OpenNebula

Hi Stefan,

The code that generates the tokens is really simple

        # Proxy data
        host     = vm_resource['/VM/HISTORY_RECORDS/HISTORY[last()]/HOSTNAME']
        vnc_port = vm_resource['TEMPLATE/GRAPHICS/PORT']
        vnc_pw = vm_resource['TEMPLATE/GRAPHICS/PASSWD']

        # Generate token random_str: host:port
        random_str = rand(36**20).to_s(36) #random string a-z0-9 length 20
        token = "#{random_str}: #{host}:#{vnc_port}" 
        token_file = 'one-'+vm_resource['ID']

        # Create token file
        begin
            f = File.open(File.join(@token_folder, token_file), 'w')
            f.write(token)
            f.close
        rescue Exception => e
            @logger.error e.message
            return error(500, "Cannot create VNC proxy token")
        end

Maybe you can configure a hook when a new VM is created, generate this token file and update the VM info with the token information. Therefore you don't need a new API call to retrieve this info.

Hope this helps

We need a valid token everytime a user requests a vnc session. Tokens can only be used once. A hook when a new vm gets created won't help here, since the next time a vnc session request comes in the token is not valid anymore. If we can query the API for a new token it's possible to offer VNC functionality outside of sunstone (another portal for example, like we have). Maybe I just don't understand your solution or I have false assumptions on how novnc tokens work.

Tokens can be used more than once for each VM. They are only destroyed when novnc is stopped

Well, every time a vnc session is started a new token gets generated and the token_file overwritten. So a token is actually only usable once. This might be changed in the code (check if token exists, if not create new one, otherwise leave old token_file) but it doesn't solve the problem when novnc gets restarted. There is no way (as far as I can see) to update the token in the vm automatically after a restart from novnc. Besides scripting this in novnc init scripts, but this becomes rather ugly. Having this novnc token in the database instead of on a filesystem might help solve this problem. It would also solve the problem when more than one novnc proxy is used (i.e. multiple sunstone instances are running, like we have), no need for a shared filesystem anymore.

+1 for this feature.

We don't know how to retrieve the token from Sunstone REST API.

Regards.