Can salt-api use mysql auth?

[ivanwa]

1、salt-api use PAM auth is ok

2、command-line mysql auth is ok

3、but salt-api user mysql auth fail

4、master debug messages is

[DEBUG ] Could not LazyLoad mysql.groups [DEBUG ] Reading configuration from /etc/salt/master [DEBUG ] Guessing ID. The id can be explicitly in set /etc/salt/minion [INFO ] Found minion id from generate_minion_id(): saltstack-test-6-76.localhost [DEBUG ] Reading configuration from /etc/salt/master [INFO ] Could not import psycopg2, postges_local_cache disabled. [DEBUG ] Could not LazyLoad mysql.clean_old_jobs [DEBUG ] Could not LazyLoad config.merge [DEBUG ] Updating roots fileserver cache [DEBUG ] This salt-master instance has accepted 2 minion keys. [DEBUG ] Reading configuration from /etc/salt/master [DEBUG ] Guessing ID. The id can be explicitly in set /etc/salt/minion [INFO ] Found minion id from generate_minion_id(): saltstack-test-6-76.localhost [DEBUG ] Reading configuration from /etc/salt/master [INFO ] Could not import psycopg2, postges_local_cache disabled. [DEBUG ] Could not LazyLoad mysql.clean_old_jobs [DEBUG ] Could not LazyLoad config.merge

5、version Salt: 2015.5.5 Python: 2.6.6 (r266:84292, May 22 2015, 08:34:51) Jinja2: 2.2.1 M2Crypto: 0.20.2 msgpack-python: 0.4.6 msgpack-pure: Not Installed pycrypto: 2.0.1 libnacl: Not Installed PyYAML: 3.10 ioflo: Not Installed PyZMQ: 14.5.0 RAET: Not Installed ZMQ: 4.0.5 Mako: Not Installed Tornado: Not Installed timelib: Not Installed dateutil: 1.4.1

Thanks

[whiteinge]

salt-api is just a light wrapper around Salt's Python API so it supports all auth backends that Salt does.

The salt-api daemon shares memory with the Salt Master, such as the master config file. Do a full shutdown of both daemons, verify both are completely stopped (pgrep, et al), then start salt-master followed by salt-api. Does the problem persist after that?

On Tue, Nov 24, 2015 at 12:35 AM, ivanwa notifications@github.com wrote:

1、salt-api use PAM auth is ok

2、command-line mysql auth is ok

3、but salt-api user mysql auth fail

4、master debug messages is

[DEBUG ] Could not LazyLoad mysql.groups [DEBUG ] Reading configuration from /etc/salt/master [DEBUG ] Guessing ID. The id can be explicitly in set /etc/salt/minion [INFO ] Found minion id from generate_minion_id(): saltstack-test-6-76.localhost [DEBUG ] Reading configuration from /etc/salt/master [INFO ] Could not import psycopg2, postges_local_cache disabled. [DEBUG ] Could not LazyLoad mysql.clean_old_jobs [DEBUG ] Could not LazyLoad config.merge [DEBUG ] Updating roots fileserver cache [DEBUG ] This salt-master instance has accepted 2 minion keys. [DEBUG ] Reading configuration from /etc/salt/master [DEBUG ] Guessing ID. The id can be explicitly in set /etc/salt/minion [INFO ] Found minion id from generate_minion_id(): saltstack-test-6-76.localhost [DEBUG ] Reading configuration from /etc/salt/master [INFO ] Could not import psycopg2, postges_local_cache disabled. [DEBUG ] Could not LazyLoad mysql.clean_old_jobs [DEBUG ] Could not LazyLoad config.merge

5、version Salt: 2015.5.5 Python: 2.6.6 (r266:84292, May 22 2015, 08:34:51) Jinja2: 2.2.1 M2Crypto: 0.20.2 msgpack-python: 0.4.6 msgpack-pure: Not Installed pycrypto: 2.0.1 libnacl: Not Installed PyYAML: 3.10 ioflo: Not Installed PyZMQ: 14.5.0 RAET: Not Installed ZMQ: 4.0.5 Mako: Not Installed Tornado: Not Installed timelib: Not Installed dateutil: 1.4.1

Thanks

— Reply to this email directly or view it on GitHub.

[ivanwa]

Thanks @whiteinge . I try but fail. When I user mysql auth. It will cause error.

It seems than use mysql auth will lose a parameter or database user table structure was wrong.

The salt-api debug messages:(When use pam auth,this error does't exist) [DEBUG ] Error while processing request for: /login Traceback (most recent call last): File "/usr/lib/python2.6/site-packages/salt/netapi/rest_cherrypy/app.py", line 435, in hypermedia_handler ret = cherrypy.serving.request._hypermedia_inner_handler(_args, _kwargs) File "/usr/lib/python2.6/site-packages/cherrypy/_cpdispatch.py", line 34, in call return self.callable(_self.args, _self.kwargs) File "/usr/lib/python2.6/site-packages/salt/netapi/rest_cherrypy/app.py", line 1440, in POST user_groups = set(token['groups']) TypeError: 'bool' object is not iterable [INFO ] 127.0.0.1 - - [25/Nov/2015:14:27:30] "POST /login HTTP/1.1" 500 49 "" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.18 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2"

---

My master config. interface: 0.0.0.0 file_roots: base:

• /srv/salt pillar_roots: base:
• /srv/pillar

  mysql.host: '172.26.6.76'

  mysql.user: 'salt'

  mysql.pass: 'q1w2e3r4'

  mysql.db: 'salt'

  mysql.port: 3306

  master_job_cache: mysql

  mysql_auth: hostname: 172.26.6.76 database: salt username: salt password: q1w2e3r4 auth_sql: 'SELECT username FROM users WHERE username = "{0}" AND password = SHA2("{1}", 256)' external_auth: mysql: ivanwa:

  • .*
  • '@wheel'
  • '@runner'

    client_acl:

ivanwa:

- test.*

rest_cherrypy: port: 8000 ssl_crt: /etc/pki/tls/certs/localhost.crt ssl_key: /etc/pki/tls/private/localhost_nopass.key autosign_file: /etc/salt/autosign.conf

---

users table structure MariaDB [salt]> show create table users; +-------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Table | Create Table | +-------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | users | CREATE TABLE users ( id int(11) NOT NULL AUTO_INCREMENT, username varchar(25) DEFAULT NULL, password varchar(70) DEFAULT NULL, PRIMARY KEY (id) ) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8 | +-------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

[whiteinge]

That traceback is a known bug that was fixed in #26974. I think the fix is present in 2015.5.6 but if not then it's definitely present in the upcoming 2015.5.7.

[ivanwa]

Well done. Thanks @whiteinge