Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1517333 - 'pcs cluster auth' fails if an empty nodelist is configured in corosync
Summary: 'pcs cluster auth' fails if an empty nodelist is configured in corosync
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pcs
Version: 7.5
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Tomas Jelinek
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2017-11-24 15:41 UTC by Tomas Jelinek
Modified: 2018-10-30 08:06 UTC (History)
6 users (show)

Fixed In Version: pcs-0.9.165-1.el7
Doc Type: Bug Fix
Doc Text:
Cause: The user runs 'pcs cluster auth' in a situation when corosync.conf exists but does not list any nodes due to it being edited by other means than pcs. Consequence: Pcs reports success, however nodes are not authenticated. Fix: If no nodes are defined in corosync.conf, save auth tokens on the local node only. Do not send them to an empty list of nodes. Result: 'pcs cluster auth' works.
Clone Of:
Last Closed: 2018-10-30 08:05:31 UTC
Target Upstream Version:

Attachments (Terms of Use)
proposed fix (deleted)
2017-12-13 14:24 UTC, Tomas Jelinek
no flags Details | Diff

System ID Priority Status Summary Last Updated
Github ClusterLabs pcs issues 153 None None None 2017-11-24 15:43:14 UTC
Red Hat Product Errata RHBA-2018:3066 None None None 2018-10-30 08:06:10 UTC

Description Tomas Jelinek 2017-11-24 15:41:02 UTC
Description of problem:
* [nodeA]# pcs cluster auth nodeB nodeC
* pcs connects to nodes and authenticates without an issue
* if corosync is not configured on nodeA, pcs saves tokens to a file
* if corosync is configured on nodeA, pcs gets its nodelist and sends token to nodes in the nodelist
* if the nodelist is empty, tokens are discarded, which means nodes are not authenticated -> bug

How reproducible:
always, easily

Steps to Reproduce:
1. setup corosync with an empty nodelist
2. pcs cluster auth

Actual results:
nodes not authenticated

Expected results:
nodes or at least the local node authenticated

Comment 1 Tomas Jelinek 2017-12-13 14:24:15 UTC
Created attachment 1367416 [details]
proposed fix

Pcs always populates nodelist in corosync.conf so usually there should not be any issue. However, corrupted or manually edited corosync.conf should not cause that 'pcs cluster auth' does not work.

1. Remove or empty nodelist in /etc/corosync/corosync.conf on all nodes you want to authenticate (rh74-node1 rh74-node2).
2. Remove auth tokens on all nodes: pcs pcsd clear-auth
3. Authenticate the nodes: pcs cluster auth rh74-node1 rh74-node2
4. Check nodes status: pcs status pcsd rh74-node1 rh74-node2

Before fix:
# pcs status pcsd rh74-node1 rh74-node2                               
  rh74-node2: Unable to authenticate
  rh74-node1: Unable to authenticate
Nodes not authenticated even though 'pcs cluster auth' reported otherwise.

After fix:
# pcs status pcsd rh74-node1 rh74-node2
  rh74-node1: Online
  rh74-node2: Online

Comment 3 Ivan Devat 2018-06-22 12:15:24 UTC
After Fix:

[ant ~] $ rpm -q pcs pcs-snmp

[ant ~] $ cat /etc/corosync/corosync.conf|grep nodelist
[ant ~] $ pcs pcsd clear-auth
[ant ~] $ pcs cluster auth ant bee
Username: hacluster
ant: Authorized
bee: Authorized
[ant ~] $ pcs status pcsd ant bee
  ant: Online
  bee: Online

Comment 7 errata-xmlrpc 2018-10-30 08:05:31 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

Note You need to log in before you can comment on or make changes to this bug.