Troubleshooting OS Login

This page describes how to troubleshoot OS Login using the metadata server. For information on setting up OS Login or for step-by-step instructions, see Setting up OS Login or Setting up OS Login with 2-step verification.

You can query the metadata server from within a virtual machine (VM) instance. For more information, see Storing and retrieving instance metadata.

Before you begin

Default OS Login metadata entries

Compute Engine defines a set of default metadata entries that serves OS Login information. Default metadata is always defined and set by the server. The following table describes the entries you can query.

Relative to http://metadata.google.internal/computeMetadata/v1/
Metadata entry Description
project/attributes/enable-oslogin Checks if OS Login is enabled on the current Cloud project.
instance/attributes/enable-oslogin Checks if OS Login is enabled on the current VM.
oslogin/users/ Retrieves profile information for OS Login users. You can pass query parameters such as username, uid, pagesize and pagetoken.
oslogin/authorize/

Retrieves login or administrative level permission settings for an OS Login user.

To check a permission, you must specify the policy query parameter. The value of the policy parameter must be set to either login (to check for login permission) or adminLogin (to check for sudo access).

Checking if OS Login is enabled

If both instance and project metadata are set, instance metadata takes precedence. You can run the following commands on your VMs.

  1. Check if OS Login is enabled in your instance metadata, run the following command.

    user@myinst:~$ curl "http://metadata.google.internal/computeMetadata/v1/instance/attributes/enable-oslogin" -H "Metadata-Flavor: Google"
    

    If OS Login is enabled on the instance, the output returns TRUE.

  2. If the metadata value is not configured for the instance, you can check if OS Login is enabled on your Cloud project. To check, run the following command.

    user@myinst:~$ curl "http://metadata.google.internal/computeMetadata/v1/project/attributes/enable-oslogin" -H "Metadata-Flavor: Google"
    

    If OS Login is enabled on the Cloud project, the output returns TRUE.

Viewing OS Login users

To view the profile information for multiple users, you need to specify the pagesize and pagetoken parameters. Replace the pagesize and pagetoken with the required numeric value.

user@myinst:~$ curl "http://metadata.google.internal/computeMetadata/v1/oslogin/users?pagesize=PAGE_SIZE&
pagetoken=PAGE_TOKEN" -H "Metadata-Flavor: Google"

For example to set the pagesize to 1 and the pagetoken to 0, run the following command:

user@myinst:~$ curl "http://metadata.google.internal/computeMetadata/v1/oslogin/users?pagesize=1&pagetoken=0" -H "Metadata-Flavor: Google"

On most distributions, you can also run the Unix command getent passwd to retrieve the password entries for organization users.

Viewing a specific OS Login user

To view the profile information for a specific user on your VM, run the following command. Replace USER_NAME with the name of the user that you want to query.

user@myinst:~$ curl "http://metadata.google.internal/computeMetadata/v1/oslogin/users?username=USER_NAME" -H "Metadata-Flavor: Google"

For example you can perform a request to look up the user user_example_com. The following command and output show added formatting for improved readability.

user@myinst:~$ curl "http://metadata.google.internal/computeMetadata/v1/oslogin/users?username=user_example_com" -H "Metadata-Flavor: Google"

{
    "loginProfiles": [{
        "name": "12345678912345",
        "posixAccounts": [{
            "primary": true,
            "username": "user_example_com",
            "uid": "123451",
            "gid": "123451",
            "homeDirectory": "/home/user_example_com",
            "operatingSystemType": "LINUX"
        }],
        "sshPublicKeys": {
            "204c4b4fb...": {
                "key": "ssh-rsa AAAAB3Nz...",
                "fingerprint": "204c4b4fb..."
            }
        }
    }]
}

On most distributions, you can also run Unix commands such as getent passwd username or getent passwd uid to retrieve profile information.

To retrieve the SSH keys for a user, you can also run /usr/bin/google_authorized_keys username. If no keys are returned, the user might not have the required permissions to log into the VM.

Checking login permissions

To view login and administrative level permissions, you must provide the policy=login&email=LOGIN_NAME query parameters. Replace LOGIN_NAME with the value in the name field from querying the user profile.

user@myinst:~$ curl "http://metadata.google.internal/computeMetadata/v1/oslogin/authorize?policy=login&email=LOGIN_NAME" -H "Metadata-Flavor: Google"

For example, you can query the login permissions for the user user_example_com that was viewed in the previous section. In this example, the command output indicates the user is authorized to log in to the VM:

user@myinst:~$ curl "http://metadata.google.internal/computeMetadata/v1/oslogin/authorize?policy=login&email=12345678912345" -H "Metadata-Flavor: Google"

{"success":true}

Checking if your VM has a service account

You can query the metadata server to find the service account associated with your VM. On your VM, run the following command:

user@myinst:~$ curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/" -H "Metadata-Flavor: Google"

12345-sa@developer.gserviceaccount.com/
default/

If no service account is found, the output is blank.

What's next