can not login to Dashboard on devstack

[Pavlo Shchelokovskyy]

Using fresh master of devstack and fresh masters of all services.

When I try to login into the Dashboard, I do not leave the login page (as if nothing happened, no error displayed). Strangely the screen log for horizon service in devstack displays

[Wed Jun 18 10:09:46.533780 2014] [:error] [pid 24605:tid 139679844230912] INFO:urllib3.connectionpool:Starting new HTTP connection (1): 192.168.122.162
[Wed Jun 18 10:09:46.535449 2014] [:error] [pid 24605:tid 139679844230912] DEBUG:urllib3.connectionpool:Setting read timeout to None
[Wed Jun 18 10:09:46.623021 2014] [:error] [pid 24605:tid 139679844230912] DEBUG:urllib3.connectionpool:"POST /v2.0/tokens HTTP/1.1" 200 1352
[Wed Jun 18 10:09:46.633130 2014] [:error] [pid 24605:tid 139679844230912] INFO:urllib3.connectionpool:Starting new HTTP connection (1): 192.168.122.162
[Wed Jun 18 10:09:46.633459 2014] [:error] [pid 24605:tid 139679844230912] DEBUG:urllib3.connectionpool:Setting read timeout to None
[Wed Jun 18 10:09:46.652504 2014] [:error] [pid 24605:tid 139679844230912] DEBUG:urllib3.connectionpool:"GET /v2.0/tenants HTTP/1.1" 200 244
[Wed Jun 18 10:09:46.654398 2014] [:error] [pid 24605:tid 139679844230912] INFO:urllib3.connectionpool:Starting new HTTP connection (1): 192.168.122.162
[Wed Jun 18 10:09:46.654701 2014] [:error] [pid 24605:tid 139679844230912] DEBUG:urllib3.connectionpool:Setting read timeout to None
[Wed Jun 18 10:09:46.750292 2014] [:error] [pid 24605:tid 139679844230912] DEBUG:urllib3.connectionpool:"POST /v2.0/tokens HTTP/1.1" 200 7457
[Wed Jun 18 10:09:46.753146 2014] [:error] [pid 24605:tid 139679844230912] Login successful for user "demo".
[Wed Jun 18 10:09:46.753354 2014] [:error] [pid 24605:tid 139679844230912] DeprecationWarning: check_for_test_cookie is deprecated; ensure your login view is CSRF-protected.
[Wed Jun 18 10:09:46.753396 2014] [:error] [pid 24605:tid 139679844230912] WARNING:py.warnings:DeprecationWarning: check_for_test_cookie is deprecated; ensure your login view is CSRF-protected.

Note the "Login successful" line. All the OS cli clients work as expected with the same credentials I use to login.

[Ana Krivokapić (akrivoka)]

I ran git bisect on keystone and turns out the culprit is the commit ed13c0e5d4ceb55a1180e2818a425dc6c60420a9 (before that one logging into Horizon works fine).

[Ana Krivokapić (akrivoka)]

Sorry, I pasted a wrong hash in the previous comment. This is the keystone commit which is at fault:

21bf6c7fdae14a5e2143c3bad4914e30c982f5d4 (Default to PKIZ tokens)

[Adam Young (ayoung)]

Problem is in django-openstack-auth: hardcoded to only deal with PKI tokens (is_asn1) and not PKIZ tokens, so it doesn't know to hash them

[Morgan Fainberg (mdrnstm)]

This isn't a bug with Keystone, it was raised by keystone changing the token format to not match the is_asn1_token check. Because this check failed the length of the token id exceeded the key size limitation for the session. The fix is to not check if the token is ASN1 before hashing, but to hash if the token length is > maximuma llowable size.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/101089

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/101360

[OpenStack Infra (hudson-openstack)]

Change abandoned by ayoung (<email address hidden>) on branch: master
Review: https://review.openstack.org/101360
Reason: Duplicate

[Julie Pichon (jpichon)]

A temporary workaround while waiting for the patch to land and be released is to set the provider back to keystone.token.providers.pki.Provider or keystone.token.providers.uuid.Provider, in the Keystone.conf for the provider setting: https://github.com/openstack/keystone/blob/e03c7af51c/etc/keystone.conf.sample#L1314 (thanks to Morgan for the helpful tips!). I tested with PKI and UUID and it does resolve the login issue.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/101089
Committed: https://git.openstack.org/cgit/openstack/django_openstack_auth/commit/?id=ff6188c7fe41ec2eb38b7159758a5f1e4da401e4
Submitter: Jenkins
Branch: master

commit ff6188c7fe41ec2eb38b7159758a5f1e4da401e4
Author: Adam Young <email address hidden>
Date: Wed Jun 18 23:20:02 2014 -0400

    Hash the token id if it is over a maximum length

    Instead of exclusively hashing the token id based on if the token is
    ASN1, hash the id if it exceeds the maximum size allowed within the
    session. Keystone has allowed more than simple PKI and UUID tokens so
    the is_asn1_token check will not catch all cases.

    Closes-Bug: 1331406

    Change-Id: I7891eb3fb35a10926ac16829eed0ff8c306f2661

[David Lyle (david-lyle)]

While this effects Horizon the problem was in django_openstack_auth and a fix has been released