When using v3 API to authenticate user/password in XML format, should report 400 Bad request instead of 401 if the XML if malformed

[xingzhou]

when using the request like below:

curl -i -X POST -H "X-Auth-Token:ADMIN" -H "Content-type:application/xml" http://9.119.148.18:35357/v3/auth/tokens -d '<?xml version="1.0" encoding="UTF-8"?><auth><identity><methods><method>password</method></methods><password><user password="xxxxxx" name="admin"></user></password></identity></auth>' -H "User-Agent:python-keystoneclient"

knowing that in the above request xml, there should be domain specified, the v3 API respond with 401 unauthorized error, which should be 400 bad request if the XML is malformed. 401 would lead to confusion

[Dolph Mathews (dolph)]

This doesn't look like valid usage of the authentication API, as an unnecessary X-Auth-Token is being provided in the request headers. If this issue is still reproducible without that header, then this should certainly be fixed.

[David Stanek (dstanek)]

I tested both with and without the X-Auth-Token on Keystone master branch running on devstack and both returned a 400:

[dstanek:/opt/stack/keystone]$ curl -s -i -X POST -H "X-Auth-Token:ADMIN" -H "Content-type:application/xml" http://localhost:35357/v3/auth/tokens -d '<?xml version="1.0" encoding="UTF-8"?><auth><identity><methods><method>password</method></methods><password><user password="xxxxxx" name="admin"></user></password></identity></auth>' -H "User-Agent:python-keystoneclient" | grep '^HTTP'
HTTP/1.1 400 Bad Request

[dstanek:/opt/stack/keystone]$ curl -s -i -X POST -H "Content-type:application/xml" http://localhost:35357/v3/auth/tokens -d '<?xml version="1.0" encoding="UTF-8"?><auth><identity><methods><method>password</method></methods><password><user password="xxxxxx" name="admin"></user></password></identity></auth>' -H "User-Agent:python-keystoneclient" | grep '^HTTP'
HTTP/1.1 400 Bad Request

What version of Keystone are you using?

[Dolph Mathews (dolph)]

David, can you run the same commands against stable/grizzly?

[Launchpad Janitor (janitor)]

[Expired for Keystone because there has been no activity for 60 days.]