access: prevent login with username-password when command-line credentials given#174
Conversation
|
@shwstppr |
|
@weizhouapache no. I think that is the issue @ingox was mentioning. |
Yes, it is the issue that @ingox reported. It seems like @DaanHoogland and @ingox have agreed it is a bash issue.
my understanding is a bit different. |
|
Thanks @weizhouapache. I don't have a strong opinion either way, so I'm happy to close this if we have agreement, it should work as it is. |
|
✅ Build complete for PR #174. 🔗 Download the cmk binaries (expires on August 23, 2025) |
|
@shwstppr work kind of like expected. I have one functional concern though: as you can see above, setting only a “wrong” APIkey does not stop me from logging in. Is that what we want? I think this does not address all of @ingox concern. In this way we can still fool ourselfves. when not using a profile as the basis it works as expected btw: What do you think about my comment here ? In short, I would expect any configured credentials to be ignored once the CLI contains any credentials. |
|
@DaanHoogland I think this needs a bit more discussion. I agree that if valid credentials are available, any invalid ones should be ignored. However, the use case @ingox raised is also valid. One option is to add a config flag—say, allowfallback—to toggle this behaviour. Alternatively, to keep cmk simple, we could avoid a new setting and address Ingo’s scenario with a few preparatory steps before setting keys (e.g., clear stale credentials, explicitly select the target profile, and validate with a quick API call). I'm converting this to draft for now |
|
@ingox can you read #174 (comment) and #174 (comment) and give your opinion, please? |
…tials given Fixes apache#168 Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
shwstppr
force-pushed
the
fix-wrongkeys-access
branch
from
a6b815c to
ec3d185
Compare
shwstppr
changed the title
|
@ingox @DaanHoogland @weizhouapache can you please check now (PR description updated) |
@ingox can you download these files and do a test with the version for your platform, please? |
|
Hello all, So there is a different behavior between passing the command directly or logging into cmk and run the command from there. |
|
@ingox my understanding was we agreed to this behaviour #168 (comment) |
kiranchavala
left a comment
kiranchavala
left a comment
There was a problem hiding this comment.
LGTM verified manually
Before fix
cmk -d -s B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw -k -MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg list users filter=account,username
[debug] UpdateConfig key:apikey value:-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg update:false
[debug] UpdateConfig key:secretkey value:B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw update:false
[debug] Trying to read API cache from:/Users/kiranchavala/.cmk/profiles/admin.cache
[debug] cmdline args:cmk, -d, -s, B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw, -k, -MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg, list, users, filter=account,username
[debug] ExecCmd args: list, users, filter=account,username
[debug] NewAPIRequest API request URL:http://10.0.35.15:8080/client/api?apiKey=-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg&command=listUsers&expires=2025-08-18T10%3A22%3A05Z&filter=account%2Cusername&response=json&signatureversion=3
[debug] NewAPIRequest response status code:200
[debug] NewAPIRequest response body:{"listusersresponse":{"count":1,"user":[{"id":"d15245cc-60fd-4144-b98d-8730d9be6900","username":"user","firstname":"ACloudStack","lastname":"User","email":"sblab@shapeblue.com","created":"2025-08-12T04:22:09+0000","state":"enabled","account":"ACSUser","accounttype":0,"usersource":"native","roleid":"1c12c75a-7731-11f0-9a5b-1e00900003a2","roletype":"User","rolename":"User","domainid":"f8f8593c-7730-11f0-9a5b-1e00900003a2","domain":"ROOT","timezone":"Etc/UTC","apikey":"-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg","accountid":"8a54a7ab-001c-4896-a3b8-e62754b96d64","iscallerchilddomain":false,"isdefault":false,"is2faenabled":false,"is2famandated":false}]}}
{
"count": 1,
"user": [
{
"account": "ACSUser",
"username": "user"
}
]
}
cmk -d -s B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw -k -MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3H list users filter=account,username
[debug] UpdateConfig key:apikey value:-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3H update:false
[debug] UpdateConfig key:secretkey value:B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw update:false
[debug] Trying to read API cache from:/Users/kiranchavala/.cmk/profiles/admin.cache
[debug] cmdline args:cmk, -d, -s, B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw, -k, -MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3H, list, users, filter=account,username
[debug] ExecCmd args: list, users, filter=account,username
[debug] NewAPIRequest API request URL:http://10.0.35.15:8080/client/api?apiKey=-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3H&command=listUsers&expires=2025-08-18T10%3A22%3A20Z&filter=account%2Cusername&response=json&signatureversion=3
[debug] NewAPIRequest response status code:401
[debug] Login POST URL:http://10.0.35.15:8080/client/apimap[command:[login] domain:[/] password:[password] response:[json] username:[admin]]
[debug] Login POST response status code:200
[debug] Login sessionkey:ZdHDdfq5-ej3KQDFsNr-BGfIbIc
[debug] NewAPIRequest API request URL:http://10.0.35.15:8080/client/api?apiKey=-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3H&command=listUsers&expires=2025-08-18T10%3A22%3A20Z&filter=account%2Cusername&response=json&sessionkey=ZdHDdfq5-ej3KQDFsNr-BGfIbIc&signature=k7uHmJKogVnHRTRj9uiccr5MAtM%3D&signatureversion=3
[debug] NewAPIRequest response body:{"listusersresponse":{"count":2,"user":[{"id":"41b07ac1-7731-11f0-9a5b-1e00900003a2","username":"admin","firstname":"admin","lastname":"cloud","created":"2025-08-12T04:03:08+0000","state":"enabled","account":"admin","accounttype":1,"usersource":"native","roleid":"1c126e6f-7731-11f0-9a5b-1e00900003a2","roletype":"Admin","rolename":"Root Admin","domainid":"f8f8593c-7730-11f0-9a5b-1e00900003a2","domain":"ROOT","apikey":"LIN6rqXuaJwMPfGYFh13qDwYz5VNNz1J2J6qIOWcd3oLQOq0WtD4CwRundBL6rzXToa3lQOC_vKjI3nkHtiD8Q","accountid":"41afc720-7731-11f0-9a5b-1e00900003a2","iscallerchilddomain":false,"isdefault":true,"is2faenabled":false,"is2famandated":false,"apikeyaccess":"INHERIT"},{"id":"d02cbd60-73aa-4298-a088-11e1ddf5a0dc","username":"admin-kubeadmin","firstname":"admin","lastname":"kubeadmin","email":"kubeadmin","created":"2025-08-13T07:49:48+0000","state":"enabled","account":"admin","accounttype":1,"usersource":"native","roleid":"1c126e6f-7731-11f0-9a5b-1e00900003a2","roletype":"Admin","rolename":"Root Admin","domainid":"f8f8593c-7730-11f0-9a5b-1e00900003a2","domain":"ROOT","apikey":"Yx4kYMSdNcJYrCdKFQfPTTYyJzJkHXqS5oWCX6IK1x-G31VBvfSKTFMQXz7UFbi4c3WerSEYF9B44Jpp2tvxdA","accountid":"41afc720-7731-11f0-9a5b-1e00900003a2","iscallerchilddomain":false,"isdefault":false,"is2faenabled":false,"is2famandated":false,"apikeyaccess":"INHERIT"}]}}
{
"count": 2,
"user": [
{
"account": "admin",
"username": "admin"
},
{
"account": "admin",
"username": "admin-kubeadmin"
}
]
}
After fix
bin/cmk -d -s B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw -k -MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg list users filter=account,username
[debug] UpdateConfig key:apikey value:-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg update:false
[debug] UpdateConfig key:secretkey value:B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw update:false
[debug] Trying to read API cache from:/Users/kiranchavala/.cmk/profiles/admin.cache
[debug] cmdline args:bin/cmk, -d, -s, B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw, -k, -MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg, list, users, filter=account,username
[debug] ExecCmd args: list, users, filter=account,username
[debug] NewAPIRequest API request URL:http://10.0.35.15:8080/client/api?apiKey=-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg&command=listUsers&expires=2025-08-18T10%3A20%3A46Z&filter=account%2Cusername&response=json&signatureversion=3
[debug] NewAPIRequest response status code:200
[debug] Credentials supplied on command-line, not falling back to login
[debug] NewAPIRequest response body:{"listusersresponse":{"count":1,"user":[{"id":"d15245cc-60fd-4144-b98d-8730d9be6900","username":"user","firstname":"ACloudStack","lastname":"User","email":"sblab@shapeblue.com","created":"2025-08-12T04:22:09+0000","state":"enabled","account":"ACSUser","accounttype":0,"usersource":"native","roleid":"1c12c75a-7731-11f0-9a5b-1e00900003a2","roletype":"User","rolename":"User","domainid":"f8f8593c-7730-11f0-9a5b-1e00900003a2","domain":"ROOT","timezone":"Etc/UTC","apikey":"-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3Hg","accountid":"8a54a7ab-001c-4896-a3b8-e62754b96d64","iscallerchilddomain":false,"isdefault":false,"is2faenabled":false,"is2famandated":false}]}}
{
"count": 1,
"user": [
{
"account": "ACSUser",
"username": "user"
}
]
}
bin/cmk -d -s B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw -k -MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3H list users filter=account,username
[debug] UpdateConfig key:apikey value:-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3H update:false
[debug] UpdateConfig key:secretkey value:B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw update:false
[debug] Trying to read API cache from:/Users/kiranchavala/.cmk/profiles/admin.cache
[debug] cmdline args:bin/cmk, -d, -s, B5iRTjItgNnOAyK5QAIsdyNQLY6n2X_Q702mRMe1nQuu3JRS3faltqtHFIbvZZxomssmqtAawEcunJ2g39tmyw, -k, -MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3H, list, users, filter=account,username
[debug] ExecCmd args: list, users, filter=account,username
[debug] NewAPIRequest API request URL:http://10.0.35.15:8080/client/api?apiKey=-MPbMG1oCyp5PS0LTIVKDkBbzPDPNcd_SOU-G_48uSiCBb83v_YSLZir1TQd_TkPU5NTMbPdZg5jPTQHN8G3H&command=listUsers&expires=2025-08-18T10%3A20%3A54Z&filter=account%2Cusername&response=json&signatureversion=3
[debug] NewAPIRequest response status code:401
[debug] Credentials supplied on command-line, not falling back to login
[debug] NewAPIRequest response body:{"listusersresponse":{"uuidList":[],"errorcode":401,"errortext":"unable to verify user credentials and/or request signature"}}
🙈 Error: (HTTP 401, error code <nil>) unable to verify user credentials and/or request signature
@DaanHoogland I'm okay if you want to continue with this and maybe close or update issue #168 accordingly |
|
@shwstppr and @DaanHoogland This is definitely an improvement for this scenario. It will still leave some risk once you're in cmk. I cannot judge the risk of breaking something else if same behavior gets implemented for within cmk. |
|
@ingox for now, I think it is safe to limit the new behaviour to command-line case. Otherwise, we can introduce a new config to allow supporting both old and new behaviour. If you are okay, I'll merge this, close your issue and open a new ticket where we can discuss or decide the behaviour for shell case? |
|
@shwstppr @DaanHoogland @ingox sorry for late comment my idea is a bit radical: we should forget the current keys and user credentials when user tries to use another user (different env, domain/username, or apikey/secretkey) To be clear,
|
|
@weizhouapache I feel a little too radical 😀 With this if I do, Won't it forget testuser as soon as I set domain? |
to be user-friendly, I think it is better do not forget the user when set the domain. but it increases the complexity. |
That is a consistent approach and understandable. |
|
@ingox @weizhouapache @DaanHoogland if you don't have objections I'll merge this PR and we can create a new issue around better handling of credentials? |
|
Merging this and creating a new issue to discuss and address credential change especially in cmk shell or when setting credentials individually. #188 |
6 participants
Fixes #168
Prevents falling back to username-password login when credentials are passed as command-line argument and authentication fails.
When using cmk shell, fallback will work as before,