[Freeipa-users] blank user screen? (web UI)

[Dmitri Pal]

On 06/22/2015 01:11 PM, Petr Vobornik wrote:
> On 06/22/2015 06:39 PM, Janelle wrote:
>> On 6/22/15 9:25 AM, Petr Vobornik wrote:
>>> On 06/22/2015 04:15 PM, Janelle wrote:
>>>> On 6/22/15 5:15 AM, Petr Vobornik wrote:
>>>>> On 06/21/2015 08:35 AM, Janelle wrote:
>>>>>> Hi,
>>>>>>
>>>>>> Sure. Just login as a normal user to the WEB UI. screen is blank:
>>>>>>
>>>>>> Of course, if you click on Actions - you will see those and you can
>>>>>> click on
>>>>>> them, but you can't do anything else. This is a vanilla server
>>>>>> install, nothing
>>>>>> fancy. Oh and there is no error message at all. Any browser = same
>>>>>> results.
>>>>>>
>>>>>> Tried clearing cache, history, web data.. Everything. Many of my
>>>>>> users report
>>>>>> the same thing.  This is 7.1 with IPA 4.1.7
>>>>>>
>>>>>> Now the funny part - login as "admin" and everything works fine. But
>>>>>> I certainly
>>>>>> can't have everyone logging in as admin. :-)
>>>>>>
>>>>>> ~Janelle
>>>>>
>>>>> Do you see any error in browser console?
>>>>>
>>>>> Does this happen also to a user which doesn't have any RBAC role
>>>>> assigned(either directly or indrectly)?
>>>> AHA -- perhaps a clue:
>>>>
>>>> [Error] Failed to load resource: the server responded with a status of
>>>> 401 (Unauthorized) (json, line 0)
>>>> [Error] Failed to load resource: the server responded with a status of
>>>> 401 (Unauthorized) (login_kerberos, line 0)
>>>> [Error] Failed to load resource: the server responded with a status of
>>>> 404 (Not Found) (jquery-2.0.3.min.map, line 0)
>>>>
>>>> ~J
>>>
>>> These errors are expected. First two happens when user is not yet
>>> authenticated. Third line is just about file for jquery debugging
>>> which is not shipped with ipa.
>>>
>>> Could you inspect other json request? Mainly the 3 which are executed
>>> on navigating to user details page (or after clicking on "refresh"
>>> button on the page). Does the first result of first request (of the
>>> three) contain user data as in
>>> <https://pvoborni.fedorapeople.org/images/user_response_data.png>
>>>
>>> I'm unable to reproduce the issue with
>>> ipa-server-4.1.0-18.el7_1.3.x86_64.
>>>
>>> Do these users have some special permissions/roles/rights?
>> The user I did the same from is a User Administrator, however, all the
>> other users are NOT.  And if you watch closely, all the details do flash
>> the screen, but then disappear. Refresh does nothing.  The one thing -
>> it works flawlessly for "admin" account.
>>
>> versions (I believe in the newest -- perhaps a bad idea)
>>
>> freeipa-client-4.1.4-1.el7.centos.x86_64
>> freeipa-server-4.1.4-1.el7.centos.x86_64
>> freeipa-python-4.1.4-1.el7.centos.x86_64
>>
>>
>> on a user screen after login -  :
>>
>> [Error] Failed to load resource: the server responded with a status of
>> 401 (Unauthorized) (json, line 0)
>> [Error] Failed to load resource: the server responded with a status of
>> 401 (Unauthorized) (login_kerberos, line 0)
>> [Error] Failed to load resource: the server responded with a status of
>> 404 (Not Found) (jquery-2.0.3.min.map, line 0)
>> [Error] Failed to load resource: the server responded with a status of
>> 401 (Unauthorized) (json, line 0)
>> [Error] Failed to load resource: the server responded with a status of
>> 401 (Unauthorized) (login_kerberos, line 0)
>> [Error] Failed to load resource: the server responded with a status of
>> 404 (Not Found) (jquery-2.0.3.min.map, line 0)
>> [Error] Failed to load resource: the server responded with a status of
>> 404 (Not Found) (jquery-2.0.3.min.map, line 0)
>>
>> ~Janelle
>
> If I understand it correctly, you get bunch of 401 Unauthorized errors 
> after successful auth? This should not happen. I have seen something 
> similar when clients were couple minutes in a future than the ipa 
> server (assuming forms based auth is used, otherwise it would fail on 
> obtaining TGT) because session expires immediately if clients are more 
> than 20 mins ahead. Or when krb ticket TTL was less than 5 minutes.
>
> Are there any "200 Success" requests to "ipa/session/json" or 
> ipa/session/login_password in the network tab as shown on image: 
> https://pvoborni.fedorapeople.org/images/user_response_data.png after 
> successful login?


Was this resolved or we need to file a ticket to track some bug?

-- 
Thank you,
Dmitri Pal

Director of Engineering for IdM portfolio
Red Hat, Inc.