Valery - Can you please file a bug for a better message. You are calling as a system user (port 8096) but for the account vdc3880 and so the system checks whether this account can access this template, network etc.
On 08/10/13 10:20 AM, "Valery Ciareszka" <valery.teres...@gmail.com> wrote: >Finally I've found the problem >in ./server/src/com/cloud/vm/UserVmManagerImpl.java near > _accountMgr.checkAccess(newAccount, null, true, >templateOwner); > > >The reason was that template was not public-enabled, therefore user >account >could not get access to non-public template. > >But I think exception message could be more friendly and senseful :-) > > > >On Mon, Oct 7, 2013 at 7:30 PM, Valery Ciareszka ><valery.teres...@gmail.com>wrote: > >> Hi all. >> >> I'm trying to deploy virtual machines through api and management throws >> permission issues. This worked in 4.0/4.1, but now I see following: >> >> curl " >> >>http://localhost:8096/client/?command=deployVirtualMachine&serviceofferin >>gid=2b45be75-0ec8-4683-91a0-d95414da310d&zoneid=4a5bc8e5-bab9-4f92-9249-d >>57ef8a0f9f8&templateid=94013c8f-b615-467f-8df2-635ac4c5efb5&networkids=59 >>28684b-f9fc-4c2f-a74b-d6af622250f3&account=vdc3880&domainid=2744e9b6-8633 >>-4e8d-bb4d-860fe5e7e744 >> " >> >> >> <?xml version="1.0" encoding="UTF-8"?> >> <deployvirtualmachineresponse >> cloud-stack-version="4.2.0"><errorcode>531</errorcode> >> <cserrorcode>4365</cserrorcode> >> <errortext>Acct[ebcf2919-a842-4986-a8ed-a3806dfbd8f2-vdc3880] does not >> have permission to operate with resource >> Acct[9d9ef909-2469-11e3-9901-90e2ba51b336-admin]</errortext> >> </deployvirtualmachineresponse> >> >> Same thing upon assignVirtualMachine api call: >> >> curl " >> >>http://localhost:8096/client/?command=assignVirtualMachine&virtualmachine >>id=dbee3d10-0c8d-4d74-bcbd-21fb041fbfce&account=vdc3880&domainid=2744e9b6 >>-8633-4e8d-bb4d-860fe5e7e744 >> " >> <?xml version="1.0" encoding="UTF-8"?><moveuservmresponse >> >>cloud-stack-version="4.2.0"><errorcode>530</errorcode><cserrorcode>9999</ >>cserrorcode><errortext>Failed >> to move vm Acct[ebcf2919-a842-4986-a8ed-a3806dfbd8f2-vdc3880] does not >>have >> permission to operate with resource >> >>Acct[9d9ef909-2469-11e3-9901-90e2ba51b336-admin]</errortext></moveuservmr >>esponse> >> >> environment used: CS 4.2.0, centos 6.4, KVM >> >> P.S. It seems error message is being generated >> at ./server/src/com/cloud/acl/DomainChecker.java: >> 145 if (caller.getId() != entity.getAccountId()) { >> 146 throw new PermissionDeniedException(caller + >> "entry3 does not have permission to operate with resource " + >> entity); >> 147 } >> >> But I can not understand why callerid goes from vdc3880 account - I'm >> calling API as admin (tested both through cloudmonkey and directly on >>8096 >> port) ? >> >> Any thoughts ? >> >> -- >> Regards, >> Valery >> >> http://protocol.by/slayer >> > > > >-- >Regards, >Valery > >http://protocol.by/slayer
