Start a Conversation

This post is more than 5 years old

Solved!

Go to Solution

4544

October 4th, 2014 03:00

Exceeded invalid login limit. Will be cleared within 60 minutes

Hi,

Trying to configure ViPR with cinder block, I face 2 issues:

First one:

- I have configured in cinder.conf the volume driver with the root user

- When I start cinder, I have the following error:

     SOSError: 'The token is not generated by authentication service.Max number of tokens exceeded for this user'

- Then I tried to relog on the VipR portal, I have this error:

     Exceeded invalid login limit. Will be cleared within 60 minutes

I am still able to login to the ViPR VM using ssh and the root user, so how can I remove:

     - The lock for root user?

     - Increase the number of token for root user?

Thanks!

35 Posts

October 7th, 2014 02:00

Hi

Just to close the subject. Now my LDAP is working so I can login with several logins, so I mark this question as answered.

Since others may fall in this issue, the thread is quite useful indeed.

Thanks for your answers.

35 Posts

October 4th, 2014 05:00

I have tried the method here:

https://www.emc.com/techpubs/vipr/run_rest_api_script_proxy_user-1.htm#GUID-2FA0956E-FAE1-48A7-B28D-88A735C3424F

BUT ... since I was logged-in using the portal, I do not have the token ... thus I cannot release it!!

35 Posts

October 4th, 2014 07:00

Thanks for the answer.

I have tried to stop/start the vipr1 vm, but it did not fix the error.

So, I tried to restart the vApp... just to be sure, and I can login again!!!

To recreate it is easy:

- You login on the portal

- then you start an openstack cinder-volume driver with the same user (root in my case because of my other issue with LDAP).

Too bad the config file does not allow several users particularly for test purpose.

Thanks.

72 Posts

October 4th, 2014 07:00

>>> I do not have token, thus cannot release it

You can intercept the traffic like using debugging proxies (for ex, like Fiddler if your ViPR Client is window) to see the authentication token as you know the portal will capture the token and use it in subsequent requests.

>>>> Exceeded invalid login limit


However since ViPR is not even allowing to login, so you no longer can capture it. but you may use the above approach to know token in future if you need it (for ex, if you want to try out some ViPR REST APIs - of course, one can always use authentication request to get new token if the goal is to try out rest apis).

Having said, that I also got similar error couple of times, even though I am sure (I think so:)), am using right credentials. (Can't recall exactly what I tried - but I think I did following) For the first time, I just waited and it started worked. Second time, I simply restarted vApp from vCenter, and started working. But I don't know the root cause/actual repro - probably it repros if one leaves portal idle for long time.

I know this is not directly answering your question, but should give you my thoughts on it or at the least u know you are not the only one come across this.

Regards.

72 Posts

October 4th, 2014 08:00

Now I think, I understand your scenario:

So, if i understand correctly you are able to login as 'root'. And ViPR portal gives two options in the portal - by default with user role, and switch to 'admin' role if user wants it. And if user need to login with different credential (like you - from portal), one has to log out.

And yes, you are correct - i don't think the ViPR portal currently has that functionality. It can be done as one can login to ViPR with different credentials from multiple boxes. from a development perspective, it involves more work (having said, i will leave the exact answer to ViPR experts as i don't want to conjecture things ).

Alternative approach: 

Have you tried ViPR CLI along with Portal as it is only for testing your use cases without waiting for an hour or so from the same client machine. I don't think ViPR CLI reuses authentication token by GUI, in fact i couldn't even capture ViPR CLI packets with HTTP proxy (so its not even interacting via REST or at typical HTTP layer).

Complicated approach (involves programming)

If it is for ur automation, and if you are familiar with programming - you can write your own simply client, always authenticate with the credentials, get different token and use it.

Regards.

35 Posts

October 4th, 2014 12:00

OK, I will try the little custom made program.

But before I have to connect to the LDAP server which is not working with ViPR ... see my other post on the subject.

So, for now, the workaround is to:

- Restart the vApp and then connect the cinder-volume ... and then loose access to the portal access...

36 Posts

October 6th, 2014 07:00

Nag,

not everything you stated is correct, I wanted to augment your answers a bit. Please see comments

So, if i understand correctly you are able to login as 'root'. And ViPR portal gives two options in the portal - by default with user role, and switch to 'admin' role if user wants it.

     >>> since ViPR 2.1 , there is no longer any switching between admin and user modes. If a user account has both admin and user privileges, he will see full range of menus on the left.

And if user need to login with different credential (like you - from portal), one has to log out.

     >>> ViPR authenticates users based on a cookie. When you log in, cookie is set in your browser. There is a different cookie for GUI and another for API.  In order to have 2 logins going from the same machine, you can use 2 different browser instances, you can use Incognito mode, or 2 completely different browsers. The idea in all cases is to achieve separate cookie spaces, because cookie name is a constant.

Are you trying to get Cinder to use ViPR, or ViPR to use Cinder?  If latter, please see this post on ECN, I made lots of comments to it, it takes you through pretty well, using XIV example. OpenStack (Icehouse) Installation and Configuration for use with EMC® ViPR®

Hope this helps.

72 Posts

October 7th, 2014 01:00

[+ 1 For using different browser. ]


I missed it. So, if Matt's AD issue is fixed, in lieu of using ViPR CLI/Custom Program, he can simply use from different browser and access portal.

Regards.

No Events found!

Top