VMware NoPermission faults do not log what permission was missing

[Shawn Hartsock]

NoPermission object has a privilegeId that tells us which permission the user did not have. Presently the VMware nova driver does not log this data. This is very useful for debugging user permissions problems on vCenter or ESX.

http://pubs.vmware.com/vsphere-55/index.jsp#com.vmware.wssdk.apiref.doc/vim.fault.NoPermission.html

[Eric Brown (ericwb)]

Looks like the only place where this exception is thrown is from the Login() in the driver.py.
   https://github.com/openstack/nova/blob/master/nova/virt/vmwareapi/driver.py#L725
which currently catches on Exception.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/79761

[Tracy Jones (tjones-i)]

ok i got called out on this one :-) This should really be rc-potential

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/havana
Review: https://review.openstack.org/83502

[Openstack Gerrit (openstack-gerrit)]

Reviewed: https://review.openstack.org/79761
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=62cb0dc6257daac5ec9fd1a90ee5721e6543dd76
Submitter: Jenkins
Branch: master

commit 62cb0dc6257daac5ec9fd1a90ee5721e6543dd76
Author: Eric Brown <email address hidden>
Date: Tue Mar 11 16:38:54 2014 -0400

    VMware: Log additional details of suds faults

    When a suds requests results in a fault response, the current
    code loses details on that fault in the sequence of exceptions
    propagated through the driver. A NoPermission fault will contain
    additional metadata on the privilegeId and object type which
    needs to be logged. The fault string will be propagated with this
    fix, along with details of a NoPermission fault.

    An example of the new exception:
    NoPermissionException: Permission to perform this operation was denied.
    {u'privilegeId': Resource.AssignVMToPool, u'object': domain-c7}

    An example of new exception within retrieveproperties_fault_checker:
    Error(s) NoPermission occurred in the call to RetrievePropertiesEx
    {'privilegeId': System.Read, 'object': datacenter-16}

    Change-Id: Iafbf052750c2835f304b2edf21d7300d1fbd7e5a
    Closes-bug: #1289627

[Eric Brown (ericwb)]

oslo.vmware patch merged with:
https://review.openstack.org/#/c/90699/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/90809
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=fe4fe70240d6b30ea157e8802b3dce54d62b4583
Submitter: Jenkins
Branch: stable/icehouse

commit fe4fe70240d6b30ea157e8802b3dce54d62b4583
Author: Eric Brown <email address hidden>
Date: Tue Mar 11 16:38:54 2014 -0400

    VMware: Log additional details of suds faults

    When a suds requests results in a fault response, the current
    code loses details on that fault in the sequence of exceptions
    propagated through the driver. A NoPermission fault will contain
    additional metadata on the privilegeId and object type which
    needs to be logged. The fault string will be propagated with this
    fix, along with details of a NoPermission fault.

    An example of the new exception:
    NoPermissionException: Permission to perform this operation was denied.
    {u'privilegeId': Resource.AssignVMToPool, u'object': domain-c7}

    An example of new exception within retrieveproperties_fault_checker:
    Error(s) NoPermission occurred in the call to RetrievePropertiesEx
    {'privilegeId': System.Read, 'object': datacenter-16}

    Change-Id: Iafbf052750c2835f304b2edf21d7300d1fbd7e5a
    Closes-bug: #1289627
    (cherry picked from commit 62cb0dc6257daac5ec9fd1a90ee5721e6543dd76)

[Vipin Balachandran (vbala)]

Released in oslo.vmware 0.3.