topic Re: Cannot login to my controller in Software Defined Networking

Cannot login to my controller

pokintania — Fri, 04 Jul 2014 04:15:25 GMT

I have just fresh install SDN controller. It always said "Invalid user & password combination specified!" when i try to login with sdn/skyline.

Please help me on this issue.

Attached file shown my user-list

Re: Cannot login to my controller

sdnindia — Mon, 07 Jul 2014 06:53:29 GMT

Hi pokintania,

Thanks for your query.

We hope that you have successfully executed all steps to install the SDN Controller.

Could you please let us know the below-

Version of the Controller
Controller logs
Command used to install keystone
Are you able to login using other account(e.g. rsdoc)

Thanks,

HP SDN Team

Re: Cannot login to my controller

RASHMIBS — Fri, 25 Jul 2014 09:55:32 GMT

Experiencing the same issue

here is the details

1) SDN controller Version :hp-sdn-ctl_2.2.5.0016_amd64.deb

command used :sudo dpkg -i hp-sdn-ctl_2.2.5.0016_amd64.deb (as mentioned in the installation guide)

2)Keystone command :

sudo apt-get install openjdk-7-jre-headless postgresql
keystone keystone-doc python-keystone iptables unzip

3) could login to the rsdoc interface .

Unable to login to the SDN controller using default Username ="sdn" password="skylake"

Please specify the steps to follow to login to the SDN controller Console GUI.

and also how to create the username and password in keystone authentication server .

Re: Cannot login to my controller

sdnindia — Fri, 01 Aug 2014 09:26:22 GMT

Hi RASHMIBS,

As per your post you are not able to login using sdn as user and skylake as the password.

Please note that default password is skyline so try with skyline and let us know if you still face the issue.

Please make sure you executed all installation steps(including dependency installation) successfully

In case you still face the issue please provide controller logs and the steps/commands you executed in order to install controller.Also please share the environment details where you are installing the controller.

You can change the password by using steps mentioned in Installation Guide[page 9 onwards ]

Thanks,

HP SDN Team

Re: Cannot login to my controller

Martin Cerveny — Sun, 03 Aug 2014 17:42:35 GMT

Hello.

There is new behavior of installation VAN SDN 2.3 - no users are added by setup to keystone during installation (for version <2.3 this is done by install package automatically). You must add it manually (see "install guide 2.3" step 2.2.2 on page 8 (for example run script on page 16).

Martin Cerveny

Re: Cannot login to my controller

cedLevoni — Tue, 12 Aug 2014 10:49:56 GMT

I've the same problem
	>> I have just fresh install SDN controller. 
	>> It always said "Invalid user & password combination specified!" 
	>> when i try to login with sdn/skyline.

i'have installed keystone with 
	# apt-get install keystone
	Reading package lists... Done
	Building dependency tree       
	Reading state information... Done
	The following NEW packages will be installed:
	  keystone
	0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded.
	Need to get 0 B/25.2 kB of archives.
	After this operation, 160 kB of additional disk space will be used.
	Selecting previously unselected package keystone.
	(Reading database ... 59879 files and directories currently installed.)
	Unpacking keystone (from .../keystone_1%3a2013.2.3-0ubuntu1~cloud0_all.deb) ...
	Processing triggers for man-db ...
	Processing triggers for ureadahead ...
	Setting up keystone (1:2013.2.3-0ubuntu1~cloud0) ...
	keystone start/running, process 18349
so I've executed your script add_to_keystone.sh
and I've the current user-list
	# keystone --token ADMIN --endpoint http://localhost:35357/v2.0/ user-list
	+----------------------------------+------+---------+-------+
	|                id                | name | enabled | email |
	+----------------------------------+------+---------+-------+
	| 0eecd42191cc4ab8bc9fdfd5446e3eae | sdn  |   True  |       |
	+----------------------------------+------+---------+-------+
then I've setup hp-sdn-ctl
	# dpkg -i hp-sdn-ctl_2.3.5.6505_amd64.deb 
	Selecting previously unselected package hp-sdn-ctl.
	(Reading database ... 59902 files and directories currently installed.)
	Unpacking hp-sdn-ctl (from .../hp-sdn-ctl_2.3.5.6505_amd64.deb) ...
	Setup has detected a compatible jre-headless - 1.7.0_55
	Verifying keystone server...
	Creating system group 'sdn'...
	...done.
	Creating system user 'sdn'...
	...done.
	Creating system user 'sdnadmin'...
	...done.
	Found pg_hba.conf at /etc/postgresql/9.1/main/pg_hba.conf
	Configuring PostgreSQL database...
	 * Restarting PostgreSQL 9.1 database server                                                                        [ OK ] 
	...done.
	Setting up hp-sdn-ctl (2.3.5.6505) ...
	Certificate was added to keystore
	Finalize configuration for keystone...
	... done
	sdna start/running, process 18591
	sdnc start/running, process 18597
	Processing triggers for ureadahead ...
but when I login to https://localhost:8443/sdn/ui
I get "Invalid user & password combination specified!"
the result of 
	#tail -f /var/log/sdn/virgo/logs/log.log
	[2014-08-12 12:36:07.365] INFO  http-bio-8443-exec-1         com.sun.jersey.server.impl.application.WebApplicationImpl         Initiating Jersey application, version 'Jersey: 1.17.1 02/28/2013 12:47 PM' 
	[2014-08-12 12:36:07.631] INFO  http-bio-8443-exec-9         com.sun.jersey.server.impl.application.WebApplicationImpl         Initiating Jersey application, version 'Jersey: 1.17.1 02/28/2013 12:47 PM' 
	[2014-08-12 12:36:30.752] INFO  http-bio-8443-exec-2         com.sun.jersey.server.impl.application.WebApplicationImpl         Initiating Jersey application, version 'Jersey: 1.17.1 02/28/2013 12:47 PM' 
	[2014-08-12 12:36:32.062] ERROR http-bio-8443-exec-2         hp.keystone                                                       Failed to authenticate sdn domain user sdn due to com.hp.api.auth.AuthenticationException: Validation error code 401 
I can connect to "https://localhost:8443/admin"with default user and password
and "https://localhost:8443/api/" get "200 : OK"

passing {"login":{"user":"sdn","password":"skyline"}}
to https://localhost:8443/api/#!/auth/
I get 200 Response Code and this Response Body
	{
	  "record": {
	    "token": "MIICagYJKoZIhvcNAQcCoIICWzCCAlcCAQExCTAHBgUrDgMCGjCCAUMGCSqGSIb3DQEHAaCCATQEggEweyJhY2Nlc3MiOiB7InRva2VuIjogeyJpc3N1ZWRfYXQiOiAiMjAxNC0wOC0xMlQxMDo0Mjo1Mi4xMzA0NzEiLCAiZXhwaXJlcyI6ICIyMDE0LTA4LTEzVDEwOjQyOjUyWiIsICJpZCI6ICJwbGFjZWhvbGRlciJ9LCAic2VydmljZUNhdGFsb2ciOiBbXSwgInVzZXIiOiB7InVzZXJuYW1lIjogInNkbiIsICJyb2xlc19saW5rcyI6IFtdLCAiaWQiOiAiMGVlY2Q0MjE5MWNjNGFiOGJjOWZkZmQ1NDQ2ZTNlYWUiLCAicm9sZXMiOiBbXSwgIm5hbWUiOiAic2RuIn0sICJtZXRhZGF0YSI6IHsiaXNfYWRtaW4iOiAwLCAicm9sZXMiOiBbXX19fTGB-zCB-AIBATBcMFcxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIEwVVbnNldDEOMAwGA1UEBxMFVW5zZXQxDjAMBgNVBAoTBVVuc2V0MRgwFgYDVQQDEw93d3cuZXhhbXBsZS5jb20CAQEwBwYFKw4DAhowDQYJKoZIhvcNAQEBBQAEgYCMnST-qTZN2qXTwBtg3GO38q-YZ1ClAb6n0dA6GfPInjDWdxKBwEemNqnLuM9FK3rIfGEblOsLcHui5ZX4SB7-db6wpfPpt7hnHF6ynvEfJQQAarLtbeGMzmvMOplsrIPqde6FOJRavQbajVZJM4nWvbzQ603ZcZwqTRfrdhlO6Q==",
	    "expiration": 1407926572000,
	    "expirationDate": "2014-08-13 12-42-52 +0200",
	    "userId": "0eecd42191cc4ab8bc9fdfd5446e3eae",
	    "userName": "sdn",
	    "domainId": "",
	    "domainName": ""
	  }
	}
but if I specify "domain":"sdn" in login value
	{"login":{"user":"sdn","password":"skyline","domain":"sdn"}}	
I get Response Code 401 and Response Body
{
  "error": "com.hp.api.auth.AuthenticationException",
  "message": "Authentication required"
}

can I have help ???

Re: Cannot login to my controller

Gerhard Roets — Tue, 12 Aug 2014 15:56:44 GMT

Hi cedLevoni

1. Did you remember to do the apt-get update before installing keystone ?

2. From th HP VAN SDN INstallation guide 2.3 on page 9

Edit the /etc/keystone/keystone.conf file with the following line to set UUID as the

provider type, you will need to add this in the [token] section:

provider=keystone.token.providers.uuid.Provider

Then restart the keystone service.

HTH

Gerhard

Re: Cannot login to my controller

dysanf — Tue, 12 Aug 2014 18:54:56 GMT

I am seeing the same behavior from a fresh install this morning. Just tried your suggestions and it is still a no go.

Re: Cannot login to my controller

cedLevoni — Wed, 13 Aug 2014 06:55:04 GMT

done
>>1. Did you remember to do the apt-get update before installing keystone ?

done
>>2. From th HP VAN SDN INstallation guide 2.3 on page 9
>>Edit the /etc/keystone/keystone.conf file with the following
>> line to set UUID as the provider type, you will need to add this
>>in the [token] section:
>> provider=keystone.token.providers.uuid.Provider

done
>>Then restart the keystone service.

no success
[2014-08-13 08:47:34.374] ERROR http-bio-8443-exec-5 hp.keystone Failed to authenticate sdn domain user sdn due to com.hp.api.auth.AuthenticationException: Validation error code 401

Re: Cannot login to my controller

Gerhard Roets — Thu, 14 Aug 2014 13:10:24 GMT

HI cedLevoni and dysanf

1.Which version of keystone are you using ( Icehouse / Havanna / Grizzly … )
2.Can you please collect the output of the following command “keystone –version” from the controller
3.Can you please collect the output of the following command “uname -a” from the controller
4.Can you please collect the output of the following command “lsb_release -a” from the controller

5.Keystone user mapping
Lets run through this on the controller Please collect the output . I will include a sample inline. Please be aware some of the commands might line wrap but they are all in a single line. SOme of the tables in my example wrapped but sorry not much I can do about that.

List tenants
Command:
keystone --os-token ADMIN --os-endpoint http://127.0.0.1:35357/v2.0 tenant-list
Output:
+----------------------------------+------+---------+
| id | name | enabled |
+----------------------------------+------+---------+
| f7209570ff8a49708b1995492cbfab28 | sdn | True |
+----------------------------------+------+---------+

Get the user to role mappings for the given tenant
This is where it gets tricky we need to find which user has been mapped to which role for the sdn tenant
In the following command the value after tenant is the id for the sdn tenant from the earlier commands, and the value for user is id for the sdn user
Command :
keystone --os-token ADMIN --os-endpoint http://127.0.0.1:35357/v2.0 user-role-list --tenant <SDNTENANTIDHERE> --user <SDNUSERIDHERE>
Example
keystone --os-token ADMIN --os-endpoint http://127.0.0.1:35357/v2.0 user-role-list --tenant f7209570ff8a49708b1995492cbfab28 --user 3d93720e361847acac98150661e2c655

6. Can you please attempt the following curl for me please from the command liune for the HP van SDN Controller and collect the output please without the domain.

curl -sk -H 'Content-Type:application/json' -d '{"login":{"user":"sdn","password":"skyline"}}' https://127.0.0.1:8443/sdn/v2.0/auth

7. Can you please attempt the following curl for me please from the command liune for the HP van SDN Controller and collect the output please with the domain.

curl -sk -H 'Content-Type:application/json' -d '{"login":{"user":"sdn","password":"skyline","domain":"sdn"}}' https://127.0.0.1:8443/sdn/v2.0/auth

Thanks in advance
Gerhard Roets
HP SDN Team

Re: Cannot login to my controller

cedLevoni — Thu, 14 Aug 2014 14:37:31 GMT

sorry for the trouble
but the problem is solved

I performed the reinstallation of the package
and now everything works fine

thank you very much

I've tried this:

#apt-get purge keystone
#rm -Rf /var/lib/keystone/
#apt-get install keystone
#./add_users_keystone.sh
#vi /etc/keystone/keystone.conf
....
provider=keystone.token.providers.uuid.Provider
....
#service keystone restart
#service sdna restart
#service sdnc restart

Re: Cannot login to my controller

Abhik_123 — Mon, 08 Sep 2014 10:00:28 GMT

I am still facing the issue. This is what I tried:

#sudo apt-get purge keystone
#sudo rm -Rf /var/lib/keystone/
#sudo apt-get update
#sudo apt-get install keystone
#sudo ./add_to_keystone.sh
#sudo vi /etc/keystone/keystone.conf
....
provider=keystone.token.providers.uuid.Provider
....
#sudo service keystone restart
#sudo service sdna restart
#sudo service sdnc restart

I am getting authentication error when I am using the following curl:

curl -sk -H 'Content-Type:application/json' -d '{"login":{"user":"sdn","password":"skyline"}}' https://127.0.0.1:8443/sdn/v2.0/auth
{"error":"com.hp.api.auth.AuthenticationException","message":"Authentication required"}

curl -sk -H 'Content-Type:application/json' -d '{"login":{"user":"sdn","password":"skyline","domain":"sdn"}}' https://127.0.0.1:8443/sdn/v2.0/auth
{"error":"com.hp.api.auth.AuthenticationException","message":"Authentication required"}

The add_to_keystone.sh I used is attached.

Re: Cannot login to my controller

Gerhard Roets — Mon, 08 Sep 2014 10:31:57 GMT

Hi Abhik

would you mind posting the output of the following command please ?

curl --header "X-Auth-Token:ADMIN" -ksS --request GET --url "http://127.0.0.1:35357/v2.0/tenants" | python -mjson.tool

curl --header "X-Auth-Token:ADMIN" -ksS --request GET --url "http://127.0.0.1:35357/v2.0/users" | python -mjson.tool

curl --header "X-Auth-Token:ADMIN" -ksS --request GET --url "http://127.0.0.1:35357/v2.0/OS-KSADM/roles" | python -mjson.tool

Note each curl command is one line.

Sample from my system

gpr@lyncsdn:~$ curl --header "X-Auth-Token:ADMIN" -ksS --request GET --url "http://127.0.0.1:35357/v2.0/tenants" | python -mjson.tool
{
    "tenants": [
        {
            "description": "",
            "enabled": true,
            "id": "e13fd642ee754377be0d18e6969dc68d",
            "name": "sdn"
        }
    ],
    "tenants_links": []
}
gpr@lyncsdn:~$ curl --header "X-Auth-Token:ADMIN" -ksS --request GET --url "http://127.0.0.1:35357/v2.0/users" | python -mjson.tool
{
    "users": [
        {
            "enabled": true,
            "id": "a191b03bdc784855a1e7cdb64d959bf1",
            "name": "sdn",
            "username": "sdn"
        }
    ]
}
gpr@lyncsdn:~$
gpr@lyncsdn:~$ curl --header "X-Auth-Token:ADMIN" -ksS --request GET --url "http://127.0.0.1:35357/v2.0/OS-KSADM/roles" | python -mjson.tool

{
    "roles": [
        {
            "description": "Default role for project membership",
            "enabled": "True",
            "id": "9fe2ff9ee4384b1894a90878d3e92bab",
            "name": "_member_"
        },
        {
            "id": "f9f75b4662b1421eb894476ad1442300",
            "name": "sdn-admin"
        },
        {
            "id": "c2f061d1740d44b8beabb1df7180ae90",
            "name": "sdn-user"
        }
    ]
}

Even if you get errors please post the output here.

Kind Regards

Gerhard

Re: Cannot login to my controller

Abhik_123 — Mon, 08 Sep 2014 15:50:13 GMT

Hi Gerhard,

Thanks for your reply.

I tried the curl commands, but I am getting the error "couldn't connect to host".

cnlabs@cnlabs-VirtualBox:~$ curl --header "X-Auth-Token:ADMIN" -ksS --request GET --url "http://127.0.0.1:35357/v2.0/tenants" | python -mjson.tool
curl: (7) couldn't connect to host
No JSON object could be decoded
cnlabs@cnlabs-VirtualBox:~$
cnlabs@cnlabs-VirtualBox:~$ curl --header "X-Auth-Token:ADMIN" -ksS --request GET --url "http://127.0.0.1:35357/v2.0/users" | python -mjson.tool
curl: (7) couldn't connect to host
No JSON object could be decoded
cnlabs@cnlabs-VirtualBox:~$
cnlabs@cnlabs-VirtualBox:~$ curl --header "X-Auth-Token:ADMIN" -ksS --request GET --url "http://127.0.0.1:35357/v2.0/OS-KSADM/roles" | python -mjson.tool
curl: (7) couldn't connect to host
No JSON object could be decoded
cnlabs@cnlabs-VirtualBox:~$

Thanks

Abhik

Re: Cannot login to my controller

Gerhard Roets — Mon, 08 Sep 2014 17:26:06 GMT

Hi Abhik

That is odd.

Can you get the following output

service keystone status

netstat -na | grep 35357

lsb_realease -a

dpkg -l keystone

Do you have any firewalls running like iptables ?

Kind Regards

Gerhard

HP SDN Team

Re: Cannot login to my controller

Abhik_123 — Tue, 09 Sep 2014 08:22:17 GMT

Hi Gerhard,

cnlabs@cnlabs-VirtualBox:~$ service keystone status
keystone start/running, process 2699
cnlabs@cnlabs-VirtualBox:~$ netstat -na | grep 35357
cnlabs@cnlabs-VirtualBox:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 12.04.4 LTS
Release: 12.04
Codename: precise
cnlabs@cnlabs-VirtualBox:~$ dpkg -l keystone
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Description
+++-==============-==============-============================================
ii keystone 2012.2.4-0ubun OpenStack identity service - Daemons
cnlabs@cnlabs-VirtualBox:~$
cnlabs@cnlabs-VirtualBox:~$
cnlabs@cnlabs-VirtualBox:~$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- 127.0.0.0/8 anywhere tcp dpt:9160
REJECT tcp -- anywhere anywhere tcp dpt:9160 rejec t-with icmp-port-unreachable
ACCEPT tcp -- 127.0.0.0/8 anywhere tcp dpt:7199
REJECT tcp -- anywhere anywhere tcp dpt:7199 rejec t-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
cnlabs@cnlabs-VirtualBox:~$

Does the patch 65 of java 7 still has the issue in handling SSL connections?

cnlabs@cnlabs-VirtualBox:~$ java -version
java version "1.7.0_65"
OpenJDK Runtime Environment (IcedTea 2.5.1) (7u65-2.5.1-4ubuntu1~0.12.04.2)
OpenJDK 64-Bit Server VM (build 24.65-b04, mixed mode)
cnlabs@cnlabs-VirtualBox:~$

Thanks

Abhik

Re: Cannot login to my controller

Gerhard Roets — Tue, 09 Sep 2014 11:34:49 GMT

Hi Abhik

It looks to me as if keystone is not listening on the default port, I would suggest you look in /etc/keystone/keystone.conf, and see if the admin_port value has been changed.

Kind Regards

Gerhard

Re: Cannot login to my controller

Abhik_123 — Fri, 12 Sep 2014 14:27:40 GMT

Yes Gerhard, you were right. It is now working. Thanks :)

Re: Cannot login to my controller

Skaarup — Wed, 01 Oct 2014 09:59:47 GMT

Hi,

I have now tried everything in this post without success. I still get "Invalid user & password combination specified!" everytime i try to login with "sdn" and "skyline"

Any suggestions on what i can try?

Re: Cannot login to my controller

sdnindia — Thu, 09 Oct 2014 10:42:39 GMT

Hello Skaarup,

Apologies for the delay.

Please provide below details-

1.Controller version ?

2.did you upgrade the controller or install afresh?

3.version of keystone?

4.command used to install keystone?

5.Are you able to login using other user?

6.Are you able to see REST API page?

Thanks,

HP SDN Team