Heat returns Error 400 "Malformed Request" when PKIZ token without catalog is used

[Marcin Zbik]

It is impossible to create stack using API call like this:
curl -i -X POST -H 'X-Auth-Token: PKIZ_ROKEN_HERE' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"files": {}, "disable_rollback": true, "parameters": {}, "stack_name": "test_2", "environment": {}, "template": {"heat_template_version": "2013-05-23", "resources": {"cirros_scaling_group": {"type": "OS::Heat::AutoScalingGroup", "properties": {"min_size": 1, "desired_capacity": 2, "resource": {"type": "OS::Nova::Server", "properties": {"image": "cirros-0.3.2-x86_64", "flavor": "m1.small"}}, "max_size": 10}}}}}' http://localhost:8004/v1/014739cbf3b34b85b8b80a383a7bd3cc/stacks

when using PKIZ tokens created with ?nocatalog switch

TRACE from /var/log/heat/api.log

2014-12-17 11:22:32.574 16779 ERROR root [req-8a28b942-69e6-4a20-ae7a-8694c1062035 ] Exception handling resource: 'NoneType' object is unsubscriptable
Traceback (most recent call last):

  File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/dispatcher.py", line 134, in _dispatch_and_reply
    incoming.message))

  File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/dispatcher.py", line 177, in _dispatch
    return self._do_dispatch(endpoint, method, ctxt, args)

  File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/dispatcher.py", line 123, in _do_dispatch
    result = getattr(endpoint, method)(ctxt, **new_args)

  File "/usr/lib/python2.6/site-packages/heat/engine/service.py", line 69, in wrapped
    return func(self, ctx, *args, **kwargs)

  File "/usr/lib/python2.6/site-packages/heat/engine/service.py", line 639, in create_stack
    stack.store()

  File "/usr/lib/python2.6/site-packages/heat/engine/stack.py", line 341, in store
    trust_ctx = keystone.create_trust_context()

  File "/usr/lib/python2.6/site-packages/heat/common/heat_keystoneclient.py", line 279, in create_trust_context
    trustor_user_id = self.client.auth_ref.user_id

  File "/usr/lib/python2.6/site-packages/heat/common/heat_keystoneclient.py", line 121, in client
    self._client = self._v3_client_init()

  File "/usr/lib/python2.6/site-packages/heat/common/heat_keystoneclient.py", line 199, in _v3_client_init
    client = kc_v3.Client(**kwargs)

  File "/usr/lib/python2.6/site-packages/keystoneclient/v3/client.py", line 169, in __init__
    super(Client, self).__init__(**kwargs)

  File "/usr/lib/python2.6/site-packages/keystoneclient/utils.py", line 318, in inner
    return func(*args, **kwargs)

  File "/usr/lib/python2.6/site-packages/keystoneclient/httpclient.py", line 191, in __init__
    self.auth_url = self.auth_ref.auth_url[0]

TypeError: 'NoneType' object is unsubscriptable

Exact same command but with PKIZ token which contains catalog works flawlessly.

We are using trusts for heat:
deferred_auth_method=trusts
trusts_delegated_roles=heat_stack_owner

I think this is heat issue, because nova works well with tokens without catalog.

[Jamie Lennox (jamielennox)]

This is related to the ?nocatalog switch rather than the PKIZ tokens.

keystoneclient is trying to look at the catalog to figure out where to send its requests to - and there isn't one.

?nocatalog is pretty much only useful for auth_token middleware service tokens where they aren't going to have to contact anyone else.

[Jamie Lennox (jamielennox)]

Also nova works incorrectly because you are able to specify the URL that you want to use to talk to cinder and neutron via the config file therefore it ignores the values in the catalog. It really should be using the catalog as well.

[Steve Baker (steve-stevebaker)]

This looks like a bug, since heat should be fetching a catalog if it is not in the context.

[Angus Salkeld (asalkeld)]

https://github.com/openstack/heat/commit/2913f0ee1404d72ddbaa0d753601554fcbe217cd