Repository navigation
Moving User with API key fails through MySQLIntegrityConstraintViolationException #2707
Description
ISSUE TYPE
- Bug Report
COMPONENT NAME
CLOUDSTACK VERSION
Advanced Networking, Cloudstack 4.11.0.0 on Ubuntu 14.04 LTS,
MySQL 5.5.59-0ubuntu0.14.04.1
CONFIGURATION
OS / ENVIRONMENT
SUMMARY
The API call "moveUser" on a user with an API key fails with a MySQLIntegrityConstraintViolationException.
Moving a user without API key works perfectly.
Looks to me, as if there is a constraint on mySQL not allowing to have a new user with the same API key to be prepared.
STEPS TO REPRODUCE
Prepare user with an API key.
Call "move user id=<user-id> account=<destination account name>"
EXPECTED RESULTS
The user to be moved to the destination account.
ACTUAL RESULTS
API call returns with:
--
(rz-admin) :D > move user id=56fab0c7-6724-46c0-9904-eff4020485ad account=AdminTeam-Intern-Individuell
Error 530: Entity already exists:
{
"cserrorcode": 9999,
"errorcode": 530,
"errortext": "Entity already exists: ",
"uuidList": []
}
--
Exception in /var/log/cloudstack/management/management-server.log:
Caused by: com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException: Duplicate entry '<the api key>' for key 'i_user__api_key'
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
Activity
DaanHoogland commentedon Jun 13, 2018
thanks @mdesaive
mdesaive commentedon Jun 15, 2018
@DaanHoogland thanks a lot for taking care of this!
DaanHoogland commentedon Jun 15, 2018
welcome @mdesaive care to do a review of the code in return?
mdesaive commentedon Jun 15, 2018
Hi @DaanHoogland I did have a look at the code and it looks reasonable to me, although I have no Java Knowledge or IDE on hand. ;) If you like me to review it I can confirm it looks reasonable to me, assuming the following:
I understand the steps to move a user to another account like this:
Reading your discussion with @rafaelweingartner in PR #2710 the reason for creating a new entry in the database is that you do not want to loose information that is connected to old user.
Looking in the code with a texteditor, I see, that you erase API-key and API-secret for one of the users. I assume it is the old user? So the user attached to the destination domain will still have the old API-key available?
DaanHoogland commentedon Jun 15, 2018
@mdesaive one of your assumptions is wrong; resources do not belong to users but to accounts, which means that a 'moved' user will loose all of it assets. The reasong for this change was to allow for a configuration change directed by a configured LDAP.
mdesaive commentedon Jun 15, 2018
@DaanHoogland I approved the changes for the PR. Hope I did that correctly, as it was my first time I reviewed code on GitHub. Please get back for me, if something more needs to be done.
PaulAngus commentedon Jun 19, 2018
Fixed by PR:
#2710