build-R3.1.0-18:liberty- webui login not working on HA setup

[shajuvk]

with admin/contrail123 credentials, contrail-webui login not going through. I have noticed below error during login attempts.

08/08/2016 05:44:00 PM - debug: Query sent to Opserver at Mon Aug 08 2016 17:44:00 GMT-0700 (PDT) {"table":"StatTable.ComputeCpuState.cpu_info","start_time":"now-15m","end_time":"now","select_fields":["Source","name","T","cpu_info.cpu_share","cpu_info.mem_res"],"filter":[],"limit":150000,"where":[[{"name":"name","value":"","op":7}]]}
08/08/2016 05:44:00 PM - error: URL [http://10.84.13.38:9081/analytics/query] returned error ["Authentication required"]
08/08/2016 05:44:01 PM - error: URL [http://10.84.13.38:9081/analytics/queries] returned error ["Authentication required"]
08/08/2016 05:44:01 PM - error: Encountered broken link: /analytics/queries
08/08/2016 05:44:01 PM - error: REST Server Error: Authentication required
    at APIServer.retryMakeCall (/usr/src/contrail/contrail-web-core/src/serverroot/common/rest.api.js:203:13)
    at Request.<anonymous> (/usr/src/contrail/contrail-web-core/src/serverroot/common/rest.api.js:336:18)
    at Request.emit (events.js:98:17)
    at Request.mixin._fireSuccess (/usr/lib64/node_modules/restler/lib/restler.js:226:10)
    at /usr/lib64/node_modules/restler/lib/restler.js:157:20
    at IncomingMessage.parsers.auto (/usr/lib64/node_modules/restler/lib/restler.js:390:7)
    at Request.mixin._encode (/usr/lib64/node_modules/restler/lib/restler.js:194:29)
    at /usr/lib64/node_modules/restler/lib/restler.js:153:16
    at Request.mixin._decode (/usr/lib64/node_modules/restler/lib/restler.js:169:7)
    at IncomingMessage.<anonymous> (/usr/lib64/node_modules/restler/lib/restler.js:146:14)
08/08/2016 05:44:02 PM - debug: We got the channel as:51d6d37e-ed65-4416-8330-83d8ad37a608
Got from worker process: { cmd: 'sendToJobServer',

[shajuvk (shajuvk)]

a6s32- 10.84.13.32
on 10.84.13.32 ~/fabric-utils directory testbed available.

[Rahul (rahuls)]

Discovery keeps on giving 3 analytics nodes to UI while one of them is down and keeps on responding back with unauthorized.

Once analytics is brought down on that node, then UI works fine.

Along with other issues, analytics-api needs to see when it should publish itself to discovery.

08/09/2016 12:18:51 AM - ^[[34mdebug^[[39m: DiscService Response Updated by process:3709 {"OpServer":[{"@publisher-id":"a6s32","port":9081,"ip-address":"10.84.13.32"},{"@publisher-id":"a6s33","port":9081,"ip-address":"10.84.13.33"},{"@publisher-id":"a6s38","port":9081,"ip-address":"10.84.13.38"}],"ttl":712}

08/09/2016 12:15:35 AM - ^[[31merror^[[39m: URL [http://10.84.13.38:9081/analytics/query] returned error ["Authentication required"]
08/09/2016 12:15:36 AM - ^[[34mdebug^[[39m: Redis: ready
08/09/2016 12:15:36 AM - ^[[34mdebug^[[39m: Redis DB 3 SELECT suuccess:
08/09/2016 12:15:36 AM - ^[[31merror^[[39m: URL [http://10.84.13.38:9081/analytics/queries] returned error ["Authentication required"]
08/09/2016 12:15:36 AM - ^[[31merror^[[39m: Encountered broken link: /analytics/queries
08/09/2016 12:15:36 AM - ^[[31merror^[[39m: REST Server Error: Authentication required

root@a6s38:~# contrail-status
== Contrail Control ==
supervisor-control: active
contrail-control active
contrail-control-nodemgr active
contrail-dns active
contrail-named active

== Contrail Analytics ==
supervisor-analytics: active
contrail-alarm-gen active
contrail-analytics-api initializing (ApiServer connection down)

[Jeba Paulaiyan (jebap)]

As per Shaju, Megh has a pending checkin for this. We need to take that in next build.

[shajuvk (shajuvk)]

Megh committed the checking related to this bug also in another bug https://bugs.launchpad.net/juniperopenstack/+bug/1611158

[Jeba Paulaiyan (jebap)]

For R3.1, this has been taken care in bug 1611158. Waiting for dev to comments and decision.

[Megh Bhatt (meghb)]

We will change the error code to 5XX in case analytics-api is not able to connect to VNC API.

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/36119
Submitter: Megh Bhatt (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/36120
Submitter: Megh Bhatt (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/36119
Submitter: Megh Bhatt (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/36120
Submitter: Megh Bhatt (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/36120
Committed: http://github.com/Juniper/contrail-controller/commit/75fd3670970a62a57995b734b0b0eebfdb848d3a
Submitter: Zuul (<email address hidden>)
Branch: R4.1

commit 75fd3670970a62a57995b734b0b0eebfdb848d3a
Author: Megh Bhatt <email address hidden>
Date: Thu Sep 28 23:43:33 2017 -0700

Handle exceptions from VNC API in OpServer validate_user_token

Add auth token validation for all links served by
contrail-analytics-api using the decorator OpServer
validate_user_token. Handle VNC exceptions in the
decorator. Change all systemless tests to use
the OpServer rest API port instead of the admin port

Return HTTP status code 503 when not able to connect
to VNC API

Change-Id: I2aa4b154e852de8a5c26c6c3654e1fb650b05822
Closes-Bug: #1718969
Closes-Bug: #1611161

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/36119
Committed: http://github.com/Juniper/contrail-controller/commit/82a8218c84caf406b84e5f4d0201aaf555dcec8b
Submitter: Zuul (<email address hidden>)
Branch: master

commit 82a8218c84caf406b84e5f4d0201aaf555dcec8b
Author: Megh Bhatt <email address hidden>
Date: Thu Sep 28 23:43:33 2017 -0700

Handle exceptions from VNC API in OpServer validate_user_token

Add auth token validation for all links served by
contrail-analytics-api using the decorator OpServer
validate_user_token. Handle VNC exceptions in the
decorator. Change all systemless tests to use
the OpServer rest API port instead of the admin port

Return HTTP status code 503 when not able to connect
to VNC API

Change-Id: I2aa4b154e852de8a5c26c6c3654e1fb650b05822
Closes-Bug: #1718969
Closes-Bug: #1611161

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/36873
Submitter: Megh Bhatt (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/36873
Committed: http://github.com/Juniper/contrail-controller/commit/31bc538842c92a3d9cef19ef7a78599e2bb01bc2
Submitter: Zuul (<email address hidden>)
Branch: R4.0

commit 31bc538842c92a3d9cef19ef7a78599e2bb01bc2
Author: Megh Bhatt <email address hidden>
Date: Thu Oct 26 10:28:47 2017 -0700

Handle exceptions from VNC API in OpServer validate_user_token

Add auth token validation for all links served by
contrail-analytics-api using the decorator OpServer
validate_user_token. Handle VNC exceptions in the
decorator.

Return HTTP status code 503 when not able to connect
to VNC API

Change-Id: I2aa4b154e852de8a5c26c6c3654e1fb650b05822
Closes-Bug: #1718969
Closes-Bug: #1611161