os_password was set to None by the novaclient

[Haiwei Xu]

When creating an instance with V3 API, novaclient sends an empty
os_password to image_cs. This will cause 401(Unauthorized: Invalid
user/password) when trying to find image.

Here is what I did:

nova --debug --os-compute-api-version 3 boot --image cirros-0.3.1-x86_64-uec --flavor m1.nano vm01

REQ: curl -i 'http://10.xxxxxxx:5000/v2.0/tokens' -X POST -H "Content-Type: application/json" -H "Accept: application/json" -H "User-Agent: python-novaclient" -d '{"auth": {"tenantName": "demo", "passwordCredentials": {"username": "admin", "password": "openstack"}}}'

RESP: [200] CaseInsensitiveDict({'date': 'Fri, 07 Feb 2014 18:42:11 GMT', 'vary': 'X-Auth-Token', 'content-length': '8759', 'content-type': 'application/json'})
RESP BODY: {"access": {"token": {"issued_at": "2014-02-07T18:42:11.616984", "expires": "2014-02-07T19:42:11Z", "id": "MIIPawYJKoZIhvcNAQcCoIIPXDCCD1gCAQExCTAHBgUrDgMCGjCCDcEGCSqGSIb3DQEHAaCCDbIEgg2ueyJhY2Nlc3MiOiB7InRva2VuIjogeyJpc3N1ZWRfYXQiOiAiMjAxNC0wMi0wN1QxODo0MjoxMS42MTY5ODQiLCAiZXhwaXJlcyI6ICIyMDE0LTAyLTA3VDE5OjQyOjExWiIsICJpZCI6ICJwbGFjZWhvbGRlciIsICJ0ZW5hbnQiOiB7ImRlc2NyaXB0aW9uIjogbnVsbCwgImVuYWJsZWQiOiB0cnVlLCAiaWQiOiAiMzUyYzgzYzhjYjMwNGNiNWExNzE5ZGNkYThhODAxMTgiLCAibmFtZSI6ICJkZW1vIn19LCAic2VydmljZUNhdGFsb2ciOiBbeyJlbmRwb2ludHMiOiBbeyJhZG1pblVSTCI6ICJodHRwOi8vMTAuMjEuNDIuOTg6ODc3Ni92MS8zNTJjODNjOGNiMzA0Y2I1YTE3MTlkY2RhOGE4MDExOCIsICJyZWdpb24iOiAiUmVnaW9uT25lIiwgImludGVybmFsVVJMIjogImh0dHA6Ly8xMC4yMS40Mi45ODo4Nzc2L3YxLzM1MmM4M2M4Y2IzMDRjYjVhMTcxOWRjZGE4YTgwMTE4IiwgImlkIjogIjUzZDNjZDVkNWM1YTQwODdhMjFiYTIyMjg1YTY1YTkzIiwgInB1YmxpY1VSTCI6ICJodHRwOi8vMTAuMjEuNDIuOTg6ODc3Ni92MS8zNTJjODNjOGNiMzA0Y2I1YTE3MTlkY2RhOGE4MDExOCJ9XSwgImVuZHBvaW50c19saW5rcyI6IFtdLCAidHlwZSI6ICJ2b2x1bWUiLCAibmFtZSI6ICJjaW5kZXIifSwgeyJlbmRwb2ludHMiOiBbeyJhZG1pblVSTCI6ICJodHRwOi8vMTAuMjEuNDIuOTg6ODc3NC92Mi8zNTJjODNjOGNiMzA0Y2I1YTE3MTlkY2RhOGE4MDExOCIsICJyZWdpb24iOiAiUmVnaW9uT25lIiwgImludGVybmFsVVJMIjogImh0dHA6Ly8xMC4yMS40Mi45ODo"endpoints_links": [], "type": "identity", "name": "keystone"}], "user": {"username": "admin", "roles_links": [], "id": "3ae48abcf38449b18dd12162e5fdf683", "roles": [{"name": "admin"}], "name": "admin"}, "metadata": {"is_admin": 0, "roles": ["4ed6b3d5679c4d2f8446b3c5df720dce"]}}}

REQ: curl -i 'http://10.xxx:5000/v2.0/tokens' -X POST -H "Content-Type: application/json" -H "Accept: application/json" -H "User-Agent: python-novaclient" -d '{"auth": {"tenantName": "demo", "passwordCredentials": {"username": "admin", "password": ★null}}}'★

RESP: [401] CaseInsensitiveDict({'date': 'Fri, 07 Feb 2014 18:42:11 GMT', 'vary': 'X-Auth-Token', 'content-length': '87', 'content-type': 'application/json', 'www-authenticate': 'Keystone uri="http://10.21.42.98:5000/"'})
RESP BODY: {"error": {"message": "Invalid user / password", "code": 401, "title": "Unauthorized"}}

DEBUG (shell:775) Invalid user / password (HTTP 401)
Traceback (most recent call last):
  File "/opt/stack/python-novaclient/novaclient/shell.py", line 772, in main
    OpenStackComputeShell().main(map(strutils.safe_decode, sys.argv[1:]))
  File "/opt/stack/python-novaclient/novaclient/shell.py", line 708, in main
    args.func(self.cs, args)
  File "/opt/stack/python-novaclient/novaclient/v3/shell.py", line 304, in do_boot
    boot_args, boot_kwargs = _boot(cs, args)
  File "/opt/stack/python-novaclient/novaclient/v3/shell.py", line 77, in _boot
    image = _find_image(cs.image_cs, args.image)
  File "/opt/stack/python-novaclient/novaclient/v3/shell.py", line 1366, in _find_image
    return utils.find_resource(cs.images, image)
  File "/opt/stack/python-novaclient/novaclient/utils.py", line 223, in find_resource
    return manager.get(tmp_id)
  File "/opt/stack/python-novaclient/novaclient/v3/images.py", line 86, in get
    resp, _ = self.api.client._cs_request(url, 'HEAD')
  File "/opt/stack/python-novaclient/novaclient/client.py", line 220, in _cs_request
    self.authenticate()
  File "/opt/stack/python-novaclient/novaclient/client.py", line 352, in authenticate
    auth_url = self._v2_auth(auth_url)
  File "/opt/stack/python-novaclient/novaclient/client.py", line 439, in _v2_auth
    return self._authenticate(url, body)
  File "/opt/stack/python-novaclient/novaclient/client.py", line 452, in _authenticate
    **kwargs)
  File "/opt/stack/python-novaclient/novaclient/client.py", line 213, in _time_request
    resp, body = self.request(url, method, **kwargs)
  File "/opt/stack/python-novaclient/novaclient/client.py", line 207, in request
    raise exceptions.from_response(resp, body, url, method)
Unauthorized: Invalid user / password (HTTP 401)
ERROR: Invalid user / password (HTTP 401)

[Ken'ichi Ohmichi (oomichi)]

I see the same problem when using Nova v3 API:

$ nova --os-compute-api-version 3 boot --image cirros-0.3.1-x86_64-uec --flavor m1.nano vm01
ERROR: Invalid user / password (HTTP 401)
$

This problem does not happen when using Nova v2 API:
$ nova --os-compute-api-version 1.1 boot --image cirros-0.3.1-x86_64-uec --flavor m1.nano vm01
+--------------------------------------+----------------------------------------------------------------+
| Property | Value |
+--------------------------------------+----------------------------------------------------------------+
| OS-DCF:diskConfig | MANUAL |
| OS-EXT-AZ:availability_zone | nova |
| OS-EXT-STS:power_state | 0 |
| OS-EXT-STS:task_state | scheduling |
| OS-EXT-STS:vm_state | building |
| OS-SRV-USG:launched_at | - |
| OS-SRV-USG:terminated_at | - |
| accessIPv4 | |
| accessIPv6 | |
| adminPass | 8sGQuznJiCJy |
| config_drive | |
| created | 2014-02-19T15:13:28Z |
| flavor | m1.nano (42) |
| hostId | |
| id | e99d9585-9e14-40eb-8227-5fe685654c69 |
| image | cirros-0.3.1-x86_64-uec (7480a328-bb66-449f-8413-815ba1ac32b8) |
| key_name | - |
| metadata | {} |
| name | vm01 |
| os-extended-volumes:volumes_attached | [] |
| progress | 0 |
| security_groups | default |
| status | BUILD |
| tenant_id | c245e9417b164b6fa2dc0b5f9c174cd0 |
| up...

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/71846
Committed: https://git.openstack.org/cgit/openstack/python-novaclient/commit/?id=02a091cc6c5b19c0e97a7b5771379cef20b612d5
Submitter: Jenkins
Branch: master

commit 02a091cc6c5b19c0e97a7b5771379cef20b612d5
Author: Haiwei Xu <email address hidden>
Date: Sat Feb 8 03:45:47 2014 +0900

    Fix authentication bug when booting an server in V3

    Currently when booting a server with V3, novaclient sends an empty
    os_password to image_cs. This will cause 401(Unauthorized: Invalid
    user/password) when trying to find image. This is is a result of
    changes nova's V3 API: nova is no longer used as a proxy for the
    image service. So novaclient uses two Client instances: one for
    nova, the other for image service. This patch checks os_password
    before creating the image Client and assigns it if it's empty.

    Change-Id: Ic54cef93e9b823fb98b1edd78776c9a1fc06ba46
    Closes-Bug: #1277425