++ -----Original Message----- From: Thamlur Raju Sent: Friday, July 5, 2019 6:21 PM To: [email protected] Subject: RE: [onap-discuss] [AAI] AAI got access denied (403)
Hi Keong, Thank you for the response. I doesn't have any certificate issue and the CADI filter issue. The aai-resources pod is not producing any logs, and there is no issue of disk storage also. As work around, I disable the AAF in the AAI values.yaml (aaf-auth with one-way-ssl), now it is working fine. Temporally I disable the AAf authentication. If you got any permanent solution with AAF authentication, Please let us know. Thanks & Regards, Thamlur Raju. -----Original Message----- From: [email protected] <[email protected]> On Behalf Of Keong Lim Sent: Friday, July 5, 2019 12:24 PM To: Thamlur Raju <[email protected]>; [email protected] Subject: Re: [onap-discuss] [AAI] AAI got access denied (403) Hi Thamlur, Your aai-resources pod should be producing many log messages. Note that if you use "kubectl logs" command, then you also need to specify the right container inside the pod as well. For example, at the startup, it should show many CADI filter initialisations: $ kubectl -n onap logs dev-aai-aai-resources-7c8b66fbf4-pkplj aai-resources | less 2019-02-25T03:50:25.484+0000 INIT [cadi] aaf_taf_class is set to org.onap.aaf.cadi.aaf.v2_0.AAFTaf 2019-02-25T03:50:25.490+0000 INIT [cadi] ID Conversion from AAI to [email protected] enabled 2019-02-25T03:50:25.490+0000 INIT [cadi] ID Conversion from ModelLoader to [email protected] enabled 2019-02-25T03:50:25.490+0000 INIT [cadi] ID Conversion from AaiUI to [email protected] enabled 2019-02-25T03:50:25.491+0000 INIT [cadi] ID Conversion from MSO to [email protected] enabled 2019-02-25T03:50:25.491+0000 INIT [cadi] ID Conversion from SDNC to [email protected] enabled 2019-02-25T03:50:25.491+0000 INIT [cadi] ID Conversion from DCAE to [email protected] enabled 2019-02-25T03:50:25.491+0000 INIT [cadi] ID Conversion from POLICY to [email protected] enabled 2019-02-25T03:50:25.492+0000 INIT [cadi] ID Conversion from ASDC to [email protected] enabled 2019-02-25T03:50:25.492+0000 INIT [cadi] ID Conversion from VID to [email protected] enabled 2019-02-25T03:50:25.492+0000 INIT [cadi] ID Conversion from APPC to [email protected] enabled 2019-02-25T03:50:25.492+0000 INIT [cadi] ID Conversion from OOF to [email protected] enabled 2019-02-25T03:50:25.492+0000 INIT [cadi] AAF TAF Configured to https://AAF_LOCATE_URL/AAF_NS.service:2.0 2019-02-25T03:50:25.493+0000 INIT [cadi] aaf_oauth2_token_url is set to https://AAF_LOCATE_URL/AAF_NS.token:2.0/token and corresponding to each API call, it should show CADI filter authentications: 2019-02-25T03:55:01.416+0000 WARN [cadi] Trans: [email protected][BAth],ip=172.16.0.72,ms=758.335266,validate=0.348612,code=757.946838 2019-02-25T03:55:01.605+0000 AUDIT [cadi] ID AAI converted to [email protected] 2019-02-25T03:55:01.605+0000 INFO [cadi] Authenticated: [email protected] authenticated by cached AAF password from 172.16.0.72:35458 However, if you have some problems, e.g. like expiring certificates in https://ind01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fjira.onap.org%2Fbrowse%2FAAI-2474&data=02%7C01%7CTR00568434%40TechMahindra.com%7Ca0bcf683d06d4ea9dfa308d70117544a%7Cedf442f5b9944c86a131b42b03a16c95%7C0%7C0%7C636979072018324161&sdata=AQL5U0XxCilG2BsjbhhIzRIzWQq5evRqUR77zT2l1rI%3D&reserved=0 then the aai-resources log will show error messages like this: 2019-06-04T07:01:54.453+0000: Error connecting https://ind01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faaf-locate.onap%3A8095%2Flocat&data=02%7C01%7CTR00568434%40TechMahindra.com%7Ca0bcf683d06d4ea9dfa308d70117544a%7Cedf442f5b9944c86a131b42b03a16c95%7C0%7C0%7C636979072018334169&sdata=lfURs1sdVZ3Kcxf%2B3Xj4qF2UxNvZ3hXh2Rc3R6JRqHg%3D&reserved=0 e/AAF_NS.service:2.0 for location. org.onap.aaf.misc.env.APIException: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown at org.onap.aaf.cadi.http.HClient.send(HClient.java:153) at org.onap.aaf.cadi.aaf.v2_0.AAFLocator.refresh(AAFLocator.java:109) 2019-06-04T07:01:54.454+0000 WARN [cadi] Authenticating Service unavailable from 172.16.0.72:35486 ( No Entries found for 'https://ind01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faaf-locate.onap%3A8095%2Flocate%2FAAF_NS.service%3A2.0&data=02%7C01%7CTR00568434%40TechMahindra.com%7Ca0bcf683d06d4ea9dfa308d70117544a%7Cedf442f5b9944c86a131b42b03a16c95%7C0%7C0%7C636979072018334169&sdata=9V62uNY8RniVXwuwTpIOvCCHbzrwjU6FBF22ObX4dH0%3D&reserved=0' ) 2019-06-04T07:01:54.454+0000 AUDIT [cadi] No TAF will authorize for request from 172.16.0.72:35486 If your aai-resources pod is not producing any logs at all, then I would suspect that your disk storage is full. In that case, please fix the underlying disk problem first, then restart your pods and try again. There are other scenarios that could lead to a 403 error too, so it may require further investigation. Keong ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally http://tim.techmahindra.com/tim/disclaimer.html internally within TechMahindra. ============================================================================================================================ -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#17881): https://lists.onap.org/g/onap-discuss/message/17881 Mute This Topic: https://lists.onap.org/mt/32308503/21656 Group Owner: [email protected] Unsubscribe: https://lists.onap.org/g/onap-discuss/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
<<attachment: winmail.dat>>
