<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Arial;color: #000000;font-size: 10pt;">Hi,<br>
<br>
I am trying to give admin rights to my clusters to non-root users. I have two users which need to be able to control the cluster. Both are members of the haclient group, and I have created acl roles granting write-access. I can query the cluster status, but
I am unable to perform any commands:<br>
id<br>
uid=1000(mdaf) gid=1000(mdaf) groups=1000(mdaf),10(wheel),189(haclient),801(mdaf),802(mdafkey),803(mdafmaintain)<br>
<br>
pcs acl<br>
ACLs are enabled<br>
<br>
User: mdaf<br>
Roles: admin<br>
User: mdafmaintain<br>
Roles: admin<br>
Role: admin<br>
Permission: write xpath /cib (admin-write)<br>
<br>
pcs cluster status<br>
Cluster Status:<br>
Last updated: Mon Jun 13 11:46:45 2016 Last change: Mon Jun 13 11:46:38 2016 by root via cibadmin on MDA2PFP-S02<br>
Stack: corosync<br>
Current DC: MDA2PFP-S01 (version 1.1.13-10.el7-44eb2dd) - partition with quorum<br>
2 nodes and 9 resources configured<br>
Online: [ MDA2PFP-S01 MDA2PFP-S02 ]<br>
<br>
PCSD Status:<br>
MDA2PFP-S01: Online<br>
MDA2PFP-S02: Online<br>
<br>
pcs cluster stop<br>
Error: localhost: Permission denied - (HTTP error: 403)<br>
<br>
pcs cluster start<br>
Error: localhost: Permission denied - (HTTP error: 403)<br>
<br>
I tried to use sudo instead, but this also not working:<br>
sudo pcs status<br>
Permission denied<br>
Error: unable to locate command: /usr/sbin/crm_mon<br>
<br>
Any help would be greatly appreciated.<br>
<br>
Best wishes,<br>
Jens<br>
<div><br>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div id="divBdy" class="bdyItmPrt">
<div>
<div><span lang="en-GB">
<div>
<div style="margin:0pt"><font face="Calibri,sans-serif" size="2"><span style="font-size:11pt"><font color="#a29791" face="Arial,sans-serif" size="2"><span style="font-size:9pt">--</span></font></span></font></div>
<font face="Arial" size="1"><span style="font-size:8pt">
<div><font size="2"><span style="font-size:9pt"><b>Jens Auer </b>| <span style="background-color:rgb(255,255,255)">
CGI | Software-Engineer</span></span></font></div>
<span style="background-color:rgb(255,255,255)"></span>
<div><font size="2"><span style="font-size:9pt"><span style="background-color:yellow"><span style="background-color:rgb(255,255,255)">CGI (Germany) GmbH & Co. KG</span><br>
</span>Rheinstraße 95 | 64295 Darmstadt | Germany</span></font></div>
<div><font size="2"><span style="font-size:9pt">T: +49 6151 36860 154<br>
<a href="mailto:jens.auer@cgi.com"><u>jens.auer@cgi.com</u></a><br>
<font size="1"><span style="font-size:7.5pt">Unsere Pflichtangaben gemäß § 35a GmbHG / §§ 161, 125a HGB finden Sie un<span style="background-color:rgb(255,255,255)">ter
</span></span></font><span style="background-color:rgb(255,255,255)"><a href="http://de.cgi.com/pflichtangaben" target="_blank"><font size="1"><span style="font-size:7.5pt"><u>de.cgi.com/pflichtangaben</u></span></font></a><font size="1"><span style="font-size:7.5pt">.</span></font></span></span></font></div>
<span style="background-color:rgb(255,255,255)"></span>
<div><font face="Calibri" size="2"><span style="font-size:11pt"> </span></font></div>
<div><font size="1"><span style="font-size:7.5pt">CONFIDENTIALITY NOTICE: Proprietary/Confidential information belonging to CGI Group Inc. and its affiliates may be contained in this message. If you are not a recipient indicated or intended in this message
(or responsible for delivery of this message to such person), or you think for any reason that this message may have been addressed to you in error, you may not use or copy or deliver this message to anyone else. In such case, you should destroy this message
and are asked to notify the sender by reply e-mail.</span></font></div>
</span></font></div>
</span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>