juju asking to login to every controller

[Ondrej Kuchar]

we're creating juju users and trying to operate with those instead of super-admin user.
Problem is when juju runs in HA it is asking for password for every controller

for example when I run same command, without providing password (pressing Ctrl+c)
kucharo@ic-skbrat2-infra1:~$ juju show-user -c foundations-maas
please enter password for kucharo on foundations-maas:
kucharo@ic-skbrat2-infra1:~$ juju show-user -c foundations-maas kucharo
please enter password for kucharo on foundations-maas:
kucharo@ic-skbrat2-infra1:~$ juju show-user -c foundations-maas kucharo
please enter password for kucharo on foundations-maas:
kucharo@ic-skbrat2-infra1:~$ juju show-user -c foundations-maas kucharo
please enter password for kucharo on foundations-maas:
kucharo@ic-skbrat2-infra1:~$ juju show-user -c foundations-maas kucharo
please enter password for kucharo on foundations-maas:
kucharo@ic-skbrat2-infra1:~$ juju show-user -c foundations-maas kucharo
user-name: kucharo
access: login
date-created: 2018-11-12
last-connection: just now

with --debug is visible that one controller is logged in
https://pastebin.ubuntu.com/p/BKZ6myGpm5/

juju controllers:
https://pastebin.ubuntu.com/p/HJRy74jFKs/

juju show-model:
https://pastebin.ubuntu.com/p/MZCJ7BYCH3/

I'd say juju should share state of user authentication between controllers in HA mode

[John A Meinel (jameinel)]

this seems like an issue with the underlying macaroon authentication. I'll add the Candid project.

[John A Meinel (jameinel)]

https://github.com/CanonicalLtd/candid/issues/109

[Ante Karamatić (ivoks)]

FWIW, candid is not being used here.

[Richard Harding (rharding)]

Thanks, we're investigating how we can make sure that the macaroons minted are good on each of the controllers. Typically we'd use a dns name to help with this, but understand that's not always part of the setup.

[Gábor Mészáros (gabor.meszaros)]

A possible workaround for this situation is to include the password in the accounts definition file. E.g.:

.local/share/juju/accounts.yaml
controllers:
  controller1:
    user: user1
    password: MySecurePassw0rd
    last-known-access: login

Which may not be optimal for some use cases, but for others it could be even better, as there will be no password prompted when the sessions expire.

[Anastasia (anastasia-macmood)]

Removing from a milestone as this work will not be done in 2.5 series.

[Canonical Juju QA Bot (juju-qa-bot)]

This bug has not been updated in 2 years, so we're marking it Low importance. If you believe this is incorrect, please update the importance.