Delete old packages fails with 401 error in case vro is embedded

[ivanstcoe]

Description

Import of VRO packages is successful but delete is throwing 401 error

12:51:02.015 [main] INFO com.vmware.pscoe.iac.artifact.VroPackageStore - Package | IMPORT | com.vmware.pscoe.library.dns.platform-1.0.1.package 12:51:04.367 [main] INFO com.vmware.pscoe.iac.artifact.VroPackageStore - Package | IMPORT | com.vmware.pscoe.library.vra.dispatcher-2.1.0.package 12:51:13.738 [main] INFO com.vmware.pscoe.iac.artifact.VroPackageStore - Package | IMPORT | com.vmware.pscoe.library.vra.iaas-1.1.1.package Jun 16, 2023 12:51:16 PM com.vmware.pscoe.iac.artifact.configuration.ConfigurationVro validate INFO: Checking if exists refresh token Jun 16, 2023 12:51:16 PM com.vmware.pscoe.iac.artifact.configuration.ConfigurationVro validate INFO: Refresh token not detected using BASIC Authentication 12:51:16.517 [main] INFO com.vmware.pscoe.iac.artifact.configuration.Configuration - Refresh token not detected. Checking username and password on configuration 12:51:16.517 [main] INFO com.vmware.pscoe.iac.artifact.VraPackageStore - Searching for Package Store for type VRO 12:51:16.517 [main] INFO com.vmware.pscoe.iac.artifact.VraPackageStore - Detected ConfigurationVro 12:51:16.517 [main] WARN com.vmware.pscoe.iac.artifact.rest.RestClientFactory - SSL: You are now ignoring certificate verification. 12:51:16.517 [main] WARN com.vmware.pscoe.iac.artifact.rest.RestClientFactory - SSL: You are now ignoring hostname verification. 12:51:16.532 [main] INFO com.vmware.pscoe.iac.artifact.rest.RestClientFactory - Authentication strategy: ‘BASIC’ 12:51:16.595 [main] INFO com.vmware.pscoe.iac.artifact.VraPackageStore - Detecting vRO Server version ‘8.11.0.20963650’. 12:51:16.610 [main] INFO com.vmware.pscoe.iac.artifact.VroPackageStore - Cleaning up server package ‘com.vmware.pscoe.odcn’ versions LATEST=false, OLDER=true DRYRUN=false Exception in thread “main” org.springframework.web.client.HttpClientErrorException: 401 Unauthorized

Steps to Reproduce

1. Start installer
2. Select to import only VRO packages
3. Select basic authentication
4. Select embedded vro
5. Type credentials for VRA
6. Select to delete old package versions

Preconditions: environment.properties file used

Fri Jun 16 12:33:11 EEST 2023

http_socket_timeout=360 vrang_port=443 vro_import_packages=true ignore_ssl_certificate_verification=true vrang_host=vra-l-01a.corp.local vro_import_old_versions=false vrang_auth_with_refresh_token=false vro_enable_backup=false vrang_password=xxx http_connection_timeout=360 ignore_ssl_host_verification=true vro_import_configuration_secure_attribute_values=false skip_vro_import_old_versions=false vro_import_configuration_attribute_values=false vrang_username=configurationadmin vro_embedded=true vro_delete_old_versions=true vro_run_workflow=false

Expected behavior: Old package versions are deleted

Actual behavior: 401 error

Reproduces how often: every time with these parameters

Component/s: artifact-manager"

Affects Build/s: 2.32.0

Environment

Client

• Build Tools for VMware Aria Version: artifact-manager/2.32.0
• OS Version: Windows 2018

Server

• vRealize Automation Version:8.11.0.20963650
• vRealize Orchestrator Version:8.11.0.20963650

Failure Logs

12:51:16.532 [main] INFO com.vmware.pscoe.iac.artifact.rest.RestClientFactory - Authentication strategy: ‘BASIC’ 12:51:16.595 [main] INFO com.vmware.pscoe.iac.artifact.VraPackageStore - Detecting vRO Server version ‘8.11.0.20963650’. 12:51:16.610 [main] INFO com.vmware.pscoe.iac.artifact.VroPackageStore - Cleaning up server package ‘com.vmware.pscoe.odcn’ versions LATEST=false, OLDER=true DRYRUN=false Exception in thread “main” org.springframework.web.client.HttpClientErrorException: 401 Unauthorized

Additional Context

We had a chat in slack and thats the hint i got

"In case of vro import that is embedded we merge the vrang authentication.. so essentially it is "injecting" the username and password from vrang properties"

[Michaelpalacce]

This is how it's done when we are importing for embedded vro:

[Michaelpalacce]

@jgangel Any updates on this?

[jgangel]

Hello. I already setup an environment where I could replicate the behavior, I have already identified the spots on code where the issue might be raised, it effectively is not using the credentials we passed in, so it is probably in the auth interceptor, where I have tried some logging to check how to pass the authentication header appropriately. Last week and this one I have had some projects, so I'll try to create a PR by the EOW.

[jgangel]

@ivanstcoe Is Basic authentication enabled in the vRO instance? That could be the problem, as it is disabled by default, but once I enabled it, the 401 stopped appearing as error when executing the installer.bat

Here is a link to enable basic authentication: https://docs.vmware.com/en/vRealize-Orchestrator/8.8/com.vmware.vrealize.orchestrator-install-config.doc/GUID-30026BCF-DC1F-471E-A63C-A29E85FBDD41.html

[ivanstcoe]

the import was successful in my case. only delete was throwing 401. meaning, basic authentication should have been enabled at the time of testing.

[jgangel]

Is this still an issue? I've got some time to review again

[jgangel]

I've tested the behaviour in 2.32.0 and 2.36.1 (current), both in vRA/vRO version 8.11 and 8.12. The behavior arises if and only if basic authentication is not enabled in vro control center (default). I can include this step (enable basic authentication) in the documentation for vRO projects if needed.

[ivo-kotev]

Hi @jgangel, if this is the problem, then we need to check why this specific API calls are not capable of using vRA authentication, but using only Basic - our solution should support both.