<div dir="ltr"><div>We had a short discussion and decided to implement this feature for 5.1 in this way:<br></div><ol><li>Do not store credentials at all even in browser</li><li>Do not implement specific handling of auth errors</li>
<li>Make the form hidden by default; it can be shown by clicking a button</li><li>There will be a short description</li></ol><p>It will look like this:</p><p><a href="http://i.imgur.com/0Uwx0M5.png">http://i.imgur.com/0Uwx0M5.png</a></p>
<p><a href="http://i.imgur.com/VF1skHw.png">http://i.imgur.com/VF1skHw.png</a><br></p><p>I think we'll change the button text to "Provide Credentials" and the description to "If you changed the credentials after deployment, you need to provide new ones to run the checks. The credentials won't be stored anywhere.". Your suggestions are welcome.<br>
</p></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-07-12 2:54 GMT+04:00 David Easter <span dir="ltr"><<a href="mailto:deaster@mirantis.com" target="_blank">deaster@mirantis.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif"><div>I think showing this only upon failure is good – if the user is also given the option to sore the credentials in the browser. That way, you only have to re-enter the credentials once if you want convenience, or do it every time if you want improved security.</div>
<div><br></div><div>One downside would be that if you don’t cache the credentials, you’ll have to “fail” the auth every time to be given the chance to re-enter the credentials. It may not be obvious that clicking “run tests” will then let you enter new credentials. I was thinking that having a button you can press to enter the credentials would make it more obvious, but wouldn’t reduce the number of clicks… I.e. either run tests and fail or click “Enter credentials” and enter new ones. The “Enter credential” option would obviously be a little faster…</div>
<div><br></div><div><div>- David J. Easter</div><div> Director of Product Management, Mirantis, Inc.</div><div> </div></div><span><div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span> Mike Scherbakov <<a href="mailto:mscherbakov@mirantis.com" target="_blank">mscherbakov@mirantis.com</a>><br><span style="font-weight:bold">Reply-To: </span> "OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Date: </span> Friday, July 11, 2014 at 2:36 PM<br><span style="font-weight:bold">To: </span> "OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span> Re: [openstack-dev] [Fuel] [OSTF] OSTF stops working after password is changed<br></div><div><div class="h5"><div><br></div><div dir="ltr"><span style="font-family:arial,sans-serif;font-size:12.800000190734863px">I'm wondering if we can show all these windows ONLY if there is authz failure with existing credentials from Nailgun.</span><div style="font-family:arial,sans-serif;font-size:12.800000190734863px">
So the flow would be: user clicks on "Run tests" button, healthcheck tries to access OpenStack and fails. It shows up text fields to enter tenant/user/pass with the message similar to "Default administrative credentials to OpenStack were changed since the deployment time. Please provide current credentials so HealthCheck can access OpenStack and run verification tests."</div>
<div style="font-family:arial,sans-serif;font-size:12.800000190734863px"><br></div><div style="font-family:arial,sans-serif;font-size:12.800000190734863px">I think it should be more obvious this way...</div><div style="font-family:arial,sans-serif;font-size:12.800000190734863px">
<br></div><div style="font-family:arial,sans-serif;font-size:12.800000190734863px">Anyone, it must be a choice for a user, if he wants to store creds in a browser.</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Fri, Jul 11, 2014 at 8:50 PM, Vitaly Kramskikh <span dir="ltr"><<a href="mailto:vkramskikh@mirantis.com" target="_blank">vkramskikh@mirantis.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>Hi,<br><br></div>In the current implementation we store provided credentials in browser local storage. What's your opinion on that? Maybe we shouldn't store new credentials at all even in browser? So users have to enter them manually every time they want to run OSTF.<br>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-06-25 13:47 GMT+04:00 Dmitriy Shulyak <span dir="ltr"><<a href="mailto:dshulyak@mirantis.com" target="_blank">dshulyak@mirantis.com</a>></span>:<div>
<div><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">It is possible to change everything so username, password and tenant fields<div><br></div><div>
Also this way we will be able to run tests not only as admin user</div></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Wed, Jun 25, 2014 at 12:29 PM, Vitaly Kramskikh <span dir="ltr"><<a href="mailto:vkramskikh@mirantis.com" target="_blank">vkramskikh@mirantis.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Dmitry,<br><br>Fields or field? Do we need to provide password only or other credentials are needed?<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-06-25 13:02 GMT+04:00 Dmitriy Shulyak <span dir="ltr"><<a href="mailto:dshulyak@mirantis.com" target="_blank">dshulyak@mirantis.com</a>></span>:<div>
<div><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Looks like we will stick to #2 option, as most reliable one.<div><br></div><div>- we have no way to know that openrc is changed, even if some scripts relies on it - ostf should not fail with auth error</div>
<div>- we can create ostf user in post-deployment stage, but i heard that some ceilometer tests relied on admin user, also</div><div> operator may not want to create additional user, for some reasons</div><div><br></div>
<div>So, everybody is ok with additional fields on HealthCheck tab?</div><div><br></div><div><br></div></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jun 20, 2014 at 8:17 PM, Andrew Woodward <span dir="ltr"><<a href="mailto:xarses@gmail.com" target="_blank">xarses@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The openrc file has to be up to date for some of the HA scripts to<br>
work, we could just source that.<br><div><div><br>
On Fri, Jun 20, 2014 at 12:12 AM, Sergii Golovatiuk<br>
<<a href="mailto:sgolovatiuk@mirantis.com" target="_blank">sgolovatiuk@mirantis.com</a>> wrote:<br>
> +1 for #2.<br>
><br>
> ~Sergii<br>
><br>
><br>
> On Fri, Jun 20, 2014 at 1:21 AM, Andrey Danin <<a href="mailto:adanin@mirantis.com" target="_blank">adanin@mirantis.com</a>> wrote:<br>
>><br>
>> +1 to Mike. Let the user provide actual credentials and use them in place.<br>
>><br>
>><br>
>> On Fri, Jun 20, 2014 at 2:01 AM, Mike Scherbakov<br>
>> <<a href="mailto:mscherbakov@mirantis.com" target="_blank">mscherbakov@mirantis.com</a>> wrote:<br>
>>><br>
>>> I'm in favor of #2. I think users might not want to have their password<br>
>>> stored in Fuel Master node.<br>
>>> And if so, then it actually means we should not save it when user<br>
>>> provides it on HealthCheck tab.<br>
>>><br>
>>><br>
>>> On Thu, Jun 19, 2014 at 8:05 PM, Vitaly Kramskikh<br>
>>> <<a href="mailto:vkramskikh@mirantis.com" target="_blank">vkramskikh@mirantis.com</a>> wrote:<br>
>>>><br>
>>>> Hi folks,<br>
>>>><br>
>>>> We have a bug which prevents OSTF from working if user changes a<br>
>>>> password which was using for the initial installation. I skimmed through the<br>
>>>> comments and it seems there are 2 viable options:<br>
>>>><br>
>>>> Create a separate user just for OSTF during OpenStack installation<br>
>>>> Provide a field for a password in UI so user could provide actual<br>
>>>> password in case it was changed<br>
>>>><br>
>>>> What do you guys think? Which options is better?<br>
>>>><br>
>>>> --<br>
>>>> Vitaly Kramskikh,<br>
>>>> Software Engineer,<br>
>>>> Mirantis, Inc.<br>
>>>><br>
>>>> _______________________________________________<br>
>>>> OpenStack-dev mailing list<br>
>>>> <a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
>>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>>>><br>
>>><br>
>>><br>
>>><br>
>>> --<br>
>>> Mike Scherbakov<br>
>>> #mihgen<br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> OpenStack-dev mailing list<br>
>>> <a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>>><br>
>><br>
>><br>
>><br>
>> --<br>
>> Andrey Danin<br>
>> <a href="mailto:adanin@mirantis.com" target="_blank">adanin@mirantis.com</a><br>
>> skype: gcon.monolake<br>
>><br>
>> _______________________________________________<br>
>> OpenStack-dev mailing list<br>
>> <a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>><br>
><br>
><br>
> _______________________________________________<br>
> OpenStack-dev mailing list<br>
> <a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
><br><br><br><br>
--<br></div></div>Andrew<br>
Mirantis<br>
Ceph community<br><div><div><br>
_______________________________________________<br>
OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div></div></blockquote></div><br></div></div></div><br>_______________________________________________<br>
OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div></div></div><div><div><br><br clear="all"><br>-- <br><div dir="ltr">Vitaly Kramskikh,<br>Software Engineer,<br>Mirantis, Inc.</div></div></div></div><br>_______________________________________________<br>
OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div></div><br>_______________________________________________<br>
OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div></div></div><div><div><br><br clear="all"><br>-- <br><div dir="ltr">Vitaly Kramskikh,<br>Software Engineer,<br>Mirantis, Inc.</div></div></div></div><br>_______________________________________________<br>
OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Mike Scherbakov<br>#mihgen<br><br></div></div>
_______________________________________________
OpenStack-dev mailing list
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</div></div></span></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr">Vitaly Kramskikh,<br>Software Engineer,<br>Mirantis, Inc.</div>
</div>