # add your cDOT / 7Mode pollers below, example:
    uupdnas:
        datacenter: Corp-Virginia
        type: NetApp_AFFA400
        addr: 10.176.118.50
        auth_style: basic_auth
        credentials_file: secrets/credentials.yml # read credentials from the file
        use_insecure_tls: true # Disable TLS verification when connecting to ONTAP cluster
        exporters:
            - prometheus1

[root@pdgllvsanmgt01 harvest]# bin/poller --poller uupdnas --promPort 13000 --collectors Rest --objects Status
2023-05-11T15:19:40-04:00 INF ./poller.go:203 > Init Poller=uupdnas configPath=./harvest.yml logLevel=info version="harvest version 23.02.0-1 (commit 627311aa) (build date 2023-02-21T08:32:44-0500) linux/amd64\n"
2023-05-11T15:19:40-04:00 INF ./poller.go:240 > started in foreground Poller=uupdnas pid=90875
2023-05-11T15:19:40-04:00 ERR rest/rest.go:194 > error creating new client error="missing parameter => password" Poller=uupdnas collector=Rest:Status poller=uupdnas

[root@pdgllvsanmgt01 9.12.0]# curl -s 'http://localhost:13000/metrics' | grep -Ev "#|metadata_" | sort
[root@pdgllvsanmgt01 9.12.0]#

5 replies

cgrinds May 11, 2023
Maintainer

Thanks!

What version of Harvest are you using?

bin/harvest version
harvest version 23.05.0807-v23.05.0 (commit 7a247418) (build date 2023-05-08T07:54:51-0400) darwin/amd64
checking GitHub for latest... you have the latest ✓

This line implies that perhaps there is something wrong with your credentials_file:

2023-05-11T15:19:40-04:00 ERR rest/rest.go:194 > error creating new client error="missing parameter => password" Poller=uupdnas collector=Rest:Status poller=uupdnas

Does your credentials_file look like this?

Pollers:
  uupdnas:
    username: netapp-harvest
    password: password

s-kuchi May 11, 2023
Author

Credentials file

Pollers:
  uupdnas:
    username: netapp-harvest
    password: password

[root@pdgllvsanmgt01 harvest]# bin/harvest version
harvest version 23.02.0-1 (commit 627311aa) (build date 2023-02-21T08:32:43-0500) linux/amd64
checking GitHub for latest... newer version v23.05.0 available at https://github.com/NetApp/harvest/releases/latest

Yeah. I looked at the error message. Can't figure out what the issue with the credentials file. It is definitely not the password itself.

cgrinds May 11, 2023
Maintainer

That all looks good. Can you try commenting out this line?
auth_style: basic_auth and see if that works?

If not, can you give 23.05 a try? It has better logging around the credentials file when there is an error.

s-kuchi May 11, 2023
Author

Yeah. I think i'll upgrade. I will update this forum after the upgrade. Thank you @cgrinds

s-kuchi May 11, 2023
Author

@cgrinds I upgraded Harvest, but it still complains about the password. This time i removed the credentials file and put the password in harvest.yml

[root@pdgllvsanmgt01 harvest]# bin/harvest version
harvest version 23.05.0-1 (commit 6f74c7a5) (build date 2023-05-03T08:08:46-0400) linux/amd64
checking GitHub for latest... you have the latest ‚úì

Defaults:
    collectors:
#        - Zapi
#        - ZapiPerf
        - Rest
        - RestPerf
        - Ems
    use_insecure_tls: true
Pollers:
    # add your cDOT / 7Mode pollers below, example:
    uupdnas:
        datacenter: Corp-Virginia
        type: NetApp_AFFA400
        addr: 10.176.118.50
        auth_style: basic_auth
        username: netapp-harvest
        password: password
#        credentials_file: secrets/credentials.yml # read credentials from the file
        use_insecure_tls: true # Disable TLS verification when connecting to ONTAP cluster
        exporters:
            - prometheus1

[root@pdgllvsanmgt01 harvest]# bin/harvest admin start
4:37PM INF github.com/netapp/harvest/v2/cmd/admin/admin.go:68 > Admin node started BasicAuth=false TLS=false listen=:8887
4:37PM FTL github.com/netapp/harvest/v2/cmd/admin/admin.go:82 > Admin node could not listen error="listen tcp :8887: bind: address already in use" listen=:8887
[root@pdgllvsanmgt01 harvest]# bin/harvest status
   Datacenter   | Poller  | PID | PromPort |   Status     
----------------+---------+-----+----------+--------------
  Corp-Virginia | uupdnas |     |          | not running  
[root@pdgllvsanmgt01 harvest]# bin/harvest start
   Datacenter   | Poller  | PID | PromPort |   Status     
----------------+---------+-----+----------+--------------
  Corp-Virginia | uupdnas |     |          | not running  
[root@pdgllvsanmgt01 harvest]# bin/harvest status
   Datacenter   | Poller  | PID | PromPort |   Status     
----------------+---------+-----+----------+--------------
  Corp-Virginia | uupdnas |     |          | not running  
[root@pdgllvsanmgt01 harvest]# systemctl status harvest.service 
‚óè harvest.service - Harvest
   Loaded: loaded (/etc/systemd/system/harvest.service; enabled; vendor preset: disabled)
   Active: inactive (dead) since Thu 2023-05-11 16:33:13 EDT; 5min ago
  Process: 96546 ExecStop=/opt/harvest/bin/harvest stop --config /opt/harvest/harvest.yml (code=exited, status=0/SUCCESS)
  Process: 96533 ExecStart=/opt/harvest/bin/harvest restart --config /opt/harvest/harvest.yml (code=exited, status=0/SUCCESS)
 Main PID: 94034 (code=exited, status=1/FAILURE)

May 11 16:33:13 pdgllvsanmgt01.corp.siriusxm.com systemd[1]: Starting Harvest...
May 11 16:33:13 pdgllvsanmgt01.corp.siriusxm.com systemd[1]: Started Harvest.
[root@pdgllvsanmgt01 harvest]#  bin/poller --poller uupdnas --promPort 13000 --collectors Rest --objects Status
2023-05-11T16:38:57-04:00 INF ./poller.go:205 > Init Poller=uupdnas configPath=./harvest.yml logLevel=info version="harvest version 23.05.0-1 (commit 6f74c7a5) (build date 2023-05-03T08:08:48-0400) linux/amd64\n"
2023-05-11T16:38:57-04:00 INF ./poller.go:242 > started in foreground Poller=uupdnas pid=96982
2023-05-11T16:38:57-04:00 ERR rest/rest.go:200 > error creating new client error="missing parameter => password" Poller=uupdnas collector=Rest:Status poller=uupdnas
[root@pdgllvsanmgt01 harvest]#

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

"User not authorized" issue for REST #2073

{{title}}

Replies: 2 comments 11 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

"User not authorized" issue for REST #2073

s-kuchi May 11, 2023

Replies: 2 comments · 11 replies

cgrinds May 11, 2023 Maintainer

cgrinds May 11, 2023 Maintainer

s-kuchi May 11, 2023 Author

cgrinds May 11, 2023 Maintainer

s-kuchi May 11, 2023 Author

cgrinds May 11, 2023 Maintainer

s-kuchi May 11, 2023 Author

cgrinds May 11, 2023 Maintainer

s-kuchi May 11, 2023 Author

cgrinds May 11, 2023 Maintainer

s-kuchi May 11, 2023 Author

s-kuchi May 11, 2023 Author

s-kuchi
May 11, 2023

Replies: 2 comments 11 replies

cgrinds
May 11, 2023
Maintainer

cgrinds May 11, 2023
Maintainer

s-kuchi May 11, 2023
Author

cgrinds May 11, 2023
Maintainer

s-kuchi May 11, 2023
Author

cgrinds May 11, 2023
Maintainer

s-kuchi
May 11, 2023
Author

cgrinds May 11, 2023
Maintainer

s-kuchi May 11, 2023
Author

cgrinds May 11, 2023
Maintainer

s-kuchi May 11, 2023
Author

s-kuchi May 11, 2023
Author