nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

OD 6.0.2 - REQUEST_DENIED ?

Adam Stoller

I just tried upgrading my Solaris 9 OD 6.0.1 installation to OD 6.0.2 - and now when I try to run the test deployment I get the following:~ > iwodcmd start test

Locating OpenDeploy service.
Got OpenDeploy service
>>>>>-- Start deployment test.
iwodstart running in default synchronous mode.
Need to wait for deployment to complete.
***ERROR - Starting deployment.
Caught exception. Details: REQUEST_DENIEDThe only log file that seems to have changed with this attempt to deploy is the hostname_odbase.log - the end of which looks like this:...
CLT: 2005-04-11 07:53:00 EDT GMT-04:00 Allowing execution from localhost/127.0.0.1

API: 2005-04-11 07:53:00 EDT GMT-04:00 Requested start of deployment test
API: 2005-04-11 07:53:00 EDT GMT-04:00 User astoller login on od-admin role but is not an od-admin user on this OpenDeploy host.
API: 2005-04-11 07:53:00 EDT GMT-04:00 User astoller not in od-user role either.
API: 2005-04-11 07:53:00 EDT GMT-04:00 Request denied. User: astoller, login role: od-admin, deployment: test, request: START_DEPLOYWe are not using the AdminServer here - and thus have not installed the AdminServer nor CSF components for OD.

Does 6.0.2 require the CSF installation for using OD as a CLT ?

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

Find more posts tagged with

Comments

Adam Stoller

There definitely seem to be something to do with authentication - because if I run:
sudo iwodcmd start test
it works - but I should not have to run deployments through sudo -- so I need to find out where/how to fix this.
Anyone?

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

Adam Stoller

Following on this theme - the OD 6.0.2 Refrence Guide - in Chapter 1 beginning on page 17 has the following:

There are no authentication or authorization checks on individuals invoking command-line tools.This is followed immediately with documentation on iwodauthorize which talks about authorizing users to run deployments - but nowhere does it state that this is only for authorizing users to run deployments through the GUI.

I haven't yet tried using this command - but one way or the other, this documentation could use some fixing.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

jed

Later on the manual, it mentions that the user running an external task must have access to run the deploy during workflow deploy tasks, so this also conflicts with what is said earlier in the manual about not affecting CLT's. Sure would be nice to have an "authentication=off" flag....

--
Jed Michnowicz
jedm@sun.com
Content Management Engineer
Sun Microsystems

Adam Stoller

Working with Support on this -- so far we've discovered that:

iwodcmd start test - fails (see previous post)
sudo iwodcmd start test - succeeds (see previous post)
iwodstart test - succeeds

This last part seems to indicate that there is something specific to iwodcmd that isn't functioning as expected/desired .. hopefully we'll figure out what it is soon...

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

Migrateduser

Adam,

Here's the scoop. Apparently when fixing bug 56632...

"Different users are associated with deployments depending on whether iwodstart or iwodcmd is used to invoke deployment"

the behavior of iwodcmd changed. So now when starting a deployment, the authorization policy for the base server is checked.

If you are not using the Admin UI and want to add users to the authorization policy for the base server, you can use the iwodauthorize tool. Note that the boostrap user is added to the policy automatically as an admin.

iwodstart is not affected by this change.

I've filed two doc bugs, one to document this new behavior and the other to clarify iwoduathorize pertains to deployments done through the Admin UI, web services, and now iwodcmd.

Todd Scallan
Director of Product Management
Interwoven
t: 408-530-7167
e: tscallan@interwoven.com

Adam Stoller

Is there anyway that I can set this up with wild-cards or disable the authorization checking?

We have different users for each environment (DEV, TEST, PROD) - and any one of these users may be involved with invoking one of several deployments through the workflows -- I'd hate to have to keep separate lists for each environment and have to remember to add users to these lists as they change over time.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

james1

Perhaps you can make the authorization of your user(s) a part of your workflow, so that, prior to invoking the deployment, you have assurance that your user is authorized to do so?

Thanks
-- James

--
James H Koh
Interwoven Engineering

Migrateduser

It should be possible to authorize a list of users (using iwodauthorize) to the root deployment group or a deployment sub-group. But there isn't a wildcard capability in terms of authorized users.

Or you can sidestep this by using iwodstart.

Todd Scallan
Director of Product Management
Interwoven
t: 408-530-7167
e: tscallan@interwoven.com

jed

This can't be right...As a normal user, I am able to run the iwodauthorize command and make myself authorized:

# id
uid=60119(stlqa1) gid=10(staff)
#
# ./iwodauthorize -u /app/suncom/iw-home/conf/roles/editor.uid -d /tmp/deploys.list -a add
OpenDeploy server host: localhost, RMI registry port: 9174
Batch authorization successful.

Kinda like locking something up but giving the key to everyone?

Anyway, this is going to be an administrative nightmare. An option to disable this is really needed.

--
Jed Michnowicz
jedm@sun.com
Content Management Engineer
Sun Microsystems

Migrateduser

I'm doing some checking with Engineering in real time here. Stay tuned...

Todd Scallan
Director of Product Management
Interwoven
t: 408-530-7167
e: tscallan@interwoven.com

Adam Stoller

More doc-issues:

Clearly "user name" should be "deployment name".If I can list an entire deployment group via the directory name - can I just use a single entry like '/' to indicate everything ? (trial and error seems to indicate "no")Although shown without the .xml extension in the example, it doesn't specify that you need to leave out the .xml extension in the actual file; as I have determined the command accepts a filelist containing "test.xml" in it - but that won't help me run the test.xml deployment -- I need to make sure the file list contains "test" in order to get it to work.You can use this command to set, add, or remove user-deployment access rights -- but I don't see anyway to use this utility to show all the existing access rights that have been configured -- makes it difficult to use for administrative functions which may be shared across multiple people and/or across significant spans of time.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

Adam Stoller

I *could* add an extra CLT call to my externaltask for running deployments - but that adds additional time to the process to invoke the shell process to run the CLT and then process the return results -- of and by itself, not overly significant, but every fraction of a second counts and anything that slows down the process does tend to get noticed -- and it just feels like a hack solution to a badly implemented feature.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

Adam Stoller

Heh - good point - I hadn't even picked up on the fact that there didn't seem to be any requirements check for me as a user to run the iwodauthorize CLT.

I'd also prefer it if I could provide the names of users and/or deployments on the command line (though I can see where that would only be of limited use)

I'd certainly prefer to be able to use wild-cards and/or disable it.

I don't want to go back to using iwodstart -- we went to iwodcmd because we wanted to stop firing off new JVMs for every deployment -- so telling me to go back to using iwodstart is definitely a step in the *wrong* direction.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

Migrateduser

1. Added this to doc bug.

2. I thought that should work. Since you have a case open, perhaps you can ask Support to verify and file a bug.

3. Added this to doc bug.

4. Part of FR 36671.

Todd Scallan
Director of Product Management
Interwoven
t: 408-530-7167
e: tscallan@interwoven.com

Migrateduser

Looking at providing an override for the iwodcmd authorization check to be delivered as part of an upcoming patch. If you're interested in more detail, please contact Tech Support and refer to bug #59926.

Todd Scallan
Director of Product Management
Interwoven
t: 408-530-7167
e: tscallan@interwoven.com

Adam Stoller

Thanks - will do.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

jed

Yeah! Thanks.

--
Jed Michnowicz
jedm@sun.com
Content Management Engineer
Sun Microsystems

Migrateduser

The patch to disable the OpenDeploy 6.0.2 authorization check for 'iwodcmd start' is available on the support site. Patch IDs are 1572-1576, depending on platform.

Todd Scallan
Director of Product Management
Interwoven
t: 408-530-7167
e: tscallan@interwoven.com

Adam Stoller

Excellent!
Thanks - we'll probably look into it on Monday.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

Adam Stoller

The patch and subsequent edit of the deploy.cfg appear to have done the job - thanks.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

megamala

I recently installed OD6.2 with SP1 On Linux. I am getting same error. SP1 is latest, do I still need to install the patch. I am not seeing option Deploy.cltProxyAuthCheck in deploy.cfg.

TIA
MM Guptha
TS6.1WGE on Linux

jed

You probably have to manually add that option to the config file, restart the server and try again.

--
Jed Michnowicz
jedm@sun.com
Content Management Engineering
Sun Microsystems

megamala

Thanks, I added manually and it is working fine. To make perm. fix (Disable Authentication), I guess I have to do the following steps inorder to fix the bug.
uninstall SP1, install patch, install SP1

TIA
MM Guptha
TS6.1WGE on Linux