CVE-2016-0721: Session Fixation (CWE-384)
value: Session fixation vulnerability in pcsd in pcs before 0.9.157.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 8.1
Published: 2017-04-21T15:59Z
Repository: https://github.com/ClusterLabs/pcs
Language: Ruby
Files changed: pcsd/auth.rb, pcsd/cfgsync.rb, pcsd/cluster_entity.rb, pcsd/fenceagent.rb, pcsd/pcs.rb, pcsd/pcsd-cli.rb, pcsd/pcsd.rb, pcsd/remote.rb, pcsd/resource.rb, pcsd/test/test_auth.rb
Commit date: 2016-02-15 15:57:36 +0100
Commit message: web UI auth: decouple auth_user from session

Sessions are processed in web UI part only. Pcsd backend does not work
with sessions so it only gets who is logged in and not the whole session.

Diff: diff --git a/pcsd/auth.rb b/pcsd/auth.rb
index f5e7d382..18f934b2 100644
--- a/pcsd/auth.rb
+++ b/pcsd/auth.rb
@@ -45,11 +45,11 @@ class PCSAuth
     return true
   end
 
   def self.getUsersGroups(username)
     stdout, stderr, retval = run_cmd(
-      getSuperuserSession, "id", "-Gn", username
+      getSuperuserAuth(), "id", "-Gn", username
     )
     if retval != 0
       $logger.info(
         "Unable to determine groups of user '#{username}': #{stderr.join(' ').strip}"
       )
@@ -92,45 +92,47 @@ class PCSAuth
       end
     }
     return false
   end
 
-  def self.loginByToken(session, cookies)
+  def self.loginByToken(cookies)
+    auth_user = {}
     if username = validToken(cookies["token"])
       if SUPERUSER == username
         if cookies['CIB_user'] and cookies['CIB_user'].strip != ''
-          session[:username] = cookies['CIB_user']
+          auth_user[:username] = cookies['CIB_user']
           if cookies['CIB_user_groups'] and cookies['CIB_user_groups'].strip != ''
-            session[:usergroups] = cookieUserDecode(
+            auth_user[:usergroups] = cookieUserDecode(
               cookies['CIB_user_groups']
             ).split(nil)
           else
-            session[:usergroups] = []
+            auth_user[:usergroups] = []
           end
         else
-          session[:username] = SUPERUSER
-          session[:usergroups] = []
+          auth_user[:username] = SUPERUSER
+          auth_user[:usergroups] = []
         end
-        return true
+        return auth_user
       else
-        session[:username] = username
+        auth_user[:username] = username
         success, groups = getUsersGroups(username)
-        session[:usergroups] = success ? groups : []
-        return true
+        auth_user[:usergroups] = success ? groups : []
+        return auth_user
       end
     end
-    return false
+    return nil
   end
 
-  def self.loginByPassword(session, username, password)
+  def self.loginByPassword(username, password)
     if validUser(username, password)
-      session[:username] = username
+      auth_user = {}
+      auth_user[:username] = username
       success, groups = getUsersGroups(username)
-      session[:usergroups] = success ? groups : []
-      return true
+      auth_user[:usergroups] = success ? groups : []
+      return auth_user
     end
-    return false
+    return nil
   end
 
   def self.isLoggedIn(session)
     username = session[:username]
     if (username != nil) and isUserAllowedToLogin(username, false)
@@ -139,11 +141,11 @@ class PCSAuth
       return true
     end
     return false
   end
 
-  def self.getSuperuserSession()
+  def self.getSuperuserAuth()
     return {
       :username => SUPERUSER,
       :usergroups => [],
     }
   end
@@ -160,7 +162,19 @@ class PCSAuth
   end
 
   def self.cookieUserDecode(text)
     return Base64.decode64(text)
   end
+
+  def self.sessionToAuthUser(session)
+    return {
+      :username => session[:username],
+      :usergroups => session[:usergroups],
+    }
+  end
+
+  def self.authUserToSession(auth_user, session)
+    session[:username] = auth_user[:username]
+    session[:usergroups] = auth_user[:usergroups]
+  end
 end
 
diff --git a/pcsd/cfgsync.rb b/pcsd/cfgsync.rb
index 0cfb587e..ca5a21ac 100644
--- a/pcsd/cfgsync.rb
+++ b/pcsd/cfgsync.rb
@@ -423,19 +423,19 @@ module Cfgsync
     end
   end
 
 
   class ConfigPublisher
-    def initialize(session, configs, nodes, cluster_name, tokens={})
+    def initialize(auth_user, configs, nodes, cluster_name, tokens={})
       @configs = configs
       @nodes = nodes
       @cluster_name = cluster_name
       @published_configs_names = @configs.collect { |cfg|
         cfg.class.name
       }
       @additional_tokens = tokens
-      @session = session
+      @auth_user = auth_user
     end
 
     def send(force=false)
       nodes_txt = @nodes.join(', ')
       @configs.each { |cfg|
@@ -449,11 +449,11 @@ module Cfgsync
       node_response = {}
       threads = []
       @nodes.each { |node|
         threads << Thread.new {
           code, out = send_request_with_token(
-            @session, node, 'set_configs', true, data, true, nil, 30,
+            @auth_user, node, 'set_configs', true, data, true, nil, 30,
             @additional_tokens
           )
           if 200 == code
             begin
               node_response[node] = JSON.parse(out)
@@ -533,15 +533,15 @@ module Cfgsync
     end
   end
 
 
   class ConfigFetcher
-    def initialize(session, config_classes, nodes, cluster_name)
+    def initialize(auth_user, config_classes, nodes, cluster_name)
       @config_classes = config_classes
       @nodes = nodes
       @cluster_name = cluster_name
-      @session = session
+      @auth_user = auth_user
     end
 
     def fetch_all()
       return self.filter_configs_cluster(
         self.get_configs_cluster(@nodes, @cluster_name),
@@ -589,11 +589,11 @@ module Cfgsync
       threads = []
       node_configs = {}
       nodes.each { |node|
         threads << Thread.new {
           code, out = send_request_with_token(
-            @session, node, 'get_configs', false, data
+            @auth_user, node, 'get_configs', false, data
           )
           if 200 == code
             begin
               parsed = JSON::parse(out)
               if 'ok' == parsed['status'] and cluster_name == parsed['cluster_name']
@@ -698,17 +698,17 @@ module Cfgsync
       config.save()
       return true, {}
     else
       # we run in a cluster so we need to sync the config
       publisher = ConfigPublisher.new(
-        PCSAuth.getSuperuserSession(), [config], nodes, cluster_name, tokens
+        PCSAuth.getSuperuserAuth(), [config], nodes, cluster_name, tokens
       )
       old_configs, node_responses = publisher.publish()
       if old_configs.include?(config.class.name)
         if fetch_on_conflict
           fetcher = ConfigFetcher.new(
-            PCSAuth.getSuperuserSession(), [config.class], nodes, cluster_name
+            PCSAuth.getSuperuserAuth(), [config.class], nodes, cluster_name
           )
           cfgs_to_save, _ = fetcher.fetch()
           cfgs_to_save.each { |cfg_to_save|
             cfg_to_save.save() if cfg_to_save.class == config.class
           }
@@ -749,21 +749,21 @@ module Cfgsync
       config_new.save()
       return true, {}
     end
     # we run in a cluster so we need to sync the config
     publisher = ConfigPublisher.new(
-      PCSAuth.getSuperuserSession(), [config_new], nodes, cluster_name,
+      PCSAuth.getSuperuserAuth(), [config_new], nodes, cluster_name,
       new_tokens
     )
     old_configs, node_responses = publisher.publish()
     if not old_configs.include?(config_new.class.name)
       # no node had newer tokens file, we are ok, everything done
       return true, node_responses
     end
     # get tokens from all nodes and merge them
     fetcher = ConfigFetcher.new(
-      PCSAuth.getSuperuserSession(), [config_new.class], nodes, cluster_name
+      PCSAuth.getSuperuserAuth(), [config_new.class], nodes, cluster_name
     )
     fetched_tokens = fetcher.fetch_all()[config_new.class.name]
     config_new = Cfgsync::merge_tokens_files(config, fetched_tokens, new_tokens)
     # and try to publish again
     return Cfgsync::save_sync_new_version(
diff --git a/pcsd/cluster_entity.rb b/pcsd/cluster_entity.rb
index 41dfff70..1da29e20 100644
--- a/pcsd/cluster_entity.rb
+++ b/pcsd/cluster_entity.rb
@@ -1016,11 +1016,11 @@ module ClusterEntity
       @corosync_enabled = false
       @pacemaker_enabled = false
       @pcsd_enabled = false
     end
 
-    def self.load_current_node(session, crm_dom=nil)
+    def self.load_current_node(crm_dom=nil)
       node = ClusterEntity::Node.new
       node.corosync = corosync_running?
       node.corosync_enabled = corosync_enabled?
       node.pacemaker = pacemaker_running?
       node.pacemaker_enabled = pacemaker_enabled?
diff --git a/pcsd/fenceagent.rb b/pcsd/fenceagent.rb
index b52ad6f4..8b0bc128 100644
--- a/pcsd/fenceagent.rb
+++ b/pcsd/fenceagent.rb
@@ -1,26 +1,26 @@
-def getFenceAgents(session, fence_agent = nil)
+def getFenceAgents(auth_user, fence_agent = nil)
   fence_agent_list = {}
   agents = Dir.glob('/usr/sbin/fence_' + '*')
   agents.each { |a|
     fa = FenceAgent.new
     fa.name =  a.sub(/.*\//,"")
     next if fa.name == "fence_ack_manual"
 
     if fence_agent and a.sub(/.*\//,"") == fence_agent.sub(/.*:/,"")
-      required_options, optional_options, advanced_options, info = getFenceAgentMetadata(session, fa.name)
+      required_options, optional_options, advanced_options, info = getFenceAgentMetadata(auth_user, fa.name)
       fa.required_options = required_options
       fa.optional_options = optional_options
       fa.advanced_options = advanced_options
       fa.info = info
     end
     fence_agent_list[fa.name] = fa
   }
   fence_agent_list
 end
 
-def getFenceAgentMetadata(session, fenceagentname)
+def getFenceAgentMetadata(auth_user, fenceagentname)
   options_required = {}
   options_optional = {}
   options_advanced = {
       "priority" => "",
       "pcmk_host_argument" => "",
@@ -41,11 +41,11 @@ def getFenceAgentMetadata(session, fenceagentname)
   if not fenceagentname.start_with?('fence_') or fenceagentname.include?('/')
     $logger.error "Invalid fence agent '#{fenceagentname}'"
     return [options_required, options_optional, options_advanced]
   end
   stdout, stderr, retval = run_cmd(
-    session, "/usr/sbin/#{fenceagentname}", '-o', 'metadata'
+    auth_user, "/usr/sbin/#{fenceagentname}", '-o', 'metadata'
   )
   metadata = stdout.join
   begin
     doc = REXML::Document.new(metadata)
   rescue REXML::ParseException => e
diff --git a/pcsd/pcs.rb b/pcsd/pcs.rb
index 2d7179bf..e441817e 100644
--- a/pcsd/pcs.rb
+++ b/pcsd/pcs.rb
@@ -14,53 +14,53 @@ require 'cfgsync.rb'
 require 'corosyncconf.rb'
 require 'resource.rb'
 require 'cluster_entity.rb'
 require 'auth.rb'
 
-def getAllSettings(session, cib_dom=nil)
+def getAllSettings(auth_user, cib_dom=nil)
   unless cib_dom
-    cib_dom = get_cib_dom(session)
+    cib_dom = get_cib_dom(auth_user)
   end
   ret = {}
   if cib_dom
     cib_dom.elements.each('/cib/configuration/crm_config//nvpair') { |e|
       ret[e.attributes['name']] = e.attributes['value']
     }
   end
   return ret
 end
 
-def add_fence_level(session, level, devices, node, remove = false)
+def add_fence_level(auth_user, level, devices, node, remove = false)
   if not remove
     stdout, stderr, retval = run_cmd(
-      session, PCS, "stonith", "level", "add", level, node, devices
+      auth_user, PCS, "stonith", "level", "add", level, node, devices
     )
     return retval,stdout, stderr
   else
     stdout, stderr, retval = run_cmd(
-      session, PCS, "stonith", "level", "remove", level, node, devices
+      auth_user, PCS, "stonith", "level", "remove", level, node, devices
     )
     return retval,stdout, stderr
   end
 end
 
-def add_node_attr(session, node, key, value)
+def add_node_attr(auth_user, node, key, value)
   stdout, stderr, retval = run_cmd(
-    session, PCS, "property", "set", "--node", node, key.to_s + '=' + value.to_s
+    auth_user, PCS, "property", "set", "--node", node, key.to_s + '=' + value.to_s
   )
   return retval
 end
 
-def add_meta_attr(session, resource, key, value)
+def add_meta_attr(auth_user, resource, key, value)
   stdout, stderr, retval = run_cmd(
-    session, PCS, "resource", "meta", resource, key.to_s + "=" + value.to_s
+    auth_user, PCS, "resource", "meta", resource, key.to_s + "=" + value.to_s
   )
   return retval
 end
 
 def add_location_constraint(
-  session, resource, node, score, force=false, autocorrect=true
+  auth_user, resource, node, score, force=false, autocorrect=true
 )
   if node == ""
     return "Bad node"
   end
 
@@ -72,16 +72,16 @@ def add_location_constraint(
 
   cmd = [PCS, "constraint", "location", resource, "prefers", nodescore]
   cmd << '--force' if force
   cmd << '--autocorrect' if autocorrect
 
-  stdout, stderr, retval = run_cmd(session, *cmd)
+  stdout, stderr, retval = run_cmd(auth_user, *cmd)
   return retval, stderr.join(' ')
 end
 
 def add_location_constraint_rule(
-  session, resource, rule, score, force=false, autocorrect=true
+  auth_user, resource, rule, score, force=false, autocorrect=true
 )
   cmd = [PCS, "constraint", "location", resource, "rule"]
   if score != ''
     if is_score(score.upcase)
       cmd << "score=#{score.upcase}"
@@ -90,16 +90,16 @@ def add_location_constraint_rule(
     end
   end
   cmd.concat(rule.shellsplit())
   cmd << '--force' if force
   cmd << '--autocorrect' if autocorrect
-  stdout, stderr, retval = run_cmd(session, *cmd)
+  stdout, stderr, retval = run_cmd(auth_user, *cmd)
   return retval, stderr.join(' ')
 end
 
 def add_order_constraint(
-    session, resourceA, resourceB, actionA, actionB, score, symmetrical=true,
+    auth_user, resourceA, resourceB, actionA, actionB, score, symmetrical=true,
     force=false, autocorrect=true
 )
   sym = symmetrical ? "symmetrical" : "nonsymmetrical"
   if score != ""
     score = "score=" + score
@@ -108,74 +108,74 @@ def add_order_constraint(
     PCS, "constraint", "order", actionA, resourceA, "then", actionB, resourceB,
     score, sym
   ]
   command << '--force' if force
   command << '--autocorrect' if autocorrect
-  stdout, stderr, retval = run_cmd(session, *command)
+  stdout, stderr, retval = run_cmd(auth_user, *command)
   return retval, stderr.join(' ')
 end
 
 def add_order_set_constraint(
-  session, resource_set_list, force=false, autocorrect=true
+  auth_user, resource_set_list, force=false, autocorrect=true
 )
   command = [PCS, "constraint", "order"]
   resource_set_list.each { |resource_set|
     command << "set"
     command.concat(resource_set)
   }
   command << '--force' if force
   command << '--autocorrect' if autocorrect
-  stdout, stderr, retval = run_cmd(session, *command)
+  stdout, stderr, retval = run_cmd(auth_user, *command)
   return retval, stderr.join(' ')
 end
 
 def add_colocation_constraint(
-  session, resourceA, resourceB, score, force=false, autocorrect=true
+  auth_user, resourceA, resourceB, score, force=false, autocorrect=true
 )
   if score == "" or score == nil
     score = "INFINITY"
   end
   command = [
     PCS, "constraint", "colocation", "add", resourceA, resourceB, score
   ]
   command << '--force' if force
   command << '--autocorrect' if autocorrect
-  stdout, stderr, retval = run_cmd(session, *command)
+  stdout, stderr, retval = run_cmd(auth_user, *command)
   return retval, stderr.join(' ')
 end
 
-def remove_constraint(session, constraint_id)
+def remove_constraint(auth_user, constraint_id)
   stdout, stderror, retval = run_cmd(
-    session, PCS, "constraint", "remove", constraint_id
+    auth_user, PCS, "constraint", "remove", constraint_id
   )
   $logger.info stdout
   return retval
 end
 
-def remove_constraint_rule(session, rule_id)
+def remove_constraint_rule(auth_user, rule_id)
   stdout, stderror, retval = run_cmd(
-    session, PCS, "constraint", "rule", "remove", rule_id
+    auth_user, PCS, "constraint", "rule", "remove", rule_id
   )
   $logger.info stdout
   return retval
 end
 
-def add_acl_role(session, name, description)
+def add_acl_role(auth_user, name, description)
   cmd = [PCS, "acl", "role", "create", name.to_s]
   if description.to_s != ""
     cmd << "description=#{description.to_s}"
   end
-  stdout, stderror, retval = run_cmd(session, *cmd)
+  stdout, stderror, retval = run_cmd(auth_user, *cmd)
   if retval != 0
     return stderror.join("\n").strip
   end
   return ""
 end
 
-def add_acl_permission(session, acl_role_id, perm_type, xpath_id, query_id)
+def add_acl_permission(auth_user, acl_role_id, perm_type, xpath_id, query_id)
   stdout, stderror, retval = run_cmd(
-    session, PCS, "acl", "permission", "add", acl_role_id.to_s, perm_type.to_s,
+    auth_user, PCS, "acl", "permission", "add", acl_role_id.to_s, perm_type.to_s,
     xpath_id.to_s, query_id.to_s
   )
   if retval != 0
     if stderror.empty?
       return "Error adding permission"
@@ -184,24 +184,24 @@ def add_acl_permission(session, acl_role_id, perm_type, xpath_id, query_id)
     end
   end
   return ""
 end
 
-def add_acl_usergroup(session, acl_role_id, user_group, name)
+def add_acl_usergroup(auth_user, acl_role_id, user_group, name)
   if (user_group == "user") or (user_group == "group")
     stdout, stderr, retval = run_cmd(
-      session, PCS, "acl", user_group, "create", name.to_s, acl_role_id.to_s
+      auth_user, PCS, "acl", user_group, "create", name.to_s, acl_role_id.to_s
     )
     if retval == 0
       return ""
     end
     if not /^error: (user|group) #{name.to_s} already exists$/i.match(stderr.join("\n").strip)
       return stderr.join("\n").strip
     end
   end
   stdout, stderror, retval = run_cmd(
-    session, PCS, "acl", "role", "assign", acl_role_id.to_s, name.to_s
+    auth_user, PCS, "acl", "role", "assign", acl_role_id.to_s, name.to_s
   )
   if retval != 0
     if stderror.empty?
       return "Error adding #{user_group}"
     else
@@ -209,13 +209,13 @@ def add_acl_usergroup(session, acl_role_id, user_group, name)
     end
   end
   return ""
 end
 
-def remove_acl_permission(session, acl_perm_id)
+def remove_acl_permission(auth_user, acl_perm_id)
   stdout, stderror, retval = run_cmd(
-    session, PCS, "acl", "permission", "delete", acl_perm_id.to_s
+    auth_user, PCS, "acl", "permission", "delete", acl_perm_id.to_s
   )
   if retval != 0
     if stderror.empty?
       return "Error removing permission"
     else
@@ -223,13 +223,13 @@ def remove_acl_permission(session, acl_perm_id)
     end
   end
   return ""
 end
 
-def remove_acl_usergroup(session, role_id, usergroup_id)
+def remove_acl_usergroup(auth_user, role_id, usergroup_id)
   stdout, stderror, retval = run_cmd(
-    session, PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s,
+    auth_user, PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s,
     "--autodelete"
   )
   if retval != 0
     if stderror.empty?
       return "Error removing user / group"
@@ -259,19 +259,19 @@ def get_cluster_nodes(cluster_name)
     nodes = []
   end
   return nodes
 end
 
-def send_cluster_request_with_token(session, cluster_name, request, post=false, data={}, remote=true, raw_data=nil)
+def send_cluster_request_with_token(auth_user, cluster_name, request, post=false, data={}, remote=true, raw_data=nil)
   $logger.info("SCRWT: " + request)
   nodes = get_cluster_nodes(cluster_name)
   return send_nodes_request_with_token(
-    session, nodes, request, post, data, remote, raw_data
+    auth_user, nodes, request, post, data, remote, raw_data
   )
 end
 
-def send_nodes_request_with_token(session, nodes, request, post=false, data={}, remote=true, raw_data=nil)
+def send_nodes_request_with_token(auth_user, nodes, request, post=false, data={}, remote=true, raw_data=nil)
   out = ""
   code = 0
   $logger.info("SNRWT: " + request)
 
   # If we're removing nodes, we don't send this to one of the nodes we're
@@ -289,11 +289,11 @@ def send_nodes_request_with_token(session, nodes, request, post=false, data={},
   end
 
   for node in nodes
     $logger.info "SNRWT Node: #{node} Request: #{request}"
     code, out = send_request_with_token(
-      session, node, request, post, data, remote, raw_data
+      auth_user, node, request, post, data, remote, raw_data
     )
     # try next node if:
     # - current node does not support the request (old version of pcsd?) (404)
     # - an exception or other error occurred (5xx)
     # - we don't have a token for the node (401, notoken)
@@ -326,26 +326,26 @@ def send_nodes_request_with_token(session, nodes, request, post=false, data={},
     break
   end
   return code, out
 end
 
-def send_request_with_token(session, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, additional_tokens={})
+def send_request_with_token(auth_user, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, additional_tokens={})
   token = additional_tokens[node] || get_node_token(node)
   $logger.info "SRWT Node: #{node} Request: #{request}"
   if not token
     $logger.error "Unable to connect to node #{node}, no token available"
     return 400,'{"notoken":true}'
   end
   cookies_data = {
     'token' => token,
   }
   return send_request(
-    session, node, request, post, data, remote, raw_data, timeout, cookies_data
+    auth_user, node, request, post, data, remote, raw_data, timeout, cookies_data
   )
 end
 
-def send_request(session, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, cookies_data=nil)
+def send_request(auth_user, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, cookies_data=nil)
   cookies_data = {} if not cookies_data
   begin
     request = "/#{request}" if not request.start_with?("/")
 
     # fix ipv6 address for URI.parse
@@ -372,14 +372,14 @@ def send_request(session, node, request, post=false, data={}, remote=true, raw_d
     cookies_data_default = {}
     # Let's be safe about characters in cookie variables and do base64.
     # We cannot do it for CIB_user however to be backward compatible
     # so we at least remove disallowed characters.
     cookies_data_default['CIB_user'] = PCSAuth.cookieUserSafe(
-      session[:username].to_s
+      auth_user[:username].to_s
     )
     cookies_data_default['CIB_user_groups'] = PCSAuth.cookieUserEncode(
-      (session[:usergroups] || []).join(' ')
+      (auth_user[:usergroups] || []).join(' ')
     )
 
     cookies_data_default.update(cookies_data)
     cookies_data_default.each { |name, value|
       cookies_to_send << CGI::Cookie.new('name' => name, 'value' => value).to_s
@@ -403,21 +403,21 @@ def send_request(session, node, request, post=false, data={}, remote=true, raw_d
     $logger.info "No response from: #{node} request: #{request}, exception: #{e}"
     return 400,'{"noresponse":true}'
   end
 end
 
-def add_node(session, new_nodename, all=false, auto_start=true)
+def add_node(auth_user, new_nodename, all=false, auto_start=true)
   if all
     command = [PCS, "cluster", "node", "add", new_nodename]
     if auto_start
       command << '--start'
       command << '--enable'
     end
-    out, stderror, retval = run_cmd(session, *command)
+    out, stderror, retval = run_cmd(auth_user, *command)
   else
     out, stderror, retval = run_cmd(
-      session, PCS, "cluster", "localnode", "add", new_nodename
+      auth_user, PCS, "cluster", "localnode", "add", new_nodename
     )
   end
   $logger.info("Adding #{new_nodename} to pcs_settings.conf")
   corosync_nodes = get_corosync_nodes()
   pcs_config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
@@ -429,19 +429,19 @@ def add_node(session, new_nodename, all=false, auto_start=true)
     sync_config, corosync_nodes, $cluster_name, true
   )
   return retval, out.join("\n") + stderror.join("\n")
 end
 
-def remove_node(session, new_nodename, all=false)
+def remove_node(auth_user, new_nodename, all=false)
   if all
     # we check for a quorum loss warning in remote_remove_nodes
     out, stderror, retval = run_cmd(
-      session, PCS, "cluster", "node", "remove", new_nodename, "--force"
+      auth_user, PCS, "cluster", "node", "remove", new_nodename, "--force"
     )
   else
     out, stderror, retval = run_cmd(
-      session, PCS, "cluster", "localnode", "remove", new_nodename
+      auth_user, PCS, "cluster", "localnode", "remove", new_nodename
     )
   end
   $logger.info("Removing #{new_nodename} from pcs_settings.conf")
   corosync_nodes = get_corosync_nodes()
   pcs_config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
@@ -455,42 +455,42 @@ def remove_node(session, new_nodename, all=false)
   return retval, out + stderror
 end
 
 def get_current_node_name()
   stdout, stderror, retval = run_cmd(
-    PCSAuth.getSuperuserSession, CRM_NODE, "-n"
+    PCSAuth.getSuperuserAuth(), CRM_NODE, "-n"
   )
   if retval == 0 and stdout.length > 0
     return stdout[0].chomp()
   end
   return ""
 end
 
 def get_local_node_id()
   if ISRHEL6
     out, errout, retval = run_cmd(
-      PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL, "cluster.cman"
+      PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL, "cluster.cman"
     )
     if retval != 0
       return ""
     end
     match = /cluster\.nodename=(.*)/.match(out.join("\n"))
     if not match
       return ""
     end
     local_node_name = match[1]
     out, errout, retval = run_cmd(
-      PCSAuth.getSuperuserSession,
+      PCSAuth.getSuperuserAuth(),
       CMAN_TOOL, "nodes", "-F", "id", "-n", local_node_name
     )
     if retval != 0
       return ""
     end
     return out[0].strip()
   end
   out, errout, retval = run_cmd(
-    PCSAuth.getSuperuserSession,
+    PCSAuth.getSuperuserAuth(),
     COROSYNC_CMAPCTL, "-g", "runtime.votequorum.this_node_id"
   )
   if retval != 0
     return ""
   else
@@ -502,11 +502,11 @@ def get_corosync_conf()
   return Cfgsync::cluster_cfg_class.from_file().text()
 end
 
 def get_corosync_nodes()
   stdout, stderror, retval = run_cmd(
-    PCSAuth.getSuperuserSession, PCS, "status", "nodes", "corosync"
+    PCSAuth.getSuperuserAuth(), PCS, "status", "nodes", "corosync"
   )
   if retval != 0
     return []
   end
 
@@ -532,11 +532,11 @@ def get_nodes_status()
   pacemaker_online = []
   pacemaker_offline = []
   pacemaker_standby = []
   in_pacemaker = false
   stdout, stderr, retval = run_cmd(
-    PCSAuth.getSuperuserSession, PCS, "status", "nodes", "both"
+    PCSAuth.getSuperuserAuth(), PCS, "status", "nodes", "both"
   )
   stdout.each {|l|
     l = l.chomp
     if l.start_with?("Pacemaker Nodes:")
       in_pacemaker = true
@@ -575,11 +575,11 @@ def get_nodes_status()
     'pacemaker_standby' => pacemaker_standby,
   }
 end
 
 def need_ring1_address?()
-  out, errout, retval = run_cmd(PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL)
+  out, errout, retval = run_cmd(PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL)
   if retval != 0
     return false
   else
     udpu_transport = false
     rrp = false
@@ -614,13 +614,13 @@ def is_cman_with_udpu_transport?
     return false
   end
   return false
 end
 
-def get_resource_agents_avail(session)
+def get_resource_agents_avail(auth_user, params)
   code, result = send_cluster_request_with_token(
-    session, params[:cluster], 'get_avail_resource_agents'
+    auth_user, params[:cluster], 'get_avail_resource_agents'
   )
   return {} if 200 != code
   begin
     ra = JSON.parse(result)
     if (ra["noresponse"] == true) or (ra["notauthorized"] == "true") or (ra["notoken"] == true) or (ra["pacemaker_not_running"] == true)
@@ -631,13 +631,13 @@ def get_resource_agents_avail(session)
   rescue JSON::ParserError
     return {}
   end
 end
 
-def get_stonith_agents_avail(session)
+def get_stonith_agents_avail(auth_user, params)
   code, result = send_cluster_request_with_token(
-    session, params[:cluster], 'get_avail_fence_agents'
+    auth_user, params[:cluster], 'get_avail_fence_agents'
   )
   return {} if 200 != code
   begin
     sa = JSON.parse(result)
     if (sa["noresponse"] == true) or (sa["notauthorized"] == "true") or (sa["notoken"] == true) or (sa["pacemaker_not_running"] == true)
@@ -651,11 +651,11 @@ def get_stonith_agents_avail(session)
 end
 
 def get_cluster_name()
   if ISRHEL6
     stdout, stderror, retval = run_cmd(
-      PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL, "cluster"
+      PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL, "cluster"
     )
     if retval == 0
       stdout.each { |line|
         match = /^cluster\.name=(.*)$/.match(line)
         return match[1] if match
@@ -672,11 +672,11 @@ def get_cluster_name()
     end
     return ''
   end
 
   stdout, stderror, retval = run_cmd(
-    PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL, "totem.cluster_name"
+    PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL, "totem.cluster_name"
   )
   if retval != 0 and not ISRHEL6
     # Cluster probably isn't running, try to get cluster name from
     # corosync.conf
     begin
@@ -698,13 +698,13 @@ def get_cluster_name()
   else
     return stdout.join().gsub(/.*= /,"").strip
   end
 end
 
-def get_node_attributes(session, cib_dom=nil)
+def get_node_attributes(auth_user, cib_dom=nil)
   unless cib_dom
-    cib_dom = get_cib_dom(session)
+    cib_dom = get_cib_dom(auth_user)
     return {} unless cib_dom
   end
   node_attrs = {}
   cib_dom.elements.each(
     '/cib/configuration/nodes/node/instance_attributes/nvpair'
@@ -736,13 +736,13 @@ def get_nodes_utilization(cib_dom)
     }
   }
   return utilization
 end
 
-def get_fence_levels(session, cib_dom=nil)
+def get_fence_levels(auth_user, cib_dom=nil)
   unless cib_dom
-    cib_dom = get_cib_dom(session)
+    cib_dom = get_cib_dom(auth_user)
     return {} unless cib_dom
   end
 
   fence_levels = {}
   cib_dom.elements.each(
@@ -758,13 +758,13 @@ def get_fence_levels(session, cib_dom=nil)
 
   fence_levels.each { |_, val| val.sort_by! { |obj| obj['level'].to_i }}
   return fence_levels
 end
 
-def get_acls(session, cib_dom=nil)
+def get_acls(auth_user, cib_dom=nil)
   unless cib_dom
-    cib_dom = get_cib_dom(session)
+    cib_dom = get_cib_dom(auth_user)
     return {} unless cib_dom
   end
 
   acls = {
     'role' => {},
@@ -804,18 +804,18 @@ def get_acls(session, cib_dom=nil)
   }
   acls['user'] = acls['target']
   return acls
 end
 
-def enable_cluster(session)
-  stdout, stderror, retval = run_cmd(session, PCS, "cluster", "enable")
+def enable_cluster(auth_user)
+  stdout, stderror, retval = run_cmd(auth_user, PCS, "cluster", "enable")
   return false if retval != 0
   return true
 end
 
-def disable_cluster(session)
-  stdout, stderror, retval = run_cmd(session, PCS, "cluster", "disable")
+def disable_cluster(auth_user)
+  stdout, stderror, retval = run_cmd(auth_user, PCS, "cluster", "disable")
   return false if retval != 0
   return true
 end
 
 def corosync_running?()
@@ -837,11 +837,11 @@ def corosync_enabled?()
 end
 
 def get_corosync_version()
   begin
     stdout, stderror, retval = run_cmd(
-      PCSAuth.getSuperuserSession, COROSYNC, "-v"
+      PCSAuth.getSuperuserAuth(), COROSYNC, "-v"
     )
   rescue
     stdout = []
   end
   if retval == 0
@@ -872,11 +872,11 @@ def pacemaker_enabled?()
 end
 
 def get_pacemaker_version()
   begin
     stdout, stderror, retval = run_cmd(
-      PCSAuth.getSuperuserSession, PACEMAKERD, "-$"
+      PCSAuth.getSuperuserAuth(), PACEMAKERD, "-$"
     )
   rescue
     stdout = []
   end
   if retval == 0
@@ -898,11 +898,11 @@ def cman_running?()
 end
 
 def get_cman_version()
   begin
     stdout, stderror, retval = run_cmd(
-      PCSAuth.getSuperuserSession, CMAN_TOOL, "-V"
+      PCSAuth.getSuperuserAuth(), CMAN_TOOL, "-V"
     )
   rescue
     stdout = []
   end
   if retval == 0
@@ -947,16 +947,16 @@ end
 
 def get_pcsd_version()
   return PCS_VERSION.split(".").collect { | x | x.to_i }
 end
 
-def run_cmd(session, *args)
+def run_cmd(auth_user, *args)
   options = {}
-  return run_cmd_options(session, options, *args)
+  return run_cmd_options(auth_user, options, *args)
 end
 
-def run_cmd_options(session, options, *args)
+def run_cmd_options(auth_user, options, *args)
   $logger.info("Running: " + args.join(" "))
   start = Time.now
   out = ""
   errout = ""
 
@@ -970,13 +970,13 @@ def run_cmd_options(session, options, *args)
     duration = Time.now - start
     $logger.debug(out)
     $logger.debug(errout)
     $logger.debug("Duration: " + duration.to_s + "s")
   }
-  cib_user = session[:username]
+  cib_user = auth_user[:username]
   # when running 'id -Gn' to get the groups they are not defined yet
-  cib_groups = (session[:usergroups] || []).join(' ')
+  cib_groups = (auth_user[:usergroups] || []).join(' ')
   $logger.info("CIB USER: #{cib_user}, groups: #{cib_groups}")
   # Open4.popen4 reimplementation which sets ENV in a child process prior
   # to running an external process by exec
   status = Open4::do_popen(proc_block, :init) { |ps_read, ps_write|
     ps_read.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
@@ -1046,11 +1046,11 @@ def add_prefix_to_keys(hash, prefix)
     new_hash["#{prefix}#{k}"] = v
   }
   return new_hash
 end
 
-def check_gui_status_of_nodes(session, nodes, check_mutuality=false, timeout=10)
+def check_gui_status_of_nodes(auth_user, nodes, check_mutuality=false, timeout=10)
   options = {}
   options[:check_auth_only] = '' if not check_mutuality
   threads = []
   not_authorized_nodes = []
   online_nodes = []
@@ -1058,11 +1058,11 @@ def check_gui_status_of_nodes(session, nodes, check_mutuality=false, timeout=10)
 
   nodes = nodes.uniq.sort
   nodes.each { |node|
     threads << Thread.new {
       code, response = send_request_with_token(
-        session, node, 'check_auth', false, options, true, nil, timeout
+        auth_user, node, 'check_auth', false, options, true, nil, timeout
       )
       if code == 200
         if check_mutuality
           begin
             parsed_response = JSON.parse(response)
@@ -1092,19 +1092,19 @@ def check_gui_status_of_nodes(session, nodes, check_mutuality=false, timeout=10)
   }
   threads.each { |t| t.join }
   return online_nodes, offline_nodes, not_authorized_nodes
 end
 
-def pcs_auth(session, nodes, username, password, force=false, local=true)
+def pcs_auth(auth_user, nodes, username, password, force=false, local=true)
   # if no sync is needed, do not report a sync error
   sync_successful = true
   sync_failed_nodes = []
   sync_responses = {}
   # check for already authorized nodes
   if not force
     online, offline, not_authenticated = check_gui_status_of_nodes(
-      session, nodes, true
+      auth_user, nodes, true
     )
     if not_authenticated.length < 1
       result = {}
       online.each { |node| result[node] = {'status' => 'already_authorized'} }
       offline.each { |node| result[node] = {'status' => 'noresponse'} }
@@ -1112,11 +1112,11 @@ def pcs_auth(session, nodes, username, password, force=false, local=true)
     end
   end
 
   # authorize the nodes locally (i.e. not bidirectionally)
   auth_responses = run_auth_requests(
-    session, nodes, nodes, username, password, force, true
+    auth_user, nodes, nodes, username, password, force, true
   )
 
   # get the tokens and sync them within the local cluster
   new_tokens = {}
   auth_responses.each { |node, response|
@@ -1160,20 +1160,20 @@ def pcs_auth(session, nodes, username, password, force=false, local=true)
       nodes.each { |node|
         nodes_to_auth << node if sync_not_supported_nodes.include?(node)
         nodes_to_auth << node if not cluster_nodes.include?(node)
       }
       auth_responses2 = run_auth_requests(
-        session, nodes_to_auth, nodes, username, password, force, false
+        auth_user, nodes_to_auth, nodes, username, password, force, false
       )
       auth_responses.update(auth_responses2)
     end
   end
 
   return auth_responses, sync_successful, sync_failed_nodes, sync_responses
 end
 
-def run_auth_requests(session, nodes_to_send, nodes_to_auth, username, password, force=false, local=true)
+def run_auth_requests(auth_user, nodes_to_send, nodes_to_auth, username, password, force=false, local=true)
   data = {}
   nodes_to_auth.each_with_index { |node, index|
     data["node-#{index}"] = node
   }
   data['username'] = username
@@ -1183,11 +1183,11 @@ def run_auth_requests(session, nodes_to_send, nodes_to_auth, username, password,
 
   auth_responses = {}
   threads = []
   nodes_to_send.each { |node|
     threads << Thread.new {
-      code, response = send_request(session, node, 'auth', true, data)
+      code, response = send_request(auth_user, node, 'auth', true, data)
       if 200 == code
         token = response.strip
         if '' == token
           auth_responses[node] = {'status' => 'bad_password'}
         else
@@ -1201,25 +1201,25 @@ def run_auth_requests(session, nodes_to_send, nodes_to_auth, username, password,
   threads.each { |t| t.join }
   return auth_responses
 end
 
 def send_local_configs_to_nodes(
-  session, nodes, force=false, clear_local_permissions=false
+  auth_user, nodes, force=false, clear_local_permissions=false
 )
   configs = Cfgsync::get_configs_local(true)
   if clear_local_permissions
     pcs_config = PCSConfig.new(configs[Cfgsync::PcsdSettings.name].text())
     pcs_config.permissions_local = Permissions::PermissionsSet.new([])
     configs[Cfgsync::PcsdSettings.name].text = pcs_config.text()
   end
   publisher = Cfgsync::ConfigPublisher.new(
-    session, configs.values(), nodes, $cluster_name
+    auth_user, configs.values(), nodes, $cluster_name
   )
   return publisher.send(force)
 end
 
-def send_local_certs_to_nodes(session, nodes)
+def send_local_certs_to_nodes(auth_user, nodes)
   begin
     data = {
       'ssl_cert' => File.read(CRT_FILE),
       'ssl_key' => File.read(KEY_FILE),
       'cookie_secret' => File.read(COOKIE_FILE),
@@ -1252,11 +1252,11 @@ def send_local_certs_to_nodes(session, nodes)
   node_response = {}
   threads = []
   nodes.each { |node|
     threads << Thread.new {
       code, response = send_request_with_token(
-        session, node, '/set_certs', true, data
+        auth_user, node, '/set_certs', true, data
       )
       node_response[node] = [code, response]
     }
   }
   threads.each { |t| t.join }
@@ -1297,17 +1297,17 @@ def send_local_certs_to_nodes(session, nodes)
       "Unable to save pcsd certificates to nodes: #{node_error.join(', ')}",
     'node_status' => node_status,
   }
 end
 
-def pcsd_restart_nodes(session, nodes)
+def pcsd_restart_nodes(auth_user, nodes)
   node_response = {}
   threads = []
   nodes.each { |node|
     threads << Thread.new {
       code, response = send_request_with_token(
-        session, node, '/pcsd_restart', true
+        auth_user, node, '/pcsd_restart', true
       )
       node_response[node] = [code, response]
     }
   }
   threads.each { |t| t.join }
@@ -1371,11 +1371,11 @@ def verify_cert_key_pair(cert, key)
   errors = []
   cert_modulus = nil
   key_modulus = nil
 
   stdout, stderr, retval = run_cmd_options(
-    PCSAuth.getSuperuserSession(),
+    PCSAuth.getSuperuserAuth(),
     {
       'stdin' => cert,
     },
     '/usr/bin/openssl', 'x509', '-modulus', '-noout'
   )
@@ -1384,11 +1384,11 @@ def verify_cert_key_pair(cert, key)
   else
     cert_modulus = stdout.join.strip
   end
 
   stdout, stderr, retval = run_cmd_options(
-    PCSAuth.getSuperuserSession(),
+    PCSAuth.getSuperuserAuth(),
     {
       'stdin' => key,
     },
     '/usr/bin/openssl', 'rsa', '-modulus', '-noout'
   )
@@ -1412,11 +1412,11 @@ def verify_cookie_secret(secret)
     return ['Cookie secret is empty']
   end
   return []
 end
 
-def cluster_status_from_nodes(session, cluster_nodes, cluster_name)
+def cluster_status_from_nodes(auth_user, cluster_nodes, cluster_name)
   node_map = {}
   forbidden_nodes = {}
   overview = {
     :cluster_name => cluster_name,
     :error_list => [],
@@ -1429,11 +1429,11 @@ def cluster_status_from_nodes(session, cluster_nodes, cluster_name)
 
   threads = []
   cluster_nodes.uniq.each { |node|
     threads << Thread.new {
       code, response = send_request_with_token(
-        session,
+        auth_user,
         node,
         'status',
         false,
         {:version=>'2', :operations=>'1'},
         true,
@@ -1620,11 +1620,11 @@ def get_node_uptime()
   hh, mm = mm.divmod(60)
   dd, hh = hh.divmod(24)
   return '%d day%s, %02d:%02d:%02d' % [dd, dd != 1?'s':'', hh, mm, ss]
 end
 
-def get_node_status(session, cib_dom)
+def get_node_status(auth_user, cib_dom)
   node_status = {
       :cluster_name => $cluster_name,
       :groups => [],
       :constraints => {
           # :rsc_location => [],
@@ -1632,14 +1632,14 @@ def get_node_status(session, cib_dom)
           # :rcs_order => []
       },
       :cluster_settings => {},
       :need_ring1_address => need_ring1_address?,
       :is_cman_with_udpu_transport => is_cman_with_udpu_transport?,
-      :acls => get_acls(session, cib_dom),
-      :username => session[:username],
-      :fence_levels => get_fence_levels(session, cib_dom),
-      :node_attr => node_attrs_to_v2(get_node_attributes(session, cib_dom)),
+      :acls => get_acls(auth_user, cib_dom),
+      :username => auth_user[:username],
+      :fence_levels => get_fence_levels(auth_user, cib_dom),
+      :node_attr => node_attrs_to_v2(get_node_attributes(auth_user, cib_dom)),
       :nodes_utilization => get_nodes_utilization(cib_dom),
       :known_nodes => []
   }
 
   nodes = get_nodes_status()
@@ -1657,11 +1657,11 @@ def get_node_status(session, cib_dom)
   if cib_dom
     node_status[:groups] = get_resource_groups(cib_dom)
     node_status[:constraints] = getAllConstraints(cib_dom.elements['/cib/configuration/constraints'])
   end
 
-  node_status[:cluster_settings] = getAllSettings(session, cib_dom)
+  node_status[:cluster_settings] = getAllSettings(auth_user, cib_dom)
 
   return node_status
 end
 
 def get_resource_groups(cib_dom)
@@ -1732,27 +1732,27 @@ def get_resource_by_id(id, cib_dom, crm_dom=nil, rsc_status=nil, operations=fals
     else
       return nil
   end
 end
 
-def get_crm_mon_dom(session)
+def get_crm_mon_dom(auth_user)
   begin
     stdout, _, retval = run_cmd(
-      session, CRM_MON, '--one-shot', '-r', '--as-xml'
+      auth_user, CRM_MON, '--one-shot', '-r', '--as-xml'
     )
     if retval == 0
       return REXML::Document.new(stdout.join("\n"))
     end
   rescue
     $logger.error 'Failed to parse crm_mon.'
   end
   return nil
 end
 
-def get_cib_dom(session)
+def get_cib_dom(auth_user)
   begin
-    stdout, _, retval = run_cmd(session, 'cibadmin', '-Q', '-l')
+    stdout, _, retval = run_cmd(auth_user, 'cibadmin', '-Q', '-l')
     if retval == 0
       return REXML::Document.new(stdout.join("\n"))
     end
   rescue
     $logger.error 'Failed to parse cib.'
@@ -1813,22 +1813,22 @@ def status_v1_to_v2(status)
   new_status[:status_version] = '1'
 
   return new_status
 end
 
-def allowed_for_local_cluster(session, action)
+def allowed_for_local_cluster(auth_user, action)
   pcs_config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
   return pcs_config.permissions_local.allows?(
-    session[:username], session[:usergroups], action
+    auth_user[:username], auth_user[:usergroups], action
   )
 end
 
-def allowed_for_superuser(session)
+def allowed_for_superuser(auth_user)
   $logger.debug(
-    "permission check superuser username=#{session[:username]} groups=#{session[:groups]}"
+    "permission check superuser username=#{auth_user[:username]} groups=#{auth_user[:usergroups]}"
   )
-  if SUPERUSER != session[:username]
+  if SUPERUSER != auth_user[:username]
     $logger.debug('permission denied')
     return false
   end
   $logger.debug('permission granted for superuser')
   return true
diff --git a/pcsd/pcsd-cli.rb b/pcsd/pcsd-cli.rb
index 630ff872..06578e51 100755
--- a/pcsd/pcsd-cli.rb
+++ b/pcsd/pcsd-cli.rb
@@ -24,58 +24,58 @@ def cli_exit(status, text=nil, data=nil, exitcode=0)
   exit exitcode
 end
 
 
 # bootstrap, emulate environment created by pcsd http server
-session = {}
+auth_user = {}
 PCS = get_pcs_path(File.expand_path(File.dirname(__FILE__)))
 $logger_device = StringIO.new
 $logger = configure_logger($logger_device)
 
 # check and set user
 uid = Process.uid
 if 0 == uid
   if ENV['CIB_user'] and ENV['CIB_user'].strip != ''
-    session[:username] = ENV['CIB_user']
+    auth_user[:username] = ENV['CIB_user']
     if ENV['CIB_user_groups'] and ENV['CIB_user_groups'].strip != ''
-      session[:usergroups] = ENV['CIB_user_groups'].split(nil)
+      auth_user[:usergroups] = ENV['CIB_user_groups'].split(nil)
     else
-      session[:usergroups] = []
+      auth_user[:usergroups] = []
     end
   else
-    session[:username] = SUPERUSER
-    session[:usergroups] = []
+    auth_user[:username] = SUPERUSER
+    auth_user[:usergroups] = []
   end
 else
   username = Etc.getpwuid(uid).name
   if not PCSAuth.isUserAllowedToLogin(username)
     cli_exit('access_denied')
   else
-    session[:username] = username
+    auth_user[:username] = username
     success, groups = PCSAuth.getUsersGroups(username)
-    session[:usergroups] = success ? groups : []
+    auth_user[:usergroups] = success ? groups : []
   end
 end
 
-# continue environment setup with user set in session
+# continue environment setup with user set in auth_user
 $cluster_name = get_cluster_name()
 
 # get params and run a command
 command = ARGV[0]
 allowed_commands = {
   'read_tokens' => {
     # returns tokens of the user who runs pcsd-cli, thus no permission check
     'only_superuser' => false,
     'permissions' => nil,
-    'call' => lambda { |params, session| read_tokens() },
+    'call' => lambda { |params, auth_user_| read_tokens() },
   },
   'auth' => {
     'only_superuser' => false,
     'permissions' => nil,
-    'call' => lambda { |params, session|
+    'call' => lambda { |params, auth_user_|
       auth_responses, sync_successful, sync_nodes_err, sync_responses = pcs_auth(
-        session, params['nodes'] || [], params['username'] || '',
+        auth_user_, params['nodes'] || [], params['username'] || '',
         params['password'] || '', params['force'], params['local']
       )
       return {
         'auth_responses' => auth_responses,
         'sync_successful' => sync_successful,
@@ -85,33 +85,33 @@ allowed_commands = {
     },
   },
   'send_local_configs' => {
     'only_superuser' => false,
     'permissions' => Permissions::FULL,
-    'call' => lambda { |params, session|
+    'call' => lambda { |params, auth_user_|
       send_local_configs_to_nodes(
         # for a case when sending to a node which is being added to a cluster
         # - the node doesn't have the config so it cannot check permissions
-        PCSAuth.getSuperuserSession(),
+        PCSAuth.getSuperuserAuth(),
         params['nodes'] || [],
         params['force'] || false,
         params['clear_local_cluster_permissions'] || false
       )
     }
   },
   'send_local_certs' => {
     'only_superuser' => false,
     'permissions' => Permissions::FULL,
-    'call' => lambda { |params, session|
-      send_local_certs_to_nodes(session, params['nodes'] || [])
+    'call' => lambda { |params, auth_user_|
+      send_local_certs_to_nodes(auth_user_, params['nodes'] || [])
     }
   },
   'pcsd_restart_nodes' => {
     'only_superuser' => false,
     'permissions' => nil,
-    'call' => lambda { |params, session|
-      pcsd_restart_nodes(session, params['nodes'] || [])
+    'call' => lambda { |params, auth_user_|
+      pcsd_restart_nodes(auth_user_, params['nodes'] || [])
     }
   },
 }
 
 if allowed_commands.key?(command)
@@ -119,20 +119,20 @@ if allowed_commands.key?(command)
     params = JSON.parse(STDIN.read)
   rescue JSON::ParserError => e
     cli_exit('bad_json_input', e.to_s)
   end
   if allowed_commands['only_superuser']
-    if not allowed_for_superuser(session)
+    if not allowed_for_superuser(auth_user)
       cli_exit('permission_denied')
     end
   end
   if allowed_commands['permissions']
-    if not allowed_for_local_cluster(session, command_settings['permissions'])
+    if not allowed_for_local_cluster(auth_user, command_settings['permissions'])
       cli_exit('permission_denied')
     end
   end
-  result = allowed_commands[command]['call'].call(params, session)
+  result = allowed_commands[command]['call'].call(params, auth_user)
   cli_exit('ok', nil, result)
 else
   cli_exit('bad_command')
 end
 
diff --git a/pcsd/pcsd.rb b/pcsd/pcsd.rb
index 847eb119..71369651 100644
--- a/pcsd/pcsd.rb
+++ b/pcsd/pcsd.rb
@@ -63,18 +63,15 @@ if development?
   also_reload 'wizard.rb'
   also_reload 'cfgsync.rb'
 end
 
 before do
+  @auth_user = nil
   if request.path != '/login' and not request.path == "/logout" and not request.path == '/remote/auth'
     protected! 
   end
   $cluster_name = get_cluster_name()
-  @errorval = session[:errorval]
-  @error = session[:error]
-  session[:errorval] = nil
-  session[:error] = nil
 end
 
 configure do
   DISABLE_GUI = (ENV['DISABLE_GUI'] and ENV['DISABLE_GUI'].downcase == 'true')
   PCS = get_pcs_path(File.expand_path(File.dirname(__FILE__)))
@@ -99,11 +96,11 @@ $thread_cfgsync = Thread.new {
           # do not sync if this host is not in a cluster
           cluster_name = get_cluster_name()
           if cluster_name and !cluster_name.empty?()
             $logger.debug('Config files sync thread fetching')
             fetcher = Cfgsync::ConfigFetcher.new(
-              PCSAuth.getSuperuserSession(), Cfgsync::get_cfg_classes(),
+              PCSAuth.getSuperuserAuth(), Cfgsync::get_cfg_classes(),
               get_corosync_nodes(), cluster_name
             )
             cfgs_to_save, _ = fetcher.fetch()
             cfgs_to_save.each { |cfg_to_save|
               cfg_to_save.save()
@@ -126,11 +123,12 @@ helpers do
       request.path == '/manage' or
       request.path == '/permissions' or
       request.path.match('/managec/.+/main')
     )
     if request.path.start_with?('/remote/') or request.path == '/run_pcs'
-      unless PCSAuth.loginByToken(session, cookies)
+      @auth_user = PCSAuth.loginByToken(cookies)
+      unless @auth_user
         halt [401, '{"notauthorized":"true"}']
       end
     else #/managec/* /manage/* /permissions
       if !gui_request and
         request.env['HTTP_X_REQUESTED_WITH'] != 'XMLHttpRequest'
@@ -165,15 +163,15 @@ helpers do
     return param_line + meta_options
   end
 end
 
 get '/remote/?:command?' do
-  return remote(params, request, session)
+  return remote(params, request, @auth_user)
 end
 
 post '/remote/?:command?' do
-  return remote(params, request, session)
+  return remote(params, request, @auth_user)
 end
 
 post '/run_pcs' do
   command = params['command'] || '{}'
   std_in = params['stdin'] || nil
@@ -304,24 +302,24 @@ post '/run_pcs' do
     }
     return JSON.pretty_generate(result)
   end
 
   if command_settings['only_superuser']
-    if not allowed_for_superuser(session)
+    if not allowed_for_superuser(@auth_user)
       return 403, 'Permission denied'
     end
   end
   if command_settings['permissions']
-    if not allowed_for_local_cluster(session, command_settings['permissions'])
+    if not allowed_for_local_cluster(@auth_user, command_settings['permissions'])
       return 403, 'Permission denied'
     end
   end
 
   options = {}
   options['stdin'] = std_in if std_in
   std_out, std_err, retval = run_cmd_options(
-    session, options, PCS, *command_decoded
+    @auth_user, options, PCS, *command_decoded
   )
   result = {
     'status' => 'ok',
     'data' => {
       'stdout' => std_out.join(""),
@@ -339,11 +337,15 @@ if not DISABLE_GUI
     session.clear
     erb :login, :layout => :main
   end
 
   post '/login' do
-    if PCSAuth.loginByPassword(session, params['username'], params['password'])
+    auth_user = PCSAuth.loginByPassword(
+      params['username'], params['password']
+    )
+    if auth_user
+      PCSAuth.authUserToSession(auth_user, session)
       # Temporarily ignore pre_login_path until we come up with a list of valid
       # paths to redirect to (to prevent status_all issues)
       #    if session["pre_login_path"]
       #      plp = session["pre_login_path"]
       #      session.delete("pre_login_path")
@@ -363,11 +365,11 @@ if not DISABLE_GUI
 
   post '/manage/existingcluster' do
     pcs_config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
     node = params['node-name']
     code, result = send_request_with_token(
-      PCSAuth.getSuperuserSession(), node, 'status'
+      PCSAuth.getSuperuserAuth(), node, 'status'
     )
     begin
       status = JSON.parse(result)
     rescue JSON::ParserError
       return 400, "Unable to communicate with remote pcsd on node '#{node}'."
@@ -389,11 +391,11 @@ if not DISABLE_GUI
 already been added to pcsd.  You may not add two clusters with the same name into pcsd."
       end
 
       # auth begin
       retval, out = send_request_with_token(
-        PCSAuth.getSuperuserSession(), node, '/get_cluster_tokens'
+        PCSAuth.getSuperuserAuth(), node, '/get_cluster_tokens'
       )
       if retval == 404 # backward compatibility layer
         warning_messages << "Unable to do correct authentication of cluster because it is running old version of pcs/pcsd."
       else
         if retval != 200
@@ -429,11 +431,12 @@ already been added to pcsd.  You may not add two clusters with the same name int
       return 400, "Unable to communicate with remote pcsd on node '#{node}'."
     end
   end
 
   post '/manage/newcluster' do
-    if not allowed_for_superuser(session)
+    auth_user = PCSAuth.sessionToAuthUser(session)
+    if not allowed_for_superuser(auth_user)
       return 400, 'Permission denied.'
     end
 
     warning_messages = []
 
@@ -470,11 +473,11 @@ already been added to pcsd.  You may not add two clusters with the same name int
 
     # first we need to authenticate nodes to each other
     tokens = add_prefix_to_keys(get_tokens_of_nodes(@nodes), "node:")
     @nodes.each {|n|
       retval, out = send_request_with_token(
-        session, n, "/save_tokens", true, tokens
+        auth_user, n, "/save_tokens", true, tokens
       )
       if retval == 404 # backward compatibility layer
         warning_messages << "Unable to do correct authentication of cluster on node '#{n}', because it is running old version of pcs/pcsd."
         break
       elsif retval != 200
@@ -486,11 +489,11 @@ already been added to pcsd.  You may not add two clusters with the same name int
     node_to_send_to = nodes_with_indexes.sort[0][1]
     $logger.info(
       "Sending setup cluster request for: #{@cluster_name} to: #{node_to_send_to}"
     )
     code,out = send_request_with_token(
-      session,
+      auth_user,
       node_to_send_to,
       'setup_cluster',
       true,
       {
         :clustername => @cluster_name,
@@ -544,15 +547,16 @@ already been added to pcsd.  You may not add two clusters with the same name int
       return 400, "Configuration conflict detected.\n\nSome nodes had a newer configuration than the local node.  Local node's configuration was updated.  Please repeat the last action if appropriate."
     end
   end
 
   get '/manage/check_pcsd_status' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     node_results = {}
     if params[:nodes] != nil and params[:nodes] != ''
       node_array = params[:nodes].split(',')
       online, offline, notauthorized = check_gui_status_of_nodes(
-        session, node_array
+        auth_user, node_array
       )
       online.each { |node|
         node_results[node] = 'Online'
       }
       offline.each { |node|
@@ -564,36 +568,38 @@ already been added to pcsd.  You may not add two clusters with the same name int
     end
     return JSON.generate(node_results)
   end
 
   get '/manage/get_nodes_sw_versions' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     if params[:nodes] != nil and params[:nodes] != ''
       nodes = params[:nodes].split(',')
       final_response = {}
       threads = []
       nodes.each {|node|
         threads << Thread.new {
           code, response = send_request_with_token(
-            session, node, 'get_sw_versions'
+            auth_user, node, 'get_sw_versions'
           )
           begin
             node_response = JSON.parse(response)
             if node_response and node_response['notoken'] == true
               $logger.error("ERROR: bad token for #{node}")
             end
             final_response[node] = node_response
-          rescue JSON::ParserError => e
+          rescue JSON::ParserError
           end
         }
       }
       threads.each { |t| t.join }
       return JSON.generate(final_response)
     end
     return '{}'
   end
 
   post '/manage/auth_gui_against_nodes' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     node_auth_error = {}
     new_tokens = {}
     threads = []
     params.each { |node|
       threads << Thread.new {
@@ -609,11 +615,11 @@ already been added to pcsd.  You may not add two clusters with the same name int
             'username' => SUPERUSER,
             'password' => pass,
             'force' => 1,
           }
           node_auth_error[nodename] = 1
-          code, response = send_request(session, nodename, 'auth', true, data)
+          code, response = send_request(auth_user, nodename, 'auth', true, data)
           if 200 == code
             token = response.strip
             if not token.empty?
               new_tokens[nodename] = token
               node_auth_error[nodename] = 0
@@ -639,21 +645,22 @@ already been added to pcsd.  You may not add two clusters with the same name int
     @manage = true
     erb :manage, :layout => :main
   end
 
   get '/clusters_overview' do
-    clusters_overview(params, request, session)
+    clusters_overview(params, request, PCSAuth.sessionToAuthUser(session))
   end
 
   get '/permissions/?' do
     @manage = true
     pcs_config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
     @clusters = pcs_config.clusters.sort { |a, b| a.name <=> b.name }
     erb :permissions, :layout => :main
   end
 
   get '/permissions_cluster_form/:cluster/?' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     @cluster_name = params[:cluster]
     @error = nil
     @permission_types = []
     @permissions_dependencies = {}
     @user_types = []
@@ -663,11 +670,11 @@ already been added to pcsd.  You may not add two clusters with the same name int
 
     if not pcs_config.is_cluster_name_in_use(@cluster_name)
       @error = 'Cluster not found'
     else
       code, data = send_cluster_request_with_token(
-        session, @cluster_name, 'get_permissions'
+        auth_user, @cluster_name, 'get_permissions'
       )
       if 404 == code
         @error = 'Cluster is running an old version of pcsd which does not support permissions'
       elsif 403 == code
         @error = 'Permission denied'
@@ -691,54 +698,59 @@ already been added to pcsd.  You may not add two clusters with the same name int
     end
     erb :_permissions_cluster
   end
 
   get '/managec/:cluster/main' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     @cluster_name = params[:cluster]
     pcs_config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
     @clusters = pcs_config.clusters
     @nodes = get_cluster_nodes(params[:cluster])
     if @nodes == []
       redirect '/manage/'
     end
-    @resource_agents = get_resource_agents_avail(session)
-    @stonith_agents = get_stonith_agents_avail(session)
+    @resource_agents = get_resource_agents_avail(auth_user, params)
+    @stonith_agents = get_stonith_agents_avail(auth_user, params)
     erb :nodes, :layout => :main
   end
 
   post '/managec/:cluster/permissions_save/?' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     new_params = {
       'json_data' => JSON.generate(params)
     }
     return send_cluster_request_with_token(
-      session, params[:cluster], "set_permissions", true, new_params
+      auth_user, params[:cluster], "set_permissions", true, new_params
     )
   end
 
   get '/managec/:cluster/status_all' do
-    status_all(params, request, session, get_cluster_nodes(params[:cluster]))
+    auth_user = PCSAuth.sessionToAuthUser(session)
+    status_all(params, request, auth_user, get_cluster_nodes(params[:cluster]))
   end
 
   get '/managec/:cluster/cluster_status' do
-    cluster_status_gui(session, params[:cluster])
+    auth_user = PCSAuth.sessionToAuthUser(session)
+    cluster_status_gui(auth_user, params[:cluster])
   end
 
   get '/managec/:cluster/cluster_properties' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     cluster = params[:cluster]
     unless cluster
       return 200, {}
     end
-    code, out = send_cluster_request_with_token(session, cluster, 'get_cib')
+    code, out = send_cluster_request_with_token(auth_user, cluster, 'get_cib')
     if code == 403
       return [403, 'Permission denied']
     elsif code != 200
       return [400, 'getting CIB failed']
     end
     begin
       properties = getAllSettings(nil, REXML::Document.new(out))
       code, out = send_cluster_request_with_token(
-        session, cluster, 'get_cluster_properties_definition'
+        auth_user, cluster, 'get_cluster_properties_definition'
       )
 
       if code == 403
         return [403, 'Permission denied']
       elsif code == 404
@@ -903,11 +915,11 @@ already been added to pcsd.  You may not add two clusters with the same name int
 
     nodes = get_cluster_nodes(clustername)
     tokens_data = add_prefix_to_keys(get_tokens_of_nodes(nodes), "node:")
 
     retval, out = send_cluster_request_with_token(
-      PCSAuth.getSuperuserSession(), clustername, "/save_tokens", true,
+      PCSAuth.getSuperuserAuth(), clustername, "/save_tokens", true,
       tokens_data, true
     )
     if retval == 404
       return [400, "Old version of PCS/PCSD is running on cluster nodes. Fixing authentication is not supported. Use 'pcs cluster auth' command to authenticate the nodes."]
     elsif retval != 200
@@ -915,15 +927,16 @@ already been added to pcsd.  You may not add two clusters with the same name int
     end
     return [200, "Auhentication of nodes in cluster should be fixed."]
   end
 
   post '/managec/:cluster/add_node_to_cluster' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     clustername = params[:cluster]
     new_node = params["new_nodename"]
 
     if clustername == $cluster_name
-      if not allowed_for_local_cluster(session, Permissions::FULL)
+      if not allowed_for_local_cluster(auth_user, Permissions::FULL)
         return 403, 'Permission denied'
       end
     end
 
     tokens = read_tokens
@@ -936,20 +949,20 @@ already been added to pcsd.  You may not add two clusters with the same name int
     # added to. Send the token to one node and let the cluster nodes synchronize
     # it by themselves.
     token_data = {"node:#{new_node}" => tokens[new_node]}
     retval, out = send_cluster_request_with_token(
       # new node doesn't have config with permissions yet
-      PCSAuth.getSuperuserSession(), clustername, '/save_tokens', true, token_data
+      PCSAuth.getSuperuserAuth(), clustername, '/save_tokens', true, token_data
     )
     # If the cluster runs an old pcsd which doesn't support /save_tokens,
     # ignore 404 in order to not prevent the node to be added.
     if retval != 404 and retval != 200
       return [400, 'Failed to save the token of the new node in target cluster.']
     end
 
     retval, out = send_cluster_request_with_token(
-      session, clustername, "/add_node_all", true, params
+      auth_user, clustername, "/add_node_all", true, params
     )
     if 403 == retval
       return [retval, out]
     end
     if retval != 200
@@ -958,40 +971,52 @@ already been added to pcsd.  You may not add two clusters with the same name int
 
     return [200, "Node added successfully."]
   end
 
   post '/managec/:cluster/?*' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     raw_data = request.env["rack.input"].read
     if params[:cluster]
       request = "/" + params[:splat].join("/")
       code, out = send_cluster_request_with_token(
-        session, params[:cluster], request, true, params, true, raw_data
+        auth_user, params[:cluster], request, true, params, true, raw_data
       )
 
       # backward compatibility layer BEGIN
       # This code correctly remove constraints on pcs/pcsd version 0.9.137 and older
       redirection = {
           "/remove_constraint_remote" => "/resource_cmd/rm_constraint",
           "/remove_constraint_rule_remote" => "/resource_cmd/rm_constraint_rule"
       }
       if code == 404 and redirection.key?(request)
         code, out = send_cluster_request_with_token(
-          session, params[:cluster], redirection[request], true, params, false,
+          auth_user,
+          params[:cluster],
+          redirection[request],
+          true,
+          params,
+          false,
           raw_data
         )
       end
       # bcl END
       return code, out
     end
   end
 
   get '/managec/:cluster/?*' do
+    auth_user = PCSAuth.sessionToAuthUser(session)
     raw_data = request.env["rack.input"].read
     if params[:cluster]
       send_cluster_request_with_token(
-        session, params[:cluster], "/" + params[:splat].join("/"), false, params,
-        true, raw_data
+        auth_user,
+        params[:cluster],
+        "/" + params[:splat].join("/"),
+        false,
+        params,
+        true,
+        raw_data
       )
     end
   end
 
   get '/' do
diff --git a/pcsd/remote.rb b/pcsd/remote.rb
index 03675001..abf2683b 100644
--- a/pcsd/remote.rb
+++ b/pcsd/remote.rb
@@ -12,11 +12,11 @@ require 'cfgsync.rb'
 require 'cluster_entity.rb'
 require 'permissions.rb'
 require 'auth.rb'
 
 # Commands for remote access
-def remote(params, request, session)
+def remote(params, request, auth_user)
   remote_cmd_without_pacemaker = {
       :status => method(:node_status),
       :status_all => method(:status_all),
       :cluster_status => method(:cluster_status_remote),
       :auth => method(:auth),
@@ -46,15 +46,15 @@ def remote(params, request, session)
       :cluster_enable => method(:cluster_enable),
       :cluster_disable => method(:cluster_disable),
       :resource_status => method(:resource_status),
       :get_sw_versions => method(:get_sw_versions),
       :node_available => method(:remote_node_available),
-      :add_node_all => lambda { |params_, request_, session_|
-        remote_add_node(params_, request_, session_, true)
+      :add_node_all => lambda { |params_, request_, auth_user_|
+        remote_add_node(params_, request_, auth_user_, true)
       },
-      :add_node => lambda { |params_, request_, session_|
-        remote_add_node(params_, request_, session_, false)
+      :add_node => lambda { |params_, request_, auth_user_|
+        remote_add_node(params_, request_, auth_user_, false)
       },
       :remove_nodes => method(:remote_remove_nodes),
       :remove_node => method(:remote_remove_node),
       :cluster_destroy => method(:cluster_destroy),
       :get_wizard => method(:get_wizard),
@@ -101,26 +101,28 @@ def remote(params, request, session)
   }
 
   command = params[:command].to_sym
 
   if remote_cmd_without_pacemaker.include? command
-    return remote_cmd_without_pacemaker[command].call(params, request, session)
+    return remote_cmd_without_pacemaker[command].call(
+      params, request, auth_user
+    )
   elsif remote_cmd_with_pacemaker.include? command
     if pacemaker_running?
-      return remote_cmd_with_pacemaker[command].call(params, request, session)
+      return remote_cmd_with_pacemaker[command].call(params, request, auth_user)
     else
       return [200,'{"pacemaker_not_running":true}']
     end
   else
     return [404, "Unknown Request"]
   end
 end
 
 # provides remote cluster status to a local gui
-def cluster_status_gui(session, cluster_name, dont_update_config=false)
+def cluster_status_gui(auth_user, cluster_name, dont_update_config=false)
   cluster_nodes = get_cluster_nodes(cluster_name)
-  status = cluster_status_from_nodes(session, cluster_nodes, cluster_name)
+  status = cluster_status_from_nodes(auth_user, cluster_nodes, cluster_name)
   unless status
     return 403, 'Permission denied'
   end
 
   new_cluster_nodes = []
@@ -140,19 +142,19 @@ def cluster_status_gui(session, cluster_name, dont_update_config=false)
       # on version conflict just go on, config will be corrected eventually
       # by displaying the cluster in the web UI
       Cfgsync::save_sync_new_version(
           sync_config, get_corosync_nodes(), $cluster_name, true
       )
-      return cluster_status_gui(session, cluster_name, true)
+      return cluster_status_gui(auth_user, cluster_name, true)
     end
   end
   return JSON.generate(status)
 end
 
 # get cluster status and return it to a remote gui or other client
-def cluster_status_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def cluster_status_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
 
   cluster_name = $cluster_name
   # If node is not in a cluster, return empty data
@@ -168,43 +170,43 @@ def cluster_status_remote(params, request, session)
     }
     return JSON.generate(overview)
   end
 
   cluster_nodes = get_nodes().flatten
-  status = cluster_status_from_nodes(session, cluster_nodes, cluster_name)
+  status = cluster_status_from_nodes(auth_user, cluster_nodes, cluster_name)
   unless status
     return 403, 'Permission denied'
   end
   return JSON.generate(status)
 end
 
-def cluster_start(params, request, session)
+def cluster_start(params, request, auth_user)
   if params[:name]
     code, response = send_request_with_token(
-      session, params[:name], 'cluster_start', true
+      auth_user, params[:name], 'cluster_start', true
     )
   else
-    if not allowed_for_local_cluster(session, Permissions::WRITE)
+    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
       return 403, 'Permission denied'
     end
     $logger.info "Starting Daemons"
     output =  `#{PCS} cluster start`
     $logger.debug output
     return output
   end
 end
 
-def cluster_stop(params, request, session)
+def cluster_stop(params, request, auth_user)
   if params[:name]
     params_without_name = params.reject {|key, value|
       key == "name" or key == :name
     }
     code, response = send_request_with_token(
-      session, params[:name], 'cluster_stop', true, params_without_name
+      auth_user, params[:name], 'cluster_stop', true, params_without_name
     )
   else
-    if not allowed_for_local_cluster(session, Permissions::WRITE)
+    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
       return 403, 'Permission denied'
     end
     options = []
     if params.has_key?("component")
       if params["component"].downcase == "pacemaker"
@@ -213,47 +215,49 @@ def cluster_stop(params, request, session)
         options << "--corosync"
       end
     end
     options << "--force" if params["force"]
     $logger.info "Stopping Daemons"
-    stdout, stderr, retval = run_cmd(session, PCS, "cluster", "stop", *options)
+    stdout, stderr, retval = run_cmd(
+      auth_user, PCS, "cluster", "stop", *options
+    )
     if retval != 0
       return [400, stderr.join]
     else
       return stdout.join
     end
   end
 end
 
-def config_backup(params, request, session)
+def config_backup(params, request, auth_user)
   if params[:name]
     code, response = send_request_with_token(
-      session, params[:name], 'config_backup', true
+      auth_user, params[:name], 'config_backup', true
     )
   else
-    if not allowed_for_local_cluster(session, Permissions::FULL)
+    if not allowed_for_local_cluster(auth_user, Permissions::FULL)
       return 403, 'Permission denied'
     end
     $logger.info "Backup node configuration"
-    stdout, stderr, retval = run_cmd(session, PCS, "config", "backup")
+    stdout, stderr, retval = run_cmd(auth_user, PCS, "config", "backup")
     if retval == 0
         $logger.info "Backup successful"
         return [200, stdout]
     end
     $logger.info "Error during backup: #{stderr.join(' ').strip()}"
     return [400, "Unable to backup node: #{stderr.join(' ')}"]
   end
 end
 
-def config_restore(params, request, session)
+def config_restore(params, request, auth_user)
   if params[:name]
     code, response = send_request_with_token(
-      session, params[:name], 'config_restore', true,
+      auth_user, params[:name], 'config_restore', true,
       {:tarball => params[:tarball]}
     )
   else
-    if not allowed_for_local_cluster(session, Permissions::FULL)
+    if not allowed_for_local_cluster(auth_user, Permissions::FULL)
       return 403, 'Permission denied'
     end
     $logger.info "Restore node configuration"
     if params[:tarball] != nil and params[:tarball] != ""
       out = ""
@@ -277,102 +281,102 @@ def config_restore(params, request, session)
       return "Error: Invalid tarball"
     end
   end
 end
 
-def node_restart(params, request, session)
+def node_restart(params, request, auth_user)
   if params[:name]
     code, response = send_request_with_token(
-      session, params[:name], 'node_restart', true
+      auth_user, params[:name], 'node_restart', true
     )
   else
-    if not allowed_for_local_cluster(session, Permissions::WRITE)
+    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
       return 403, 'Permission denied'
     end
     $logger.info "Restarting Node"
     output =  `/sbin/reboot`
     $logger.debug output
     return output
   end
 end
 
-def node_standby(params, request, session)
+def node_standby(params, request, auth_user)
   if params[:name]
     code, response = send_request_with_token(
-      session, params[:name], 'node_standby', true, {"node"=>params[:name]}
+      auth_user, params[:name], 'node_standby', true, {"node"=>params[:name]}
     )
     # data={"node"=>params[:name]} for backward compatibility with older versions of pcs/pcsd
   else
-    if not allowed_for_local_cluster(session, Permissions::WRITE)
+    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
       return 403, 'Permission denied'
     end
     $logger.info "Standby Node"
-    stdout, stderr, retval = run_cmd(session, PCS, "cluster", "standby")
+    stdout, stderr, retval = run_cmd(auth_user, PCS, "cluster", "standby")
     return stdout
   end
 end
 
-def node_unstandby(params, request, session)
+def node_unstandby(params, request, auth_user)
   if params[:name]
     code, response = send_request_with_token(
-      session, params[:name], 'node_unstandby', true, {"node"=>params[:name]}
+      auth_user, params[:name], 'node_unstandby', true, {"node"=>params[:name]}
     )
     # data={"node"=>params[:name]} for backward compatibility with older versions of pcs/pcsd
   else
-    if not allowed_for_local_cluster(session, Permissions::WRITE)
+    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
       return 403, 'Permission denied'
     end
     $logger.info "Unstandby Node"
-    stdout, stderr, retval = run_cmd(session, PCS, "cluster", "unstandby")
+    stdout, stderr, retval = run_cmd(auth_user, PCS, "cluster", "unstandby")
     return stdout
   end
 end
 
-def cluster_enable(params, request, session)
+def cluster_enable(params, request, auth_user)
   if params[:name]
     code, response = send_request_with_token(
-      session, params[:name], 'cluster_enable', true
+      auth_user, params[:name], 'cluster_enable', true
     )
   else
-    if not allowed_for_local_cluster(session, Permissions::WRITE)
+    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
       return 403, 'Permission denied'
     end
-    success = enable_cluster(session)
+    success = enable_cluster(auth_user)
     if not success
       return JSON.generate({"error" => "true"})
     end
     return "Cluster Enabled"
   end
 end
 
-def cluster_disable(params, request, session)
+def cluster_disable(params, request, auth_user)
   if params[:name]
     code, response = send_request_with_token(
-      session, params[:name], 'cluster_disable', true
+      auth_user, params[:name], 'cluster_disable', true
     )
   else
-    if not allowed_for_local_cluster(session, Permissions::WRITE)
+    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
       return 403, 'Permission denied'
     end
-    success = disable_cluster(session)
+    success = disable_cluster(auth_user)
     if not success
       return JSON.generate({"error" => "true"})
     end
     return "Cluster Disabled"
   end
 end
 
-def get_quorum_info(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def get_quorum_info(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
   if ISRHEL6
     stdout_status, stderr_status, retval = run_cmd(
-      PCSAuth.getSuperuserSession, CMAN_TOOL, "status"
+      PCSAuth.getSuperuserAuth(), CMAN_TOOL, "status"
     )
     stdout_nodes, stderr_nodes, retval = run_cmd(
-      PCSAuth.getSuperuserSession,
+      PCSAuth.getSuperuserAuth(),
       CMAN_TOOL, "nodes", "-F", "id,type,votes,name"
     )
     if stderr_status.length > 0
       return stderr_status.join
     elsif stderr_nodes.length > 0
@@ -380,11 +384,11 @@ def get_quorum_info(params, request, session)
     else
       return stdout_status.join + "\n---Votes---\n" + stdout_nodes.join
     end
   else
     stdout, stderr, retval = run_cmd(
-      PCSAuth.getSuperuserSession, COROSYNC_QUORUMTOOL, "-p", "-s"
+      PCSAuth.getSuperuserAuth(), COROSYNC_QUORUMTOOL, "-p", "-s"
     )
     # retval is 0 on success if node is not in partition with quorum
     # retval is 1 on error OR on success if node has quorum
     if stderr.length > 0
       return stderr.join
@@ -392,34 +396,34 @@ def get_quorum_info(params, request, session)
       return stdout.join
     end
   end
 end
 
-def get_cib(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def get_cib(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
-  cib, stderr, retval = run_cmd(session, CIBADMIN, "-Ql")
+  cib, stderr, retval = run_cmd(auth_user, CIBADMIN, "-Ql")
   if retval != 0
     if not pacemaker_running?
       return [400, '{"pacemaker_not_running":true}']
     end
     return [500, "Unable to get CIB: " + cib.to_s + stderr.to_s]
   else
     return [200, cib]
   end
 end
 
-def get_corosync_conf_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def get_corosync_conf_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
   return get_corosync_conf()
 end
 
-def set_cluster_conf(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def set_cluster_conf(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
   if params[:cluster_conf] != nil and params[:cluster_conf].strip != ""
     Cfgsync::ClusterConf.backup()
     Cfgsync::ClusterConf.from_text(params[:cluster_conf]).save()
@@ -428,12 +432,12 @@ def set_cluster_conf(params, request, session)
     $logger.info "Invalid cluster.conf file"
     return 400, 'Failed to update cluster.conf...'
   end
 end
 
-def set_corosync_conf(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def set_corosync_conf(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
   if params[:corosync_conf] != nil and params[:corosync_conf].strip != ""
     Cfgsync::CorosyncConf.backup()
     Cfgsync::CorosyncConf.from_text(params[:corosync_conf]).save()
@@ -442,18 +446,18 @@ def set_corosync_conf(params, request, session)
     $logger.info "Invalid corosync.conf file"
     return 400, "Failed"
   end
 end
 
-def get_sync_capabilities(params, request, session)
+def get_sync_capabilities(params, request, auth_user)
   return JSON.generate({
     'syncable_configs' => Cfgsync::get_cfg_classes_by_name().keys,
   })
 end
 
-def set_sync_options(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def set_sync_options(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
 
   options = [
     'sync_thread_pause', 'sync_thread_resume',
@@ -498,12 +502,12 @@ def set_sync_options(params, request, session)
   end
 
   return [400, 'Exactly one option has to be specified']
 end
 
-def get_configs(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def get_configs(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
   if not $cluster_name or $cluster_name.empty?
     return JSON.generate({'status' => 'not_in_cluster'})
   end
@@ -522,12 +526,12 @@ def get_configs(params, request, session)
     }
   }
   return JSON.generate(out)
 end
 
-def set_configs(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def set_configs(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
   return JSON.generate({'status' => 'bad_json'}) if not params['configs']
   begin
     configs_json = JSON.parse(params['configs'])
@@ -569,12 +573,12 @@ def set_configs(params, request, session)
     }
     return JSON.generate({'status' => 'ok', 'result' => result})
   }
 end
 
-def set_certs(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def set_certs(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
 
   ssl_cert = (params['ssl_cert'] || '').strip
   ssl_key = (params['ssl_key'] || '').strip
@@ -613,12 +617,12 @@ def set_certs(params, request, session)
   end
 
   return [200, 'success']
 end
 
-def get_permissions_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::GRANT)
+def get_permissions_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
     return 403, 'Permission denied'
   end
 
   pcs_config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
   data = {
@@ -628,12 +632,12 @@ def get_permissions_remote(params, request, session)
     'users_permissions' => pcs_config.permissions_local.to_hash(),
   }
   return [200, JSON.generate(data)]
 end
 
-def set_permissions_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::GRANT)
+def set_permissions_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
     return 403, 'Permission denied'
   end
 
   begin
     data = JSON.parse(params['json_data'])
@@ -699,11 +703,11 @@ def set_permissions_remote(params, request, session)
       if Permissions::FULL == perm_type['code']
         label = perm_type['label']
         break
       end
     }
-    if not allowed_for_local_cluster(session, Permissions::FULL)
+    if not allowed_for_local_cluster(auth_user, Permissions::FULL)
       return [
         403,
         "Permission denied\nOnly #{SUPERUSER} and users with #{label} "\
           + "permission can grant or revoke #{label} permission."
       ]
@@ -720,35 +724,35 @@ def set_permissions_remote(params, request, session)
     return [200, 'Permissions saved'] if pushed
   }
   return 400, 'Unable to save permissions'
 end
 
-def remote_pcsd_restart(params, request, session)
+def remote_pcsd_restart(params, request, auth_user)
   pcsd_restart()
   return [200, 'success']
 end
 
-def get_sw_versions(params, request, session)
+def get_sw_versions(params, request, auth_user)
   versions = {
     "rhel" => get_rhel_version(),
     "pcs" => get_pcsd_version(),
     "pacemaker" => get_pacemaker_version(),
     "corosync" => get_corosync_version(),
     "cman" => get_cman_version(),
   }
   return JSON.generate(versions)
 end
 
-def remote_node_available(params, request, session)
+def remote_node_available(params, request, auth_user)
   if (not ISRHEL6 and File.exist?(Cfgsync::CorosyncConf.file_path)) or (ISRHEL6 and File.exist?(Cfgsync::ClusterConf.file_path)) or File.exist?("/var/lib/pacemaker/cib/cib.xml")
     return JSON.generate({:node_available => false})
   end
   return JSON.generate({:node_available => true})
 end
 
-def remote_add_node(params, request, session, all=false)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def remote_add_node(params, request, auth_user, all=false)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
   auto_start = false
   if params[:auto_start] and params[:auto_start] == "1"
     auto_start = true
@@ -757,22 +761,22 @@ def remote_add_node(params, request, session, all=false)
   if params[:new_nodename] != nil
     node = params[:new_nodename]
     if params[:new_ring1addr] != nil
       node += ',' + params[:new_ring1addr]
     end
-    retval, output = add_node(session, node, all, auto_start)
+    retval, output = add_node(auth_user, node, all, auto_start)
   end
 
   if retval == 0
     return [200, JSON.generate([retval, get_corosync_conf()])]
   end
 
   return [400,output]
 end
 
-def remote_remove_nodes(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def remote_remove_nodes(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
   count = 0
   out = ""
   node_list = []
@@ -791,33 +795,33 @@ def remote_remove_nodes(params, request, session)
   # stop the nodes at once in order to:
   # - prevent resources from moving pointlessly
   # - get possible quorum loss warning
   stop_params = node_list + options
   stdout, stderr, retval = run_cmd(
-    session, PCS, "cluster", "stop", *stop_params
+    auth_user, PCS, "cluster", "stop", *stop_params
   )
   if retval != 0
     return [400, stderr.join]
   end
 
   node_list.each {|node|
-    retval, output = remove_node(session, node, true)
+    retval, output = remove_node(auth_user, node, true)
     out = out + output.join("\n")
   }
   config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
   if config.get_nodes($cluster_name) == nil or config.get_nodes($cluster_name).length == 0
     return [200,"No More Nodes"]
   end
   return out
 end
 
-def remote_remove_node(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def remote_remove_node(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
   if params[:remove_nodename] != nil
-    retval, output = remove_node(session, params[:remove_nodename])
+    retval, output = remove_node(auth_user, params[:remove_nodename])
   else
     return 400, "No nodename specified"
   end
 
   if retval == 0
@@ -825,12 +829,12 @@ def remote_remove_node(params, request, session)
   end
 
   return JSON.generate([retval,output])
 end
 
-def setup_cluster(params, request, session)
-  if not allowed_for_superuser(session)
+def setup_cluster(params, request, auth_user)
+  if not allowed_for_superuser(auth_user)
     return 403, 'Permission denied'
   end
   $logger.info("Setting up cluster: " + params.inspect)
   nodes_rrp = params[:nodes].split(';')
   options = []
@@ -875,11 +879,11 @@ def setup_cluster(params, request, session)
     nodes = nodes_rrp
   end
   nodes_options = nodes + options
   nodes_options += options_udp if transport_udp
   stdout, stderr, retval = run_cmd(
-    session, PCS, "cluster", "setup", "--enable", "--start",
+    auth_user, PCS, "cluster", "setup", "--enable", "--start",
     "--name", params[:clustername], *nodes_options
   )
   if retval != 0
     return [
       400,
@@ -887,53 +891,53 @@ def setup_cluster(params, request, session)
     ]
   end
   return 200
 end
 
-def create_cluster(params, request, session)
-  if not allowed_for_superuser(session)
+def create_cluster(params, request, auth_user)
+  if not allowed_for_superuser(auth_user)
     return 403, 'Permission denied'
   end
-  if set_corosync_conf(params, request, session)
-    cluster_start(params, request, session)
+  if set_corosync_conf(params, request, auth_user)
+    cluster_start(params, request, auth_user)
   else
     return "Failed"
   end
 end
 
-def node_status(params, request, session)
+def node_status(params, request, auth_user)
   if params[:node] and params[:node] != '' and params[:node] !=
     $cur_node_name and !params[:redirected]
     return send_request_with_token(
-      session,
+      auth_user,
       params[:node],
       'status?redirected=1',
       false,
       params.select { |k,_|
         [:version, :operations].include?(k)
       }
     )
   end
 
-  if not allowed_for_local_cluster(session, Permissions::READ)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
 
-  cib_dom = get_cib_dom(session)
-  crm_dom = get_crm_mon_dom(session)
+  cib_dom = get_cib_dom(auth_user)
+  crm_dom = get_crm_mon_dom(auth_user)
 
-  status = get_node_status(session, cib_dom)
+  status = get_node_status(auth_user, cib_dom)
   resources = get_resources(
     cib_dom,
     crm_dom,
     (params[:operations] and params[:operations] == '1')
   )
 
-  node = ClusterEntity::Node.load_current_node(session, crm_dom)
+  node = ClusterEntity::Node.load_current_node(crm_dom)
 
   _,_,not_authorized_nodes = check_gui_status_of_nodes(
-    session,
+    auth_user,
     status[:known_nodes],
     false,
     3
   )
 
@@ -1011,21 +1015,21 @@ def node_status(params, request, session)
   }
 
   return JSON.generate(old_status)
 end
 
-def status_all(params, request, session, nodes=[], dont_update_config=false)
+def status_all(params, request, auth_user, nodes=[], dont_update_config=false)
   if nodes == nil
     return JSON.generate({"error" => "true"})
   end
 
   final_response = {}
   threads = []
   forbidden_nodes = {}
   nodes.each {|node|
     threads << Thread.new {
-      code, response = send_request_with_token(session, node, 'status')
+      code, response = send_request_with_token(auth_user, node, 'status')
       if 403 == code
         forbidden_nodes[node] = true
       end
       begin
         final_response[node] = JSON.parse(response)
@@ -1063,18 +1067,18 @@ def status_all(params, request, session, nodes=[], dont_update_config=false)
       # on version conflict just go on, config will be corrected eventually
       # by displaying the cluster in the web UI
       Cfgsync::save_sync_new_version(
         sync_config, get_corosync_nodes(), $cluster_name, true
       )
-      return status_all(params, request, session, node_list, true)
+      return status_all(params, request, auth_user, node_list, true)
     end
   end
   $logger.debug("NODE LIST: " + node_list.inspect)
   return JSON.generate(final_response)
 end
 
-def clusters_overview(params, request, session)
+def clusters_overview(params, request, auth_user)
   cluster_map = {}
   forbidden_clusters = {}
   threads = []
   config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
   config.clusters.each { |cluster|
@@ -1089,11 +1093,11 @@ def clusters_overview(params, request, session)
         'node_list' => get_default_overview_node_list(cluster.name),
         'resource_list' => []
       }
       overview_cluster = nil
       online, offline, not_authorized_nodes = check_gui_status_of_nodes(
-        session,
+        auth_user,
         get_cluster_nodes(cluster.name),
         false,
         3
       )
       not_supported = false
@@ -1101,11 +1105,11 @@ def clusters_overview(params, request, session)
       cluster_nodes_auth = (online + offline).uniq
       cluster_nodes_all = (cluster_nodes_auth + not_authorized_nodes).uniq
       nodes_not_in_cluster = []
       for node in cluster_nodes_auth
         code, response = send_request_with_token(
-          session, node, 'cluster_status', true, {}, true, nil, 8
+          auth_user, node, 'cluster_status', true, {}, true, nil, 8
         )
         if code == 404
           not_supported = true
           next
         end
@@ -1237,11 +1241,11 @@ def clusters_overview(params, request, session)
     }
   }
   return JSON.generate(overview)
 end
 
-def auth(params, request, session)
+def auth(params, request, auth_user)
   token = PCSAuth.validUser(params['username'],params['password'], true)
   # If we authorized to this machine, attempt to authorize everywhere
   node_list = []
   if token and params["bidirectional"]
     params.each { |k,v|
@@ -1249,36 +1253,36 @@ def auth(params, request, session)
         node_list.push(v)
       end
     }
     if node_list.length > 0
       pcs_auth(
-        session, node_list, params['username'], params['password'],
+        auth_user, node_list, params['username'], params['password'],
         params["force"] == "1"
       )
     end
   end
   return token
 end
 
 # If we get here, we're already authorized
-def check_auth(params, request, session)
+def check_auth(params, request, auth_user)
   if params.include?("check_auth_only")
     return [200, "{\"success\":true}"]
   end
   return JSON.generate({
     'success' => true,
     'node_list' => get_token_node_list,
   })
 end
 
 # not used anymore, left here for backward compatability reasons
-def resource_status(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def resource_status(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
   resource_id = params[:resource]
-  @resources,@groups = getResourcesGroups(session)
+  @resources,@groups = getResourcesGroups(auth_user)
   location = ""
   res_status = ""
   @resources.each {|r|
     if r.id == resource_id
       if r.failed
@@ -1296,73 +1300,73 @@ def resource_status(params, request, session)
   }
   status = {"location" => location, "status" => res_status}
   return JSON.generate(status)
 end
 
-def resource_stop(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def resource_stop(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   stdout, stderr, retval = run_cmd(
-    session, PCS, "resource", "disable", params[:resource]
+    auth_user, PCS, "resource", "disable", params[:resource]
   )
   if retval == 0
     return JSON.generate({"success" => "true"})
   else
     return JSON.generate({"error" => "true", "stdout" => stdout, "stderror" => stderr})
   end
 end
 
-def resource_cleanup(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def resource_cleanup(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   stdout, stderr, retval = run_cmd(
-    session, PCS, "resource", "cleanup", params[:resource]
+    auth_user, PCS, "resource", "cleanup", params[:resource]
   )
   if retval == 0
     return JSON.generate({"success" => "true"})
   else
     return JSON.generate({"error" => "true", "stdout" => stdout, "stderror" => stderr})
   end
 end
 
-def resource_start(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def resource_start(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   stdout, stderr, retval = run_cmd(
-    session, PCS, "resource", "enable", params[:resource]
+    auth_user, PCS, "resource", "enable", params[:resource]
   )
   if retval == 0
     return JSON.generate({"success" => "true"})
   else
     return JSON.generate({"error" => "true", "stdout" => stdout, "stderror" => stderr})
   end
 end
 
-def resource_form(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def resource_form(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
 
-  cib_dom = get_cib_dom(session)
+  cib_dom = get_cib_dom(auth_user)
   @cur_resource = get_resource_by_id(params[:resource], cib_dom)
   @groups = get_resource_groups(cib_dom)
   @version = params[:version]
 
   if @cur_resource.instance_of?(ClusterEntity::Primitive) and !@cur_resource.stonith
     @cur_resource_group = @cur_resource.get_group
     @cur_resource_clone = @cur_resource.get_clone
     @cur_resource_ms = @cur_resource.get_master
     @resource = ResourceAgent.new(@cur_resource.agentname)
     if @cur_resource.provider == 'heartbeat'
-      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, HEARTBEAT_AGENTS_DIR + @cur_resource.type)
+      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, HEARTBEAT_AGENTS_DIR + @cur_resource.type)
     elsif @cur_resource.provider == 'pacemaker'
-      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, PACEMAKER_AGENTS_DIR + @cur_resource.type)
+      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, PACEMAKER_AGENTS_DIR + @cur_resource.type)
     elsif @cur_resource._class == 'nagios'
-      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, NAGIOS_METADATA_DIR + @cur_resource.type + '.xml')
+      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, NAGIOS_METADATA_DIR + @cur_resource.type + '.xml')
     end
     @existing_resource = true
     if @resource
       erb :resourceagentform
     else
@@ -1371,57 +1375,57 @@ def resource_form(params, request, session)
   else
     "Resource #{params[:resource]} doesn't exist"
   end
 end
 
-def fence_device_form(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def fence_device_form(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
 
-  @cur_resource = get_resource_by_id(params[:resource], get_cib_dom(session))
+  @cur_resource = get_resource_by_id(params[:resource], get_cib_dom(auth_user))
 
   if @cur_resource.instance_of?(ClusterEntity::Primitive) and @cur_resource.stonith
-    @resource_agents = getFenceAgents(session, @cur_resource.agentname)
+    @resource_agents = getFenceAgents(auth_user, @cur_resource.agentname)
     @existing_resource = true
     @fenceagent = @resource_agents[@cur_resource.type]
     erb :fenceagentform
   else
     "Can't find fence device"
   end
 end
 
 # Creates resource if params[:resource_id] is not set
-def update_resource (params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def update_resource (params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
 
   param_line = getParamList(params)
   if not params[:resource_id]
     out, stderr, retval = run_cmd(
-      session,
+      auth_user,
       PCS, "resource", "create", params[:name], params[:resource_type],
       *param_line
     )
     if retval != 0
       return JSON.generate({"error" => "true", "stderr" => stderr, "stdout" => out})
     end
     if params[:resource_group] and params[:resource_group] != ""
       run_cmd(
-        session,
+        auth_user,
         PCS, "resource","group", "add", params[:resource_group], params[:name]
       )
       resource_group = params[:resource_group]
     end
 
     if params[:resource_clone] and params[:resource_clone] != ""
       name = resource_group ? resource_group : params[:name]
-      run_cmd(session, PCS, "resource", "clone", name)
+      run_cmd(auth_user, PCS, "resource", "clone", name)
     elsif params[:resource_ms] and params[:resource_ms] != ""
       name = resource_group ? resource_group : params[:name]
-      run_cmd(session, PCS, "resource", "master", name)
+      run_cmd(auth_user, PCS, "resource", "master", name)
     end
 
     return JSON.generate({})
   end
 
@@ -1429,64 +1433,64 @@ def update_resource (params, request, session)
     # If it's a clone resource we strip off everything after the last ':'
     if params[:resource_clone]
       params[:resource_id].sub!(/(.*):.*/,'\1')
     end
     run_cmd(
-      session, PCS, "resource", "update", params[:resource_id], *param_line
+      auth_user, PCS, "resource", "update", params[:resource_id], *param_line
     )
   end
 
   if params[:resource_group]
     if params[:resource_group] == ""
       if params[:_orig_resource_group] != ""
         run_cmd(
-          session, PCS, "resource", "group", "remove",
+          auth_user, PCS, "resource", "group", "remove",
           params[:_orig_resource_group], params[:resource_id]
         )
       end
     else
       run_cmd(
-        session, PCS, "resource", "group", "add", params[:resource_group],
+        auth_user, PCS, "resource", "group", "add", params[:resource_group],
         params[:resource_id]
       )
     end
   end
 
   if params[:resource_clone] and params[:_orig_resource_clone] == "false"
-    run_cmd(session, PCS, "resource", "clone", params[:resource_id])
+    run_cmd(auth_user, PCS, "resource", "clone", params[:resource_id])
   end
   if params[:resource_ms] and params[:_orig_resource_ms] == "false"
-    run_cmd(session, PCS, "resource", "master", params[:resource_id])
+    run_cmd(auth_user, PCS, "resource", "master", params[:resource_id])
   end
 
   if params[:_orig_resource_clone] == "true" and not params[:resource_clone]
     run_cmd(
-      session, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
+      auth_user, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
     )
   end
   if params[:_orig_resource_ms] == "true" and not params[:resource_ms]
     run_cmd(
-      session, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
+      auth_user, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
     )
   end
 
   return JSON.generate({})
 end
 
-def update_fence_device(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def update_fence_device(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
 
   $logger.info "Updating fence device"
   $logger.info params
   param_line = getParamList(params)
   $logger.info param_line
 
   if not params[:resource_id]
     out, stderr, retval = run_cmd(
-      session,
+      auth_user,
       PCS, "stonith", "create", params[:name], params[:resource_type],
       *param_line
     )
     if retval != 0
       return JSON.generate({"error" => "true", "stderr" => stderr, "stdout" => out})
@@ -1494,82 +1498,82 @@ def update_fence_device(params, request, session)
     return "{}"
   end
 
   if param_line.length != 0
     out, stderr, retval = run_cmd(
-      session, PCS, "stonith", "update", params[:resource_id], *param_line
+      auth_user, PCS, "stonith", "update", params[:resource_id], *param_line
     )
     if retval != 0
       return JSON.generate({"error" => "true", "stderr" => stderr, "stdout" => out})
     end
   end
   return "{}"
 end
 
-def get_avail_resource_agents(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def get_avail_resource_agents(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
-  agents = getResourceAgents(session)
+  agents = getResourceAgents(auth_user)
   return JSON.generate(agents)
 end
 
-def get_avail_fence_agents(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def get_avail_fence_agents(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
-  agents = getFenceAgents(session)
+  agents = getFenceAgents(auth_user)
   return JSON.generate(agents)
 end
 
-def resource_metadata(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def resource_metadata(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
   return 200 if not params[:resourcename] or params[:resourcename] == ""
   resource_name = params[:resourcename][params[:resourcename].rindex(':')+1..-1]
   class_provider = params[:resourcename][0,params[:resourcename].rindex(':')]
 
   @resource = ResourceAgent.new(params[:resourcename])
   if class_provider == "ocf:heartbeat"
-    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, HEARTBEAT_AGENTS_DIR + resource_name)
+    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, HEARTBEAT_AGENTS_DIR + resource_name)
   elsif class_provider == "ocf:pacemaker"
-    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, PACEMAKER_AGENTS_DIR + resource_name)
+    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, PACEMAKER_AGENTS_DIR + resource_name)
   elsif class_provider == 'nagios'
-    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, NAGIOS_METADATA_DIR + resource_name + '.xml')
+    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, NAGIOS_METADATA_DIR + resource_name + '.xml')
   end
   @new_resource = params[:new]
-  @resources, @groups = getResourcesGroups(session)
+  @resources, @groups = getResourcesGroups(auth_user)
 
   erb :resourceagentform
 end
 
-def fence_device_metadata(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def fence_device_metadata(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
   return 200 if not params[:resourcename] or params[:resourcename] == ""
   @fenceagent = FenceAgent.new(params[:resourcename])
-  @fenceagent.required_options, @fenceagent.optional_options, @fenceagent.advanced_options, @fenceagent.info = getFenceAgentMetadata(session, params[:resourcename])
+  @fenceagent.required_options, @fenceagent.optional_options, @fenceagent.advanced_options, @fenceagent.info = getFenceAgentMetadata(auth_user, params[:resourcename])
   @new_fenceagent = params[:new]
   
   erb :fenceagentform
 end
 
-def remove_resource(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def remove_resource(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   force = params['force']
   no_error_if_not_exists = params.include?('no_error_if_not_exists')
   errors = ""
   params.each { |k,v|
     if k.index("resid-") == 0
       resid = k.gsub('resid-', '')
       command = [PCS, 'resource', 'delete', resid]
       command << '--force' if force
-      out, errout, retval = run_cmd(session, *command)
+      out, errout, retval = run_cmd(auth_user, *command)
       if retval != 0
         unless out.index(" does not exist.") != -1 and no_error_if_not_exists  
           errors += errout.join(' ').strip + "\n"
         end
       end
@@ -1582,63 +1586,63 @@ def remove_resource(params, request, session)
     $logger.info("Remove resource errors:\n"+errors)
     return [400, errors]
   end
 end
 
-def add_fence_level_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def add_fence_level_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   retval, stdout, stderr = add_fence_level(
-    session, params["level"], params["devices"], params["node"], params["remove"]
+    auth_user, params["level"], params["devices"], params["node"], params["remove"]
   )
   if retval == 0
     return [200, "Successfully added fence level"]
   else
     return [400, stderr]
   end
 end
 
-def add_node_attr_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def add_node_attr_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   retval = add_node_attr(
-    session, params["node"], params["key"], params["value"]
+    auth_user, params["node"], params["key"], params["value"]
   )
   # retval = 2 if removing attr which doesn't exist
   if retval == 0 or retval == 2
     return [200, "Successfully added attribute to node"]
   else
     return [400, "Error adding attribute to node"]
   end
 end
 
-def add_acl_role_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::GRANT)
+def add_acl_role_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
     return 403, 'Permission denied'
   end
-  retval = add_acl_role(session, params["name"], params["description"])
+  retval = add_acl_role(auth_user, params["name"], params["description"])
   if retval == ""
     return [200, "Successfully added ACL role"]
   else
     return [
       400,
       retval.include?("cib_replace failed") ? "Error adding ACL role" : retval
     ]
   end
 end
 
-def remove_acl_roles_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::GRANT)
+def remove_acl_roles_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
     return 403, 'Permission denied'
   end
   errors = ""
   params.each { |name, value|
     if name.index("role-") == 0
       out, errout, retval = run_cmd(
-        session, PCS, "acl", "role", "delete", value.to_s, "--autodelete"
+        auth_user, PCS, "acl", "role", "delete", value.to_s, "--autodelete"
       )
       if retval != 0
         errors += "Unable to remove role #{value}"
         unless errout.include?("cib_replace failure")
           errors += ": #{errout.join(" ").strip()}"
@@ -1653,22 +1657,22 @@ def remove_acl_roles_remote(params, request, session)
   else
     return [400, errors]
   end
 end
 
-def add_acl_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::GRANT)
+def add_acl_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
     return 403, 'Permission denied'
   end
   if params["item"] == "permission"
     retval = add_acl_permission(
-      session,
+      auth_user,
       params["role_id"], params["type"], params["xpath_id"], params["query_id"]
     )
   elsif (params["item"] == "user") or (params["item"] == "group")
     retval = add_acl_usergroup(
-      session, params["role_id"], params["item"], params["usergroup"]
+      auth_user, params["role_id"], params["item"], params["usergroup"]
     )
   else
     retval = "Error: Unknown adding request"
   end
 
@@ -1680,19 +1684,19 @@ def add_acl_remote(params, request, session)
       retval.include?("cib_replace failed") ? "Error adding permission" : retval
     ]
   end
 end
 
-def remove_acl_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::GRANT)
+def remove_acl_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
     return 403, 'Permission denied'
   end
   if params["item"] == "permission"
-    retval = remove_acl_permission(session, params["acl_perm_id"])
+    retval = remove_acl_permission(auth_user, params["acl_perm_id"])
   elsif params["item"] == "usergroup"
     retval = remove_acl_usergroup(
-      session, params["role_id"],params["usergroup_id"]
+      auth_user, params["role_id"],params["usergroup_id"]
     )
   else
     retval = "Error: Unknown removal request"
   end
 
@@ -1701,32 +1705,32 @@ def remove_acl_remote(params, request, session)
   else
     return [400, retval]
   end
 end
 
-def add_meta_attr_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def add_meta_attr_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   retval = add_meta_attr(
-    session, params["res_id"], params["key"],params["value"]
+    auth_user, params["res_id"], params["key"],params["value"]
   )
   if retval == 0
     return [200, "Successfully added meta attribute"]
   else
     return [400, "Error adding meta attribute"]
   end
 end
 
-def add_constraint_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def add_constraint_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   case params["c_type"]
   when "loc"
     retval, error = add_location_constraint(
-      session,
+      auth_user,
       params["res_id"], params["node_id"], params["score"], params["force"],
       !params['disable_autocorrect']
     )
   when "ord"
     resA = params["res_id"]
@@ -1737,11 +1741,11 @@ def add_constraint_remote(params, request, session)
       resA, resB = resB, resA
       actionA, actionB = actionB, actionA
     end
 
     retval, error = add_order_constraint(
-      session,
+      auth_user,
       resA, resB, actionA, actionB, params["score"], true, params["force"],
       !params['disable_autocorrect']
     )
   when "col"
     resA = params["res_id"]
@@ -1754,11 +1758,11 @@ def add_constraint_remote(params, request, session)
         score = "-INFINITY"
       end
     end
 
     retval, error = add_colocation_constraint(
-      session,
+      auth_user,
       resA, resB, score, params["force"], !params['disable_autocorrect']
     )
   else
     return [400, "Unknown constraint type: #{params['c_type']}"]
   end
@@ -1768,17 +1772,17 @@ def add_constraint_remote(params, request, session)
   else
     return [400, "Error adding constraint: #{error}"]
   end
 end
 
-def add_constraint_rule_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def add_constraint_rule_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   if params["c_type"] == "loc"
     retval, error = add_location_constraint_rule(
-      session,
+      auth_user,
       params["res_id"], params["rule"], params["score"], params["force"],
       !params['disable_autocorrect']
     )
   else
     return [400, "Unknown constraint type: #{params["c_type"]}"]
@@ -1789,18 +1793,18 @@ def add_constraint_rule_remote(params, request, session)
   else
     return [400, "Error adding constraint: #{error}"]
   end
 end
 
-def add_constraint_set_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def add_constraint_set_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   case params["c_type"]
   when "ord"
     retval, error = add_order_set_constraint(
-      session,
+      auth_user,
       params["resources"].values, params["force"], !params['disable_autocorrect']
     )
   else
     return [400, "Unknown constraint type: #{params["c_type"]}"]
   end
@@ -1810,62 +1814,62 @@ def add_constraint_set_remote(params, request, session)
   else
     return [400, "Error adding constraint: #{error}"]
   end
 end
 
-def remove_constraint_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def remove_constraint_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   if params[:constraint_id]
-    retval = remove_constraint(session, params[:constraint_id])
+    retval = remove_constraint(auth_user, params[:constraint_id])
     if retval == 0
       return "Constraint #{params[:constraint_id]} removed"
     else
       return [400, "Error removing constraint: #{params[:constraint_id]}"]
     end
   else
     return [400,"Bad Constraint Options"]
   end
 end
 
-def remove_constraint_rule_remote(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def remove_constraint_rule_remote(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   if params[:rule_id]
-    retval = remove_constraint_rule(session, params[:rule_id])
+    retval = remove_constraint_rule(auth_user, params[:rule_id])
     if retval == 0
       return "Constraint rule #{params[:rule_id]} removed"
     else
       return [400, "Error removing constraint rule: #{params[:rule_id]}"]
     end
   else
     return [400, "Bad Constraint Rule Options"]
   end
 end
 
-def add_group(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def add_group(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   rg = params["resource_group"]
   resources = params["resources"]
   output, errout, retval = run_cmd(
-    session, PCS, "resource", "group", "add", rg, *(resources.split(" "))
+    auth_user, PCS, "resource", "group", "add", rg, *(resources.split(" "))
   )
   if retval == 0
     return 200
   else
     return 400, errout
   end
 end
 
-def update_cluster_settings(params, request, session)
+def update_cluster_settings(params, request, auth_user)
   properties = params['config']
   to_update = []
-  current = getAllSettings(session)
+  current = getAllSettings(auth_user)
 
   # We need to be able to set cluster properties also from older version GUI.
   # This code handles proper processing of checkboxes.
   # === backward compatibility layer start ===
   params['hidden'].each { |prop, val|
@@ -1887,16 +1891,16 @@ def update_cluster_settings(params, request, session)
       to_update << prop
     end
   }
 
   if to_update.count { |x| x.downcase == 'enable-acl' } > 0
-    if not allowed_for_local_cluster(session, Permissions::GRANT)
+    if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
       return 403, 'Permission denied'
     end
   end
   if to_update.count { |x| x.downcase != 'enable-acl' } > 0
-    if not allowed_for_local_cluster(session, Permissions::WRITE)
+    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
       return 403, 'Permission denied'
     end
   end
 
   if to_update.empty?
@@ -1904,44 +1908,46 @@ def update_cluster_settings(params, request, session)
   else
     cmd_args = []
     to_update.each { |prop|
       cmd_args << "#{prop.downcase}=#{properties[prop]}"
     }
-    stdout, stderr, retval = run_cmd(session, PCS, 'property', 'set', *cmd_args)
+    stdout, stderr, retval = run_cmd(
+      auth_user, PCS, 'property', 'set', *cmd_args
+    )
     if retval != 0
       return [400, stderr.join('').gsub(', (use --force to override)', '')]
     end
   end
   return [200, "Update Successful"]
 end
 
-def cluster_destroy(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+def cluster_destroy(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
-  out, errout, retval = run_cmd(session, PCS, "cluster", "destroy")
+  out, errout, retval = run_cmd(auth_user, PCS, "cluster", "destroy")
   if retval == 0
     return [200, "Successfully destroyed cluster"]
   else
     return [400, "Error destroying cluster:\n#{out}\n#{errout}\n#{retval}\n"]
   end
 end
 
-def get_wizard(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::READ)
+def get_wizard(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
   wizard = PCSDWizard.getWizard(params["wizard"])
   if wizard != nil
     return erb wizard.collection_page
   else
     return "Error finding Wizard - #{params["wizard"]}"
   end
 end
 
-def wizard_submit(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def wizard_submit(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
   wizard = PCSDWizard.getWizard(params["wizard"])
   if wizard != nil
     return erb wizard.process_responses(params)
@@ -1950,32 +1956,32 @@ def wizard_submit(params, request, session)
   end
 
 end
 
 # not used anymore, left here for backward compatability reasons
-def get_tokens(params, request, session)
+def get_tokens(params, request, auth_user)
   # pcsd runs as root thus always returns hacluster's tokens
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, 'Permission denied'
   end
   return [200, JSON.generate(read_tokens)]
 end
 
-def get_cluster_tokens(params, request, session)
+def get_cluster_tokens(params, request, auth_user)
   # pcsd runs as root thus always returns hacluster's tokens
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, "Permission denied"
   end
   on, off = get_nodes
   nodes = on + off
   nodes.uniq!
   return [200, JSON.generate(get_tokens_of_nodes(nodes))]
 end
 
-def save_tokens(params, request, session)
+def save_tokens(params, request, auth_user)
   # pcsd runs as root thus always returns hacluster's tokens
-  if not allowed_for_local_cluster(session, Permissions::FULL)
+  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
     return 403, "Permission denied"
   end
 
   new_tokens = {}
 
@@ -1997,41 +2003,41 @@ def save_tokens(params, request, session)
   else
     return [400, "Cannot update tokenfile."]
   end
 end
 
-def resource_master(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def resource_master(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
 
   unless params[:resource_id]
     return [400, 'resource_id has to be specified.']
   end
   _, stderr, retval = run_cmd(
-    session, PCS, 'resource', 'master', params[:resource_id]
+    auth_user, PCS, 'resource', 'master', params[:resource_id]
   )
   if retval != 0
     return [400, 'Unable to create master/slave resource from ' +
       "'#{params[:resource_id]}': #{stderr.join('')}"
     ]
   end
   return 200
 end
 
-def resource_change_group(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def resource_change_group(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
 
   if params[:resource_id].nil? or params[:group_id].nil?
     return [400, 'resource_id and group_id have to be specified.']
   end
   if params[:group_id].empty?
     if params[:old_group_id]
       _, stderr, retval = run_cmd(
-        session, PCS, 'resource', 'group', 'remove', params[:old_group_id],
+        auth_user, PCS, 'resource', 'group', 'remove', params[:old_group_id],
         params[:resource_id]
       )
       if retval != 0
         return [400, "Unable to remove resource '#{params[:resource_id]}' " +
           "from group '#{params[:old_group_id]}': #{stderr.join('')}"
@@ -2039,83 +2045,83 @@ def resource_change_group(params, request, session)
       end
     end
     return 200
   end
   _, stderr, retval = run_cmd(
-    session,
+    auth_user,
     PCS, 'resource', 'group', 'add', params[:group_id], params[:resource_id]
   )
   if retval != 0
     return [400, "Unable to add resource '#{params[:resource_id]}' to " +
       "group '#{params[:group_id]}': #{stderr.join('')}"
     ]
   end
   return 200
 end
 
-def resource_ungroup(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def resource_ungroup(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
 
   unless params[:group_id]
     return [400, 'group_id has to be specified.']
   end
   
   _, stderr, retval = run_cmd(
-    session, PCS, 'resource', 'ungroup', params[:group_id]
+    auth_user, PCS, 'resource', 'ungroup', params[:group_id]
   )
   if retval != 0
     return [400, 'Unable to ungroup group ' +
       "'#{params[:group_id]}': #{stderr.join('')}"
     ]
   end
   return 200
 end
 
-def resource_clone(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def resource_clone(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
 
   unless params[:resource_id]
     return [400, 'resource_id has to be specified.']
   end
   
   _, stderr, retval = run_cmd(
-    session, PCS, 'resource', 'clone', params[:resource_id]
+    auth_user, PCS, 'resource', 'clone', params[:resource_id]
   )
   if retval != 0
     return [400, 'Unable to create clone resource from ' +
       "'#{params[:resource_id]}': #{stderr.join('')}"
     ]
   end
   return 200
 end
 
-def resource_unclone(params, request, session)
-  if not allowed_for_local_cluster(session, Permissions::WRITE)
+def resource_unclone(params, request, auth_user)
+  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
 
   unless params[:resource_id]
     return [400, 'resource_id has to be specified.']
   end
 
   _, stderr, retval = run_cmd(
-    session, PCS, 'resource', 'unclone', params[:resource_id]
+    auth_user, PCS, 'resource', 'unclone', params[:resource_id]
   )
   if retval != 0
     return [400, 'Unable to unclone ' +
       "'#{params[:resource_id]}': #{stderr.join('')}"
     ]
   end
   return 200
 end
 
-def set_resource_utilization(params, reqest, session)
-  unless allowed_for_local_cluster(session, Permissions::WRITE)
+def set_resource_utilization(params, reqest, auth_user)
+  unless allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
 
   unless params[:resource_id] and params[:name]
     return 400, 'resource_id and name are required'
@@ -2124,23 +2130,23 @@ def set_resource_utilization(params, reqest, session)
   res_id = params[:resource_id]
   name = params[:name]
   value = params[:value] || ''
 
   _, stderr, retval = run_cmd(
-    session, PCS, 'resource', 'utilization', res_id, "#{name}=#{value}"
+    auth_user, PCS, 'resource', 'utilization', res_id, "#{name}=#{value}"
   )
 
   if retval != 0
     return [400, "Unable to set utilization '#{name}=#{value}' for " +
       "resource '#{res_id}': #{stderr.join('')}"
     ]
   end
   return 200
 end
 
-def set_node_utilization(params, reqest, session)
-  unless allowed_for_local_cluster(session, Permissions::WRITE)
+def set_node_utilization(params, reqest, auth_user)
+  unless allowed_for_local_cluster(auth_user, Permissions::WRITE)
     return 403, 'Permission denied'
   end
 
   unless params[:node] and params[:name]
     return 400, 'node and name are required'
@@ -2149,27 +2155,27 @@ def set_node_utilization(params, reqest, session)
   node = params[:node]
   name = params[:name]
   value = params[:value] || ''
 
   _, stderr, retval = run_cmd(
-    session, PCS, 'node', 'utilization', node, "#{name}=#{value}"
+    auth_user, PCS, 'node', 'utilization', node, "#{name}=#{value}"
   )
 
   if retval != 0
     return [400, "Unable to set utilization '#{name}=#{value}' for node " +
       "'#{res_id}': #{stderr.join('')}"
     ]
   end
   return 200
 end
 
-def get_cluster_properties_definition(params, request, session)
-  unless allowed_for_local_cluster(session, Permissions::READ)
+def get_cluster_properties_definition(params, request, auth_user)
+  unless allowed_for_local_cluster(auth_user, Permissions::READ)
     return 403, 'Permission denied'
   end
   stdout, _, retval = run_cmd(
-    session, PCS, 'property', 'get_cluster_properties_definition'
+    auth_user, PCS, 'property', 'get_cluster_properties_definition'
   )
   if retval == 0
     return [200, stdout]
   end
   return [400, '{}']
diff --git a/pcsd/resource.rb b/pcsd/resource.rb
index aaf61c91..3a079c80 100644
--- a/pcsd/resource.rb
+++ b/pcsd/resource.rb
@@ -1,12 +1,12 @@
 require 'pathname'
 
-def getResourcesGroups(session, get_fence_devices = false, get_all_options = false,
+def getResourcesGroups(auth_user, get_fence_devices = false, get_all_options = false,
   get_operations=false
 )
   stdout, stderror, retval = run_cmd(
-    session, CRM_MON, "--one-shot", "-r", "--as-xml"
+    auth_user, CRM_MON, "--one-shot", "-r", "--as-xml"
   )
   if retval != 0
     return [],[], retval
   end
 
@@ -58,11 +58,11 @@ def getResourcesGroups(session, get_fence_devices = false, get_all_options = fal
 
   resource_list = resource_list.select { |x| not x.orphaned }
   resource_list = resource_list.sort_by{|a| (a.group ? "1" : "0").to_s + a.group.to_s + "-" +  a.id}
 
   if get_all_options or get_operations
-    stdout, stderror, retval = run_cmd(session, "cibadmin", "-Q", "-l")
+    stdout, stderror, retval = run_cmd(auth_user, "cibadmin", "-Q", "-l")
     cib_output = stdout
     resources_inst_attr_map = {}
     resources_meta_attr_map = {}
     resources_operation_map = {}
     begin
@@ -165,11 +165,11 @@ def getAllConstraints(constraints_dom)
     end
   }
   return constraints
 end
 
-def getResourceMetadata(session, resourcepath)
+def getResourceMetadata(auth_user, resourcepath)
   options_required = {}
   options_optional = {}
   long_desc = ""
   short_desc = ""
 
@@ -191,11 +191,11 @@ def getResourceMetadata(session, resourcepath)
     rescue
       metadata = ""
     end
   else
     ENV['OCF_ROOT'] = OCF_ROOT
-    stdout, stderr, retval = run_cmd(session, resourcepath, 'meta-data')
+    stdout, stderr, retval = run_cmd(auth_user, resourcepath, 'meta-data')
     metadata = stdout.join
   end
 
   begin
     doc = REXML::Document.new(metadata)
@@ -242,13 +242,15 @@ def getResourceMetadata(session, resourcepath)
     end
   }
   [options_required, options_optional, [short_desc, long_desc]]
 end
 
-def getResourceAgents(session)
+def getResourceAgents(auth_user)
   resource_agent_list = {}
-  stdout, stderr, retval = run_cmd(session, PCS, "resource", "list", "--nodesc")
+  stdout, stderr, retval = run_cmd(
+    auth_user, PCS, "resource", "list", "--nodesc"
+  )
   if retval != 0
     $logger.error("Error running 'pcs resource list --nodesc")
     $logger.error(stdout + stderr)
     return {}
   end
diff --git a/pcsd/test/test_auth.rb b/pcsd/test/test_auth.rb
index 0e9b1c07..1d8f7183 100644
--- a/pcsd/test/test_auth.rb
+++ b/pcsd/test/test_auth.rb
@@ -33,63 +33,51 @@ class TestAuth < Test::Unit::TestCase
     password_file.truncate(0)
     password_file.rewind
     password_file.write(JSON.pretty_generate(users))
     password_file.close()
 
-    session = {}
     cookies = {}
-    result = PCSAuth.loginByToken(session, cookies)
-    assert_equal(false, result)
-    assert_equal({}, session)
+    result = PCSAuth.loginByToken(cookies)
+    assert_equal(nil, result)
 
-    session = {}
     cookies = {'token' => 'tokenX'}
-    result = PCSAuth.loginByToken(session, cookies)
-    assert_equal(false, result)
-    assert_equal({}, session)
+    result = PCSAuth.loginByToken(cookies)
+    assert_equal(nil, result)
 
-    session = {}
     cookies = {'token' => 'token1'}
-    result = PCSAuth.loginByToken(session, cookies)
-    assert_equal(true, result)
+    result = PCSAuth.loginByToken(cookies)
     assert_equal(
       {:username => 'user1', :usergroups => ['group1', 'haclient']},
-      session
+      result
     )
 
-    session = {}
     cookies = {
       'token' => 'token1',
       'CIB_user' => 'userX',
       'CIB_user_groups' => PCSAuth.cookieUserEncode('groupX')
     }
-    result = PCSAuth.loginByToken(session, cookies)
-    assert_equal(true, result)
+    result = PCSAuth.loginByToken(cookies)
     assert_equal(
       {:username => 'user1', :usergroups => ['group1', 'haclient']},
-      session
+      result
     )
 
-    session = {}
     cookies = {'token' => 'tokenS'}
-    result = PCSAuth.loginByToken(session, cookies)
-    assert_equal(true, result)
+    result = PCSAuth.loginByToken(cookies)
     assert_equal(
       {:username => SUPERUSER, :usergroups => []},
-      session
+      result
     )
 
-    session = {}
     cookies = {
       'token' => 'tokenS',
       'CIB_user' => 'userX',
       'CIB_user_groups' => PCSAuth.cookieUserEncode('groupX')
     }
-    result = PCSAuth.loginByToken(session, cookies)
-    assert_equal(true, result)
+    result = PCSAuth.loginByToken(cookies)
     assert_equal(
       {:username => 'userX', :usergroups => ['groupX']},
-      session
+      result
     )
   end
 
 end

Vulnerable code:       getSuperuserSession, "id", "-Gn", username
  def self.loginByToken(session, cookies)
          session[:username] = cookies['CIB_user']
            session[:usergroups] = cookieUserDecode(
            session[:usergroups] = []
          session[:username] = SUPERUSER
          session[:usergroups] = []
        return true
        session[:username] = username
        session[:usergroups] = success ? groups : []
        return true
    return false
  def self.loginByPassword(session, username, password)
      session[:username] = username
      session[:usergroups] = success ? groups : []
      return true
    return false
  def self.getSuperuserSession()
    def initialize(session, configs, nodes, cluster_name, tokens={})
      @session = session
            @session, node, 'set_configs', true, data, true, nil, 30,
    def initialize(session, config_classes, nodes, cluster_name)
      @session = session
            @session, node, 'get_configs', false, data
        PCSAuth.getSuperuserSession(), [config], nodes, cluster_name, tokens
            PCSAuth.getSuperuserSession(), [config.class], nodes, cluster_name
      PCSAuth.getSuperuserSession(), [config_new], nodes, cluster_name,
      PCSAuth.getSuperuserSession(), [config_new.class], nodes, cluster_name
    def self.load_current_node(session, crm_dom=nil)
def getFenceAgents(session, fence_agent = nil)
      required_options, optional_options, advanced_options, info = getFenceAgentMetadata(session, fa.name)
def getFenceAgentMetadata(session, fenceagentname)
    session, "/usr/sbin/#{fenceagentname}", '-o', 'metadata'
def getAllSettings(session, cib_dom=nil)
    cib_dom = get_cib_dom(session)
def add_fence_level(session, level, devices, node, remove = false)
      session, PCS, "stonith", "level", "add", level, node, devices
      session, PCS, "stonith", "level", "remove", level, node, devices
def add_node_attr(session, node, key, value)
    session, PCS, "property", "set", "--node", node, key.to_s + '=' + value.to_s
def add_meta_attr(session, resource, key, value)
    session, PCS, "resource", "meta", resource, key.to_s + "=" + value.to_s
  session, resource, node, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(session, *cmd)
  session, resource, rule, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(session, *cmd)
    session, resourceA, resourceB, actionA, actionB, score, symmetrical=true,
  stdout, stderr, retval = run_cmd(session, *command)
  session, resource_set_list, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(session, *command)
  session, resourceA, resourceB, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(session, *command)
def remove_constraint(session, constraint_id)
    session, PCS, "constraint", "remove", constraint_id
def remove_constraint_rule(session, rule_id)
    session, PCS, "constraint", "rule", "remove", rule_id
def add_acl_role(session, name, description)
  stdout, stderror, retval = run_cmd(session, *cmd)
def add_acl_permission(session, acl_role_id, perm_type, xpath_id, query_id)
    session, PCS, "acl", "permission", "add", acl_role_id.to_s, perm_type.to_s,
def add_acl_usergroup(session, acl_role_id, user_group, name)
      session, PCS, "acl", user_group, "create", name.to_s, acl_role_id.to_s
    session, PCS, "acl", "role", "assign", acl_role_id.to_s, name.to_s
def remove_acl_permission(session, acl_perm_id)
    session, PCS, "acl", "permission", "delete", acl_perm_id.to_s
def remove_acl_usergroup(session, role_id, usergroup_id)
    session, PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s,
def send_cluster_request_with_token(session, cluster_name, request, post=false, data={}, remote=true, raw_data=nil)
    session, nodes, request, post, data, remote, raw_data
def send_nodes_request_with_token(session, nodes, request, post=false, data={}, remote=true, raw_data=nil)
      session, node, request, post, data, remote, raw_data
def send_request_with_token(session, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, additional_tokens={})
    session, node, request, post, data, remote, raw_data, timeout, cookies_data
def send_request(session, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, cookies_data=nil)
      session[:username].to_s
      (session[:usergroups] || []).join(' ')
def add_node(session, new_nodename, all=false, auto_start=true)
    out, stderror, retval = run_cmd(session, *command)
      session, PCS, "cluster", "localnode", "add", new_nodename
def remove_node(session, new_nodename, all=false)
      session, PCS, "cluster", "node", "remove", new_nodename, "--force"
      session, PCS, "cluster", "localnode", "remove", new_nodename
    PCSAuth.getSuperuserSession, CRM_NODE, "-n"
      PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL, "cluster.cman"
      PCSAuth.getSuperuserSession,
    PCSAuth.getSuperuserSession,
    PCSAuth.getSuperuserSession, PCS, "status", "nodes", "corosync"
    PCSAuth.getSuperuserSession, PCS, "status", "nodes", "both"
  out, errout, retval = run_cmd(PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL)
def get_resource_agents_avail(session)
    session, params[:cluster], 'get_avail_resource_agents'
def get_stonith_agents_avail(session)
    session, params[:cluster], 'get_avail_fence_agents'
      PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL, "cluster"
    PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL, "totem.cluster_name"
def get_node_attributes(session, cib_dom=nil)
    cib_dom = get_cib_dom(session)
def get_fence_levels(session, cib_dom=nil)
    cib_dom = get_cib_dom(session)
def get_acls(session, cib_dom=nil)
    cib_dom = get_cib_dom(session)
def enable_cluster(session)
  stdout, stderror, retval = run_cmd(session, PCS, "cluster", "enable")
def disable_cluster(session)
  stdout, stderror, retval = run_cmd(session, PCS, "cluster", "disable")
      PCSAuth.getSuperuserSession, COROSYNC, "-v"
      PCSAuth.getSuperuserSession, PACEMAKERD, "-$"
      PCSAuth.getSuperuserSession, CMAN_TOOL, "-V"
def run_cmd(session, *args)
  return run_cmd_options(session, options, *args)
def run_cmd_options(session, options, *args)
  cib_user = session[:username]
  cib_groups = (session[:usergroups] || []).join(' ')
def check_gui_status_of_nodes(session, nodes, check_mutuality=false, timeout=10)
        session, node, 'check_auth', false, options, true, nil, timeout
def pcs_auth(session, nodes, username, password, force=false, local=true)
      session, nodes, true
    session, nodes, nodes, username, password, force, true
        session, nodes_to_auth, nodes, username, password, force, false
def run_auth_requests(session, nodes_to_send, nodes_to_auth, username, password, force=false, local=true)
      code, response = send_request(session, node, 'auth', true, data)
  session, nodes, force=false, clear_local_permissions=false
    session, configs.values(), nodes, $cluster_name
def send_local_certs_to_nodes(session, nodes)
        session, node, '/set_certs', true, data
def pcsd_restart_nodes(session, nodes)
        session, node, '/pcsd_restart', true
    PCSAuth.getSuperuserSession(),
    PCSAuth.getSuperuserSession(),
def cluster_status_from_nodes(session, cluster_nodes, cluster_name)
        session,
def get_node_status(session, cib_dom)
      :acls => get_acls(session, cib_dom),
      :username => session[:username],
      :fence_levels => get_fence_levels(session, cib_dom),
      :node_attr => node_attrs_to_v2(get_node_attributes(session, cib_dom)),
  node_status[:cluster_settings] = getAllSettings(session, cib_dom)
def get_crm_mon_dom(session)
      session, CRM_MON, '--one-shot', '-r', '--as-xml'
def get_cib_dom(session)
    stdout, _, retval = run_cmd(session, 'cibadmin', '-Q', '-l')
def allowed_for_local_cluster(session, action)
    session[:username], session[:usergroups], action
def allowed_for_superuser(session)
    "permission check superuser username=#{session[:username]} groups=#{session[:groups]}"
  if SUPERUSER != session[:username]
session = {}
    session[:username] = ENV['CIB_user']
      session[:usergroups] = ENV['CIB_user_groups'].split(nil)
      session[:usergroups] = []
    session[:username] = SUPERUSER
    session[:usergroups] = []
    session[:username] = username
    session[:usergroups] = success ? groups : []
# continue environment setup with user set in session
    'call' => lambda { |params, session| read_tokens() },
    'call' => lambda { |params, session|
        session, params['nodes'] || [], params['username'] || '',
    'call' => lambda { |params, session|
        PCSAuth.getSuperuserSession(),
    'call' => lambda { |params, session|
      send_local_certs_to_nodes(session, params['nodes'] || [])
    'call' => lambda { |params, session|
      pcsd_restart_nodes(session, params['nodes'] || [])
    if not allowed_for_superuser(session)
    if not allowed_for_local_cluster(session, command_settings['permissions'])
  result = allowed_commands[command]['call'].call(params, session)
  @errorval = session[:errorval]
  @error = session[:error]
  session[:errorval] = nil
  session[:error] = nil
              PCSAuth.getSuperuserSession(), Cfgsync::get_cfg_classes(),
      unless PCSAuth.loginByToken(session, cookies)
  return remote(params, request, session)
  return remote(params, request, session)
    if not allowed_for_superuser(session)
    if not allowed_for_local_cluster(session, command_settings['permissions'])
    session, options, PCS, *command_decoded
    if PCSAuth.loginByPassword(session, params['username'], params['password'])
      PCSAuth.getSuperuserSession(), node, 'status'
        PCSAuth.getSuperuserSession(), node, '/get_cluster_tokens'
    if not allowed_for_superuser(session)
        session, n, "/save_tokens", true, tokens
      session,
        session, node_array
            session, node, 'get_sw_versions'
          rescue JSON::ParserError => e
          code, response = send_request(session, nodename, 'auth', true, data)
    clusters_overview(params, request, session)
        session, @cluster_name, 'get_permissions'
    @resource_agents = get_resource_agents_avail(session)
    @stonith_agents = get_stonith_agents_avail(session)
      session, params[:cluster], "set_permissions", true, new_params
    status_all(params, request, session, get_cluster_nodes(params[:cluster]))
    cluster_status_gui(session, params[:cluster])
    code, out = send_cluster_request_with_token(session, cluster, 'get_cib')
        session, cluster, 'get_cluster_properties_definition'
      PCSAuth.getSuperuserSession(), clustername, "/save_tokens", true,
      if not allowed_for_local_cluster(session, Permissions::FULL)
      PCSAuth.getSuperuserSession(), clustername, '/save_tokens', true, token_data
      session, clustername, "/add_node_all", true, params
        session, params[:cluster], request, true, params, true, raw_data
          session, params[:cluster], redirection[request], true, params, false,
        session, params[:cluster], "/" + params[:splat].join("/"), false, params,
        true, raw_data
def remote(params, request, session)
      :add_node_all => lambda { |params_, request_, session_|
        remote_add_node(params_, request_, session_, true)
      :add_node => lambda { |params_, request_, session_|
        remote_add_node(params_, request_, session_, false)
    return remote_cmd_without_pacemaker[command].call(params, request, session)
      return remote_cmd_with_pacemaker[command].call(params, request, session)
def cluster_status_gui(session, cluster_name, dont_update_config=false)
  status = cluster_status_from_nodes(session, cluster_nodes, cluster_name)
      return cluster_status_gui(session, cluster_name, true)
def cluster_status_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  status = cluster_status_from_nodes(session, cluster_nodes, cluster_name)
def cluster_start(params, request, session)
      session, params[:name], 'cluster_start', true
    if not allowed_for_local_cluster(session, Permissions::WRITE)
def cluster_stop(params, request, session)
      session, params[:name], 'cluster_stop', true, params_without_name
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(session, PCS, "cluster", "stop", *options)
def config_backup(params, request, session)
      session, params[:name], 'config_backup', true
    if not allowed_for_local_cluster(session, Permissions::FULL)
    stdout, stderr, retval = run_cmd(session, PCS, "config", "backup")
def config_restore(params, request, session)
      session, params[:name], 'config_restore', true,
    if not allowed_for_local_cluster(session, Permissions::FULL)
def node_restart(params, request, session)
      session, params[:name], 'node_restart', true
    if not allowed_for_local_cluster(session, Permissions::WRITE)
def node_standby(params, request, session)
      session, params[:name], 'node_standby', true, {"node"=>params[:name]}
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(session, PCS, "cluster", "standby")
def node_unstandby(params, request, session)
      session, params[:name], 'node_unstandby', true, {"node"=>params[:name]}
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(session, PCS, "cluster", "unstandby")
def cluster_enable(params, request, session)
      session, params[:name], 'cluster_enable', true
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    success = enable_cluster(session)
def cluster_disable(params, request, session)
      session, params[:name], 'cluster_disable', true
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    success = disable_cluster(session)
def get_quorum_info(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
      PCSAuth.getSuperuserSession, CMAN_TOOL, "status"
      PCSAuth.getSuperuserSession,
      PCSAuth.getSuperuserSession, COROSYNC_QUORUMTOOL, "-p", "-s"
def get_cib(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  cib, stderr, retval = run_cmd(session, CIBADMIN, "-Ql")
def get_corosync_conf_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
def set_cluster_conf(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def set_corosync_conf(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def get_sync_capabilities(params, request, session)
def set_sync_options(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def get_configs(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def set_configs(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def set_certs(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def get_permissions_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
def set_permissions_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
    if not allowed_for_local_cluster(session, Permissions::FULL)
def remote_pcsd_restart(params, request, session)
def get_sw_versions(params, request, session)
def remote_node_available(params, request, session)
def remote_add_node(params, request, session, all=false)
  if not allowed_for_local_cluster(session, Permissions::FULL)
    retval, output = add_node(session, node, all, auto_start)
def remote_remove_nodes(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
    session, PCS, "cluster", "stop", *stop_params
    retval, output = remove_node(session, node, true)
def remote_remove_node(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
    retval, output = remove_node(session, params[:remove_nodename])
def setup_cluster(params, request, session)
  if not allowed_for_superuser(session)
    session, PCS, "cluster", "setup", "--enable", "--start",
def create_cluster(params, request, session)
  if not allowed_for_superuser(session)
  if set_corosync_conf(params, request, session)
    cluster_start(params, request, session)
def node_status(params, request, session)
      session,
  if not allowed_for_local_cluster(session, Permissions::READ)
  cib_dom = get_cib_dom(session)
  crm_dom = get_crm_mon_dom(session)
  status = get_node_status(session, cib_dom)
  node = ClusterEntity::Node.load_current_node(session, crm_dom)
    session,
def status_all(params, request, session, nodes=[], dont_update_config=false)
      code, response = send_request_with_token(session, node, 'status')
      return status_all(params, request, session, node_list, true)
def clusters_overview(params, request, session)
        session,
          session, node, 'cluster_status', true, {}, true, nil, 8
def auth(params, request, session)
        session, node_list, params['username'], params['password'],
def check_auth(params, request, session)
def resource_status(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  @resources,@groups = getResourcesGroups(session)
def resource_stop(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, "resource", "disable", params[:resource]
def resource_cleanup(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, "resource", "cleanup", params[:resource]
def resource_start(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, "resource", "enable", params[:resource]
def resource_form(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  cib_dom = get_cib_dom(session)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, HEARTBEAT_AGENTS_DIR + @cur_resource.type)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, PACEMAKER_AGENTS_DIR + @cur_resource.type)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, NAGIOS_METADATA_DIR + @cur_resource.type + '.xml')
def fence_device_form(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  @cur_resource = get_resource_by_id(params[:resource], get_cib_dom(session))
    @resource_agents = getFenceAgents(session, @cur_resource.agentname)
def update_resource (params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
        session,
      run_cmd(session, PCS, "resource", "clone", name)
      run_cmd(session, PCS, "resource", "master", name)
      session, PCS, "resource", "update", params[:resource_id], *param_line
          session, PCS, "resource", "group", "remove",
        session, PCS, "resource", "group", "add", params[:resource_group],
    run_cmd(session, PCS, "resource", "clone", params[:resource_id])
    run_cmd(session, PCS, "resource", "master", params[:resource_id])
      session, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
      session, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
def update_fence_device(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
      session, PCS, "stonith", "update", params[:resource_id], *param_line
def get_avail_resource_agents(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  agents = getResourceAgents(session)
def get_avail_fence_agents(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  agents = getFenceAgents(session)
def resource_metadata(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, HEARTBEAT_AGENTS_DIR + resource_name)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, PACEMAKER_AGENTS_DIR + resource_name)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, NAGIOS_METADATA_DIR + resource_name + '.xml')
  @resources, @groups = getResourcesGroups(session)
def fence_device_metadata(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  @fenceagent.required_options, @fenceagent.optional_options, @fenceagent.advanced_options, @fenceagent.info = getFenceAgentMetadata(session, params[:resourcename])
def remove_resource(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      out, errout, retval = run_cmd(session, *command)
def add_fence_level_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, params["level"], params["devices"], params["node"], params["remove"]
def add_node_attr_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, params["node"], params["key"], params["value"]
def add_acl_role_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
  retval = add_acl_role(session, params["name"], params["description"])
def remove_acl_roles_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
        session, PCS, "acl", "role", "delete", value.to_s, "--autodelete"
def add_acl_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
      session,
      session, params["role_id"], params["item"], params["usergroup"]
def remove_acl_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
    retval = remove_acl_permission(session, params["acl_perm_id"])
      session, params["role_id"],params["usergroup_id"]
def add_meta_attr_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, params["res_id"], params["key"],params["value"]
def add_constraint_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
      session,
      session,
def add_constraint_rule_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
def add_constraint_set_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
def remove_constraint_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    retval = remove_constraint(session, params[:constraint_id])
def remove_constraint_rule_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    retval = remove_constraint_rule(session, params[:rule_id])
def add_group(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, "resource", "group", "add", rg, *(resources.split(" "))
def update_cluster_settings(params, request, session)
  current = getAllSettings(session)
    if not allowed_for_local_cluster(session, Permissions::GRANT)
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(session, PCS, 'property', 'set', *cmd_args)
def cluster_destroy(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
  out, errout, retval = run_cmd(session, PCS, "cluster", "destroy")
def get_wizard(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
def wizard_submit(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
def get_tokens(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def get_cluster_tokens(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def save_tokens(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def resource_master(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'master', params[:resource_id]
def resource_change_group(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
        session, PCS, 'resource', 'group', 'remove', params[:old_group_id],
    session,
def resource_ungroup(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'ungroup', params[:group_id]
def resource_clone(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'clone', params[:resource_id]
def resource_unclone(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'unclone', params[:resource_id]
def set_resource_utilization(params, reqest, session)
  unless allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'utilization', res_id, "#{name}=#{value}"
def set_node_utilization(params, reqest, session)
  unless allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'node', 'utilization', node, "#{name}=#{value}"
def get_cluster_properties_definition(params, request, session)
  unless allowed_for_local_cluster(session, Permissions::READ)
    session, PCS, 'property', 'get_cluster_properties_definition'
def getResourcesGroups(session, get_fence_devices = false, get_all_options = false,
    session, CRM_MON, "--one-shot", "-r", "--as-xml"
    stdout, stderror, retval = run_cmd(session, "cibadmin", "-Q", "-l")
def getResourceMetadata(session, resourcepath)
    stdout, stderr, retval = run_cmd(session, resourcepath, 'meta-data')
def getResourceAgents(session)
  stdout, stderr, retval = run_cmd(session, PCS, "resource", "list", "--nodesc")
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(false, result)
    assert_equal({}, session)
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(false, result)
    assert_equal({}, session)
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
      session
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
      session
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
      session
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
      session
Fixed code:       getSuperuserAuth(), "id", "-Gn", username
  def self.loginByToken(cookies)
    auth_user = {}
          auth_user[:username] = cookies['CIB_user']
            auth_user[:usergroups] = cookieUserDecode(
            auth_user[:usergroups] = []
          auth_user[:username] = SUPERUSER
          auth_user[:usergroups] = []
        return auth_user
        auth_user[:username] = username
        auth_user[:usergroups] = success ? groups : []
        return auth_user
    return nil
  def self.loginByPassword(username, password)
      auth_user = {}
      auth_user[:username] = username
      auth_user[:usergroups] = success ? groups : []
      return auth_user
    return nil
  def self.getSuperuserAuth()

  def self.sessionToAuthUser(session)
    return {
      :username => session[:username],
      :usergroups => session[:usergroups],
    }
  end

  def self.authUserToSession(auth_user, session)
    session[:username] = auth_user[:username]
    session[:usergroups] = auth_user[:usergroups]
  end
    def initialize(auth_user, configs, nodes, cluster_name, tokens={})
      @auth_user = auth_user
            @auth_user, node, 'set_configs', true, data, true, nil, 30,
    def initialize(auth_user, config_classes, nodes, cluster_name)
      @auth_user = auth_user
            @auth_user, node, 'get_configs', false, data
        PCSAuth.getSuperuserAuth(), [config], nodes, cluster_name, tokens
            PCSAuth.getSuperuserAuth(), [config.class], nodes, cluster_name
      PCSAuth.getSuperuserAuth(), [config_new], nodes, cluster_name,
      PCSAuth.getSuperuserAuth(), [config_new.class], nodes, cluster_name
    def self.load_current_node(crm_dom=nil)
def getFenceAgents(auth_user, fence_agent = nil)
      required_options, optional_options, advanced_options, info = getFenceAgentMetadata(auth_user, fa.name)
def getFenceAgentMetadata(auth_user, fenceagentname)
    auth_user, "/usr/sbin/#{fenceagentname}", '-o', 'metadata'
def getAllSettings(auth_user, cib_dom=nil)
    cib_dom = get_cib_dom(auth_user)
def add_fence_level(auth_user, level, devices, node, remove = false)
      auth_user, PCS, "stonith", "level", "add", level, node, devices
      auth_user, PCS, "stonith", "level", "remove", level, node, devices
def add_node_attr(auth_user, node, key, value)
    auth_user, PCS, "property", "set", "--node", node, key.to_s + '=' + value.to_s
def add_meta_attr(auth_user, resource, key, value)
    auth_user, PCS, "resource", "meta", resource, key.to_s + "=" + value.to_s
  auth_user, resource, node, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(auth_user, *cmd)
  auth_user, resource, rule, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(auth_user, *cmd)
    auth_user, resourceA, resourceB, actionA, actionB, score, symmetrical=true,
  stdout, stderr, retval = run_cmd(auth_user, *command)
  auth_user, resource_set_list, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(auth_user, *command)
  auth_user, resourceA, resourceB, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(auth_user, *command)
def remove_constraint(auth_user, constraint_id)
    auth_user, PCS, "constraint", "remove", constraint_id
def remove_constraint_rule(auth_user, rule_id)
    auth_user, PCS, "constraint", "rule", "remove", rule_id
def add_acl_role(auth_user, name, description)
  stdout, stderror, retval = run_cmd(auth_user, *cmd)
def add_acl_permission(auth_user, acl_role_id, perm_type, xpath_id, query_id)
    auth_user, PCS, "acl", "permission", "add", acl_role_id.to_s, perm_type.to_s,
def add_acl_usergroup(auth_user, acl_role_id, user_group, name)
      auth_user, PCS, "acl", user_group, "create", name.to_s, acl_role_id.to_s
    auth_user, PCS, "acl", "role", "assign", acl_role_id.to_s, name.to_s
def remove_acl_permission(auth_user, acl_perm_id)
    auth_user, PCS, "acl", "permission", "delete", acl_perm_id.to_s
def remove_acl_usergroup(auth_user, role_id, usergroup_id)
    auth_user, PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s,
def send_cluster_request_with_token(auth_user, cluster_name, request, post=false, data={}, remote=true, raw_data=nil)
    auth_user, nodes, request, post, data, remote, raw_data
def send_nodes_request_with_token(auth_user, nodes, request, post=false, data={}, remote=true, raw_data=nil)
      auth_user, node, request, post, data, remote, raw_data
def send_request_with_token(auth_user, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, additional_tokens={})
    auth_user, node, request, post, data, remote, raw_data, timeout, cookies_data
def send_request(auth_user, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, cookies_data=nil)
      auth_user[:username].to_s
      (auth_user[:usergroups] || []).join(' ')
def add_node(auth_user, new_nodename, all=false, auto_start=true)
    out, stderror, retval = run_cmd(auth_user, *command)
      auth_user, PCS, "cluster", "localnode", "add", new_nodename
def remove_node(auth_user, new_nodename, all=false)
      auth_user, PCS, "cluster", "node", "remove", new_nodename, "--force"
      auth_user, PCS, "cluster", "localnode", "remove", new_nodename
    PCSAuth.getSuperuserAuth(), CRM_NODE, "-n"
      PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL, "cluster.cman"
      PCSAuth.getSuperuserAuth(),
    PCSAuth.getSuperuserAuth(),
    PCSAuth.getSuperuserAuth(), PCS, "status", "nodes", "corosync"
    PCSAuth.getSuperuserAuth(), PCS, "status", "nodes", "both"
  out, errout, retval = run_cmd(PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL)
def get_resource_agents_avail(auth_user, params)
    auth_user, params[:cluster], 'get_avail_resource_agents'
def get_stonith_agents_avail(auth_user, params)
    auth_user, params[:cluster], 'get_avail_fence_agents'
      PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL, "cluster"
    PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL, "totem.cluster_name"
def get_node_attributes(auth_user, cib_dom=nil)
    cib_dom = get_cib_dom(auth_user)
def get_fence_levels(auth_user, cib_dom=nil)
    cib_dom = get_cib_dom(auth_user)
def get_acls(auth_user, cib_dom=nil)
    cib_dom = get_cib_dom(auth_user)
def enable_cluster(auth_user)
  stdout, stderror, retval = run_cmd(auth_user, PCS, "cluster", "enable")
def disable_cluster(auth_user)
  stdout, stderror, retval = run_cmd(auth_user, PCS, "cluster", "disable")
      PCSAuth.getSuperuserAuth(), COROSYNC, "-v"
      PCSAuth.getSuperuserAuth(), PACEMAKERD, "-$"
      PCSAuth.getSuperuserAuth(), CMAN_TOOL, "-V"
def run_cmd(auth_user, *args)
  return run_cmd_options(auth_user, options, *args)
def run_cmd_options(auth_user, options, *args)
  cib_user = auth_user[:username]
  cib_groups = (auth_user[:usergroups] || []).join(' ')
def check_gui_status_of_nodes(auth_user, nodes, check_mutuality=false, timeout=10)
        auth_user, node, 'check_auth', false, options, true, nil, timeout
def pcs_auth(auth_user, nodes, username, password, force=false, local=true)
      auth_user, nodes, true
    auth_user, nodes, nodes, username, password, force, true
        auth_user, nodes_to_auth, nodes, username, password, force, false
def run_auth_requests(auth_user, nodes_to_send, nodes_to_auth, username, password, force=false, local=true)
      code, response = send_request(auth_user, node, 'auth', true, data)
  auth_user, nodes, force=false, clear_local_permissions=false
    auth_user, configs.values(), nodes, $cluster_name
def send_local_certs_to_nodes(auth_user, nodes)
        auth_user, node, '/set_certs', true, data
def pcsd_restart_nodes(auth_user, nodes)
        auth_user, node, '/pcsd_restart', true
    PCSAuth.getSuperuserAuth(),
    PCSAuth.getSuperuserAuth(),
def cluster_status_from_nodes(auth_user, cluster_nodes, cluster_name)
        auth_user,
def get_node_status(auth_user, cib_dom)
      :acls => get_acls(auth_user, cib_dom),
      :username => auth_user[:username],
      :fence_levels => get_fence_levels(auth_user, cib_dom),
      :node_attr => node_attrs_to_v2(get_node_attributes(auth_user, cib_dom)),
  node_status[:cluster_settings] = getAllSettings(auth_user, cib_dom)
def get_crm_mon_dom(auth_user)
      auth_user, CRM_MON, '--one-shot', '-r', '--as-xml'
def get_cib_dom(auth_user)
    stdout, _, retval = run_cmd(auth_user, 'cibadmin', '-Q', '-l')
def allowed_for_local_cluster(auth_user, action)
    auth_user[:username], auth_user[:usergroups], action
def allowed_for_superuser(auth_user)
    "permission check superuser username=#{auth_user[:username]} groups=#{auth_user[:usergroups]}"
  if SUPERUSER != auth_user[:username]
auth_user = {}
    auth_user[:username] = ENV['CIB_user']
      auth_user[:usergroups] = ENV['CIB_user_groups'].split(nil)
      auth_user[:usergroups] = []
    auth_user[:username] = SUPERUSER
    auth_user[:usergroups] = []
    auth_user[:username] = username
    auth_user[:usergroups] = success ? groups : []
# continue environment setup with user set in auth_user
    'call' => lambda { |params, auth_user_| read_tokens() },
    'call' => lambda { |params, auth_user_|
        auth_user_, params['nodes'] || [], params['username'] || '',
    'call' => lambda { |params, auth_user_|
        PCSAuth.getSuperuserAuth(),
    'call' => lambda { |params, auth_user_|
      send_local_certs_to_nodes(auth_user_, params['nodes'] || [])
    'call' => lambda { |params, auth_user_|
      pcsd_restart_nodes(auth_user_, params['nodes'] || [])
    if not allowed_for_superuser(auth_user)
    if not allowed_for_local_cluster(auth_user, command_settings['permissions'])
  result = allowed_commands[command]['call'].call(params, auth_user)
  @auth_user = nil
              PCSAuth.getSuperuserAuth(), Cfgsync::get_cfg_classes(),
      @auth_user = PCSAuth.loginByToken(cookies)
      unless @auth_user
  return remote(params, request, @auth_user)
  return remote(params, request, @auth_user)
    if not allowed_for_superuser(@auth_user)
    if not allowed_for_local_cluster(@auth_user, command_settings['permissions'])
    @auth_user, options, PCS, *command_decoded
    auth_user = PCSAuth.loginByPassword(
      params['username'], params['password']
    )
    if auth_user
      PCSAuth.authUserToSession(auth_user, session)
      PCSAuth.getSuperuserAuth(), node, 'status'
        PCSAuth.getSuperuserAuth(), node, '/get_cluster_tokens'
    auth_user = PCSAuth.sessionToAuthUser(session)
    if not allowed_for_superuser(auth_user)
        auth_user, n, "/save_tokens", true, tokens
      auth_user,
    auth_user = PCSAuth.sessionToAuthUser(session)
        auth_user, node_array
    auth_user = PCSAuth.sessionToAuthUser(session)
            auth_user, node, 'get_sw_versions'
          rescue JSON::ParserError
    auth_user = PCSAuth.sessionToAuthUser(session)
          code, response = send_request(auth_user, nodename, 'auth', true, data)
    clusters_overview(params, request, PCSAuth.sessionToAuthUser(session))
    auth_user = PCSAuth.sessionToAuthUser(session)
        auth_user, @cluster_name, 'get_permissions'
    auth_user = PCSAuth.sessionToAuthUser(session)
    @resource_agents = get_resource_agents_avail(auth_user, params)
    @stonith_agents = get_stonith_agents_avail(auth_user, params)
    auth_user = PCSAuth.sessionToAuthUser(session)
      auth_user, params[:cluster], "set_permissions", true, new_params
    auth_user = PCSAuth.sessionToAuthUser(session)
    status_all(params, request, auth_user, get_cluster_nodes(params[:cluster]))
    auth_user = PCSAuth.sessionToAuthUser(session)
    cluster_status_gui(auth_user, params[:cluster])
    auth_user = PCSAuth.sessionToAuthUser(session)
    code, out = send_cluster_request_with_token(auth_user, cluster, 'get_cib')
        auth_user, cluster, 'get_cluster_properties_definition'
      PCSAuth.getSuperuserAuth(), clustername, "/save_tokens", true,
    auth_user = PCSAuth.sessionToAuthUser(session)
      if not allowed_for_local_cluster(auth_user, Permissions::FULL)
      PCSAuth.getSuperuserAuth(), clustername, '/save_tokens', true, token_data
      auth_user, clustername, "/add_node_all", true, params
    auth_user = PCSAuth.sessionToAuthUser(session)
        auth_user, params[:cluster], request, true, params, true, raw_data
          auth_user,
          params[:cluster],
          redirection[request],
          true,
          params,
          false,
    auth_user = PCSAuth.sessionToAuthUser(session)
        auth_user,
        params[:cluster],
        "/" + params[:splat].join("/"),
        false,
        params,
        true,
        raw_data
def remote(params, request, auth_user)
      :add_node_all => lambda { |params_, request_, auth_user_|
        remote_add_node(params_, request_, auth_user_, true)
      :add_node => lambda { |params_, request_, auth_user_|
        remote_add_node(params_, request_, auth_user_, false)
    return remote_cmd_without_pacemaker[command].call(
      params, request, auth_user
    )
      return remote_cmd_with_pacemaker[command].call(params, request, auth_user)
def cluster_status_gui(auth_user, cluster_name, dont_update_config=false)
  status = cluster_status_from_nodes(auth_user, cluster_nodes, cluster_name)
      return cluster_status_gui(auth_user, cluster_name, true)
def cluster_status_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  status = cluster_status_from_nodes(auth_user, cluster_nodes, cluster_name)
def cluster_start(params, request, auth_user)
      auth_user, params[:name], 'cluster_start', true
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
def cluster_stop(params, request, auth_user)
      auth_user, params[:name], 'cluster_stop', true, params_without_name
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(
      auth_user, PCS, "cluster", "stop", *options
    )
def config_backup(params, request, auth_user)
      auth_user, params[:name], 'config_backup', true
    if not allowed_for_local_cluster(auth_user, Permissions::FULL)
    stdout, stderr, retval = run_cmd(auth_user, PCS, "config", "backup")
def config_restore(params, request, auth_user)
      auth_user, params[:name], 'config_restore', true,
    if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def node_restart(params, request, auth_user)
      auth_user, params[:name], 'node_restart', true
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
def node_standby(params, request, auth_user)
      auth_user, params[:name], 'node_standby', true, {"node"=>params[:name]}
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(auth_user, PCS, "cluster", "standby")
def node_unstandby(params, request, auth_user)
      auth_user, params[:name], 'node_unstandby', true, {"node"=>params[:name]}
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(auth_user, PCS, "cluster", "unstandby")
def cluster_enable(params, request, auth_user)
      auth_user, params[:name], 'cluster_enable', true
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    success = enable_cluster(auth_user)
def cluster_disable(params, request, auth_user)
      auth_user, params[:name], 'cluster_disable', true
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    success = disable_cluster(auth_user)
def get_quorum_info(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
      PCSAuth.getSuperuserAuth(), CMAN_TOOL, "status"
      PCSAuth.getSuperuserAuth(),
      PCSAuth.getSuperuserAuth(), COROSYNC_QUORUMTOOL, "-p", "-s"
def get_cib(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  cib, stderr, retval = run_cmd(auth_user, CIBADMIN, "-Ql")
def get_corosync_conf_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
def set_cluster_conf(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def set_corosync_conf(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def get_sync_capabilities(params, request, auth_user)
def set_sync_options(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def get_configs(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def set_configs(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def set_certs(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def get_permissions_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
def set_permissions_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
    if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def remote_pcsd_restart(params, request, auth_user)
def get_sw_versions(params, request, auth_user)
def remote_node_available(params, request, auth_user)
def remote_add_node(params, request, auth_user, all=false)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
    retval, output = add_node(auth_user, node, all, auto_start)
def remote_remove_nodes(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
    auth_user, PCS, "cluster", "stop", *stop_params
    retval, output = remove_node(auth_user, node, true)
def remote_remove_node(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
    retval, output = remove_node(auth_user, params[:remove_nodename])
def setup_cluster(params, request, auth_user)
  if not allowed_for_superuser(auth_user)
    auth_user, PCS, "cluster", "setup", "--enable", "--start",
def create_cluster(params, request, auth_user)
  if not allowed_for_superuser(auth_user)
  if set_corosync_conf(params, request, auth_user)
    cluster_start(params, request, auth_user)
def node_status(params, request, auth_user)
      auth_user,
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  cib_dom = get_cib_dom(auth_user)
  crm_dom = get_crm_mon_dom(auth_user)
  status = get_node_status(auth_user, cib_dom)
  node = ClusterEntity::Node.load_current_node(crm_dom)
    auth_user,
def status_all(params, request, auth_user, nodes=[], dont_update_config=false)
      code, response = send_request_with_token(auth_user, node, 'status')
      return status_all(params, request, auth_user, node_list, true)
def clusters_overview(params, request, auth_user)
        auth_user,
          auth_user, node, 'cluster_status', true, {}, true, nil, 8
def auth(params, request, auth_user)
        auth_user, node_list, params['username'], params['password'],
def check_auth(params, request, auth_user)
def resource_status(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  @resources,@groups = getResourcesGroups(auth_user)
def resource_stop(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, "resource", "disable", params[:resource]
def resource_cleanup(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, "resource", "cleanup", params[:resource]
def resource_start(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, "resource", "enable", params[:resource]
def resource_form(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  cib_dom = get_cib_dom(auth_user)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, HEARTBEAT_AGENTS_DIR + @cur_resource.type)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, PACEMAKER_AGENTS_DIR + @cur_resource.type)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, NAGIOS_METADATA_DIR + @cur_resource.type + '.xml')
def fence_device_form(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  @cur_resource = get_resource_by_id(params[:resource], get_cib_dom(auth_user))
    @resource_agents = getFenceAgents(auth_user, @cur_resource.agentname)
def update_resource (params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
        auth_user,
      run_cmd(auth_user, PCS, "resource", "clone", name)
      run_cmd(auth_user, PCS, "resource", "master", name)
      auth_user, PCS, "resource", "update", params[:resource_id], *param_line
          auth_user, PCS, "resource", "group", "remove",
        auth_user, PCS, "resource", "group", "add", params[:resource_group],
    run_cmd(auth_user, PCS, "resource", "clone", params[:resource_id])
    run_cmd(auth_user, PCS, "resource", "master", params[:resource_id])
      auth_user, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
      auth_user, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
def update_fence_device(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
      auth_user, PCS, "stonith", "update", params[:resource_id], *param_line
def get_avail_resource_agents(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  agents = getResourceAgents(auth_user)
def get_avail_fence_agents(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  agents = getFenceAgents(auth_user)
def resource_metadata(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, HEARTBEAT_AGENTS_DIR + resource_name)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, PACEMAKER_AGENTS_DIR + resource_name)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, NAGIOS_METADATA_DIR + resource_name + '.xml')
  @resources, @groups = getResourcesGroups(auth_user)
def fence_device_metadata(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  @fenceagent.required_options, @fenceagent.optional_options, @fenceagent.advanced_options, @fenceagent.info = getFenceAgentMetadata(auth_user, params[:resourcename])
def remove_resource(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      out, errout, retval = run_cmd(auth_user, *command)
def add_fence_level_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, params["level"], params["devices"], params["node"], params["remove"]
def add_node_attr_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, params["node"], params["key"], params["value"]
def add_acl_role_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
  retval = add_acl_role(auth_user, params["name"], params["description"])
def remove_acl_roles_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
        auth_user, PCS, "acl", "role", "delete", value.to_s, "--autodelete"
def add_acl_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
      auth_user,
      auth_user, params["role_id"], params["item"], params["usergroup"]
def remove_acl_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
    retval = remove_acl_permission(auth_user, params["acl_perm_id"])
      auth_user, params["role_id"],params["usergroup_id"]
def add_meta_attr_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, params["res_id"], params["key"],params["value"]
def add_constraint_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
      auth_user,
      auth_user,
def add_constraint_rule_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
def add_constraint_set_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
def remove_constraint_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    retval = remove_constraint(auth_user, params[:constraint_id])
def remove_constraint_rule_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    retval = remove_constraint_rule(auth_user, params[:rule_id])
def add_group(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, "resource", "group", "add", rg, *(resources.split(" "))
def update_cluster_settings(params, request, auth_user)
  current = getAllSettings(auth_user)
    if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(
      auth_user, PCS, 'property', 'set', *cmd_args
    )
def cluster_destroy(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
  out, errout, retval = run_cmd(auth_user, PCS, "cluster", "destroy")
def get_wizard(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
def wizard_submit(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
def get_tokens(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def get_cluster_tokens(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def save_tokens(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def resource_master(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'master', params[:resource_id]
def resource_change_group(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
        auth_user, PCS, 'resource', 'group', 'remove', params[:old_group_id],
    auth_user,
def resource_ungroup(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'ungroup', params[:group_id]
def resource_clone(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'clone', params[:resource_id]
def resource_unclone(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'unclone', params[:resource_id]
def set_resource_utilization(params, reqest, auth_user)
  unless allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'utilization', res_id, "#{name}=#{value}"
def set_node_utilization(params, reqest, auth_user)
  unless allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'node', 'utilization', node, "#{name}=#{value}"
def get_cluster_properties_definition(params, request, auth_user)
  unless allowed_for_local_cluster(auth_user, Permissions::READ)
    auth_user, PCS, 'property', 'get_cluster_properties_definition'
def getResourcesGroups(auth_user, get_fence_devices = false, get_all_options = false,
    auth_user, CRM_MON, "--one-shot", "-r", "--as-xml"
    stdout, stderror, retval = run_cmd(auth_user, "cibadmin", "-Q", "-l")
def getResourceMetadata(auth_user, resourcepath)
    stdout, stderr, retval = run_cmd(auth_user, resourcepath, 'meta-data')
def getResourceAgents(auth_user)
  stdout, stderr, retval = run_cmd(
    auth_user, PCS, "resource", "list", "--nodesc"
  )
    result = PCSAuth.loginByToken(cookies)
    assert_equal(nil, result)
    result = PCSAuth.loginByToken(cookies)
    assert_equal(nil, result)
    result = PCSAuth.loginByToken(cookies)
      result
    result = PCSAuth.loginByToken(cookies)
      result
    result = PCSAuth.loginByToken(cookies)
      result
    result = PCSAuth.loginByToken(cookies)
      result