Unauthorized: Unknown auth strategy

[Armando Migliaccio]

I have seen this error occasionally in various (Nova) logs:

2014-03-25 10:42:58.182 31770 TRACE nova.api.openstack raise exceptions.Unauthorized(message=_('Unknown auth strategy'))
2014-03-25 10:42:58.182 31770 TRACE nova.api.openstack Unauthorized: Unknown auth strategy

Full stacktrace can be found with this logstash query:

http://logstash.openstack.org/#eyJzZWFyY2giOiJtZXNzYWdlOlwiVW5hdXRob3JpemVkOiBVbmtub3duIGF1dGggc3RyYXRlZ3lcIiIsImZpZWxkcyI6W10sIm9mZnNldCI6MCwidGltZWZyYW1lIjoiODY0MDAiLCJncmFwaG1vZGUiOiJjb3VudCIsInRpbWUiOnsidXNlcl9pbnRlcnZhbCI6MH0sInN0YW1wIjoxMzk1NzU2MzQxNTc3fQ==

As a first step, it would be nice for neutronclient to say what auth strategy it is unable to handle.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/82834

[Armando Migliaccio (armando-migliaccio)]

I have seen this error in conjunction with this server side error:

InvalidUserToken: Token authorization failed

Logstash available here:

http://logstash.openstack.org/#eyJzZWFyY2giOiJtZXNzYWdlOlwiSW52YWxpZFVzZXJUb2tlbjogVG9rZW4gYXV0aG9yaXphdGlvbiBmYWlsZWRcIiBBTkQgZmlsZW5hbWU6XCJsb2dzL3NjcmVlbi1xLXN2Yy50eHRcIiIsImZpZWxkcyI6W10sIm9mZnNldCI6MCwidGltZWZyYW1lIjoiNjA0ODAwIiwiZ3JhcGhtb2RlIjoiY291bnQiLCJ0aW1lIjp7InVzZXJfaW50ZXJ2YWwiOjB9LCJzdGFtcCI6MTM5NTc2MTUxMDc2Nn0=

shows this started manifesting itself on March 23rd.

[Matt Riedemann (mriedem)]

I think this is a duplicate of bug 1282842.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/82834
Committed: https://git.openstack.org/cgit/openstack/python-neutronclient/commit/?id=54d15e7ec0a0347aa6243cb15502508cb6f1ea29
Submitter: Jenkins
Branch: master

commit 54d15e7ec0a0347aa6243cb15502508cb6f1ea29
Author: armando-migliaccio <email address hidden>
Date: Tue Mar 25 07:19:33 2014 -0700

    Show the unknown auth stratey in neutron client

    This can help unveil some useful information
    to be used during a troubleshooting process.

    Change-Id: I23657988fe31f5c552f17d6963de89c608273b44
    Closes-bug: 1297309

[Joe Gordon (jogo)]

Not seeing this in nova logs anymore, all logstash hits are for neutron in last 7 days.

[Matt Riedemann (mriedem)]

There was a nova fix here too: https://review.openstack.org/#/c/82851/

[Matt Riedemann (mriedem)]

The nova fix is on master (juno) and the neutronclient fix is not in a released neutronclient version yet (not in 2.3.4, the latest).

Is this worth backporting to stable/icehouse for nova? Then that could work with a newer released python-neutronclient whenever that happens?

[Openstack Gerrit (openstack-gerrit)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/90368

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/90368
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=f5c3330f79a511dbfa9064482fcccfd19da3dd35
Submitter: Jenkins
Branch: stable/icehouse

commit f5c3330f79a511dbfa9064482fcccfd19da3dd35
Author: armando-migliaccio <email address hidden>
Date: Tue Mar 25 08:43:31 2014 -0700

    Pass configured auth strategy to neutronclient

    When the token is invalid Nova emits a log trace about an
    unknown auth strategy (caused by neutron client). This is a
    red herring and is only masking the fact that the token was
    unable to be validated in the first place.

    Partial-bug: 1297309

    Change-Id: Ia3801f80c7ca18674fcf46b5270aa04f6c8c9331
    (cherry picked from commit fdd689c146713d18eb901d6f3ec986cdd11d13fe)