get-ncroleconfig return error with ontap 9.X : There is an error in XML document (1, 129).

[masson]

Hello Team,

I encounter a problem with Get-NcRoleConfig from PSTK 4.2.0.0

It works well with ONTAP 8.3.2

But it failed with ONTAP 9.1:

PS C:\Users\masson> Get-NcRoleConfig -Controller $cot3
Get-NcRoleConfig : There is an error in XML document (1, 129).
At line:1 char:1
+ Get-NcRoleConfig -Controller $cot3
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (cot3:NcController) [Get-NcRoleConfig], InvalidOperationException
+ FullyQualifiedErrorId : ApiException,DataONTAP.C.PowerShell.SDK.Cmdlets.Security.GetNcRoleConfig

The only think i saw in apache.log is:

10.64.74.154 10.65.176.31 4294967295 admin [Thu Jul 13 17:55:34.041663 2017 +0200] "POST /servlets/netapp.servlets.admin.XMLrequest_filer HTTP/1.1" 200 84450 307794 - 0 + 127.0.0.1 security-login-role-config-get-iter

Any advices?

TIA

[asulliva]

For reference, this is bug 1098234.

Andrew

[tim_vd]

Hi Andrew, is this an internal bug? Cannot seem to get information for that.

We get the same error while running the latest NetAppdocs on every 9.1 cluster we are installing.

                 <S N="Activity">Get-NcRoleConfig</S>
                  <S N="Reason">InvalidOperationException</S>
                  <S N="TargetName">clustername</S>
                  <S N="TargetType">NcController</S>
                  <S N="Description">There is an error in XML document (1, 129).</S>

[asulliva · Accepted solution]

This appears to be a bug in the ZAPI being used by PSTK, or at least the documentation so that consumers (e.g. PSTK) know what output to expect.  To dig a little deeper, here is the ZAPI output from my ONTAP 9.1 cluster:

<results status="passed">
    <attributes-list>
        <security-login-role-config-info>
            <account-expiry-time>unlimited</account-expiry-time>
            <account-inactive-limit>unlimited</account-inactive-limit>
            <change-password-duration-in-days>0</change-password-duration-in-days>
            <delay-after-failed-login>4</delay-after-failed-login>
            <last-passwords-disallowed-count>6</last-passwords-disallowed-count>
            <lockout-duration>0</lockout-duration>
            <max-failed-login-attempts>0</max-failed-login-attempts>
            <min-passwd-specialchar>0</min-passwd-specialchar>
            <min-password-size>8</min-password-size>
            <min-username-size>3</min-username-size>
            <passwd-expiry-warn-time>unlimited</passwd-expiry-warn-time>
            <passwd-min-digits>0</passwd-min-digits>
            <passwd-min-lowercase-chars>0</passwd-min-lowercase-chars>
            <passwd-min-uppercase-chars>0</passwd-min-uppercase-chars>
            <password-expiration-duration>unlimited</password-expiration-duration>
            <require-initial-password-update>false</require-initial-password-update>
            <require-password-alpha-numeric>true</require-password-alpha-numeric>
            <require-username-alpha-numeric>false</require-username-alpha-numeric>
            <role-name>vsadmin</role-name>
            <vserver>qtest</vserver>
        </security-login-role-config-info>
    </attributes-list>
    <num-records>1</num-records>
</results>

The error I'm receiving is saying that it can't parse a string into a number for the value of account-inactive-limit.  If we look at the ZAPI docs it says it's a string type with an integer value:

In the ZAPI response above, notice that the value is "unlimited"...which is not an integer.  PSTK is using the function System.Number.StringToNumber to attempt to convert that into an integer, which fails and is causing the error we are seeing.

I'll create a bug to track this.  If you're willing to PM me your address, I'm happy to send you some stickers as a bug bounty 😄

Andrew