ldap group sync validation failes

[openshiftdemos]

ldap group sync validation failes

[kmurudi]

corrected typo and a task with - #53

[thoraxe]

Is this still an issue @kmurudi @dmesser ?

[dmesser]

Can't verify because I am running into #62

[kmurudi]

Worked for me in earlier deployment, but will have to check for #62 now first

[dmesser]

Fails for me with the following:

TASK [Checking if all the groups have been created by 'oc adm groups sync'] *****************************************************************************************************************
Friday 04 August 2017  06:49:07 -0400 (0:00:00.565)       0:00:00.657 *********
failed: [master.internal.aws.testdrive.openshift.com] (item=ose-user) => {
    "changed": true,
    "cmd": [
        "oc",
        "get",
        "group",
        "ose-user"
    ],
    "delta": "0:00:00.216769",
    "end": "2017-08-04 06:49:08.254813",
    "failed": true,
    "item": "ose-user",
    "rc": 1,
    "start": "2017-08-04 06:49:08.038044"
}

STDERR:

Error from server (Forbidden): User "teamuser1" cannot get groups at the cluster scope

failed: [master.internal.aws.testdrive.openshift.com] (item=ose-normal-dev) => {
    "changed": true,
    "cmd": [
        "oc",
        "get",
        "group",
        "ose-normal-dev"
    ],
    "delta": "0:00:00.209247",
    "end": "2017-08-04 06:49:08.612416",
    "failed": true,
    "item": "ose-normal-dev",
    "rc": 1,
    "start": "2017-08-04 06:49:08.403169"
}

STDERR:

Error from server (Forbidden): User "teamuser1" cannot get groups at the cluster scope

failed: [master.internal.aws.testdrive.openshift.com] (item=ose-fancy-dev) => {
    "changed": true,
    "cmd": [
        "oc",
        "get",
        "group",
        "ose-fancy-dev"
    ],
    "delta": "0:00:00.206244",
    "end": "2017-08-04 06:49:08.971087",
    "failed": true,
    "item": "ose-fancy-dev",
    "rc": 1,
    "start": "2017-08-04 06:49:08.764843"
}

STDERR:

Error from server (Forbidden): User "teamuser1" cannot get groups at the cluster scope

failed: [master.internal.aws.testdrive.openshift.com] (item=ose-teamed-app) => {
    "changed": true,
    "cmd": [
        "oc",
        "get",
        "group",
        "ose-teamed-app"
    ],
    "delta": "0:00:00.206438",
    "end": "2017-08-04 06:49:09.326905",
    "failed": true,
    "item": "ose-teamed-app",
    "rc": 1,
    "start": "2017-08-04 06:49:09.120467"
}

STDERR:

Error from server (Forbidden): User "teamuser1" cannot get groups at the cluster scope

[thoraxe]

This is a common problem when using Ansible to automate/test OpenShift. We forget to choose the right OpenShift user and assume we are running the right one! Looks like you were not a cluster admin.

Kshitija should add a task at the beginning of the play that does a oc login -u system:admin to become the cluster administrator before performing these tests.

[thoraxe]

Temporary fix for you @dmesser is to perform that yourself before launching Ansible.

[kmurudi]

@thoraxe @dmesser in the automation script - I have assigned role of 'cluster_admin' to group - ose-normal-dev so, teamuser1.2 were able to access all the projects and do the verif tests

[thoraxe]

Dunno what fixed this but It's no longer a problem.