security group list always uses identity admin endpoint

[Jan Klare]

Hi,

when 'openstackclient security group list' is called, the openstackclient always tries to use the identity admin endpoint to authenticate (https://github.com/openstack/python-openstackclient/blob/04d1fc69cfc1e6ba9ce6574cccb1b1890ef0050f/openstackclient/compute/v2/security_group.py#L163).
In our case this endpoint (the admin one) is not accessible for the specific user and therefore this functionality is not usable from the openstackclient (while it works perfectly from the novaclient or neutronclient). Would be great if this feature would also be usable from the openstackclient.

Cheers,
Jan

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/186385

[Terry Howe (thowe-g)]

A stack trace or more detail on the failure would help, but I get a 404 when I run that. I added the 404 to the ignore exceptions on that.

[Jan Klare (j-klare)]

Hi,

here a debug trace of what happens:

(openstack_clients)jklare@Jans-MacBook-Pro ~ $ openstack --debug security group list

DEBUG: openstackclient.shell options: Namespace(auth_type='', auth_url='https://public.de:4430/v2.0', cloud='', debug=True, deferred_help=False, domain_id='', domain_name='', endpoint='', insecure=None, log_file=None, os_cacert='', os_compute_api_version='2', os_default_domain='default', os_identity_api_version='2', os_image_api_version='1', os_n
etwork_api_version='2', os_object_api_version='1', os_project_id=None, os_project_name=None, os_volume_api_version='1', password='somepassword', project_domain_id='', project_domain_name='', project_id='', project_name='xion', region_name='RegionOne', timing=False, token='', trust_id='', url='', user_domain_id='', user_domain_name='', user_id='', username='j
.<email address hidden>', verbose_level=3, verify=None)
DEBUG: openstackclient.shell defaults: {'auth_type': 'osc_password', 'image_api_version': '1', 'compute_api_version': '2', 'database_api_version': '1.0', 'baremetal_api_version': '1', 'identity_api_version': '2', 'volume_api_version': '1', 'image_api_use_tasks': False, 'floating_ip_source': 'neutron', 'network_api_version': '2', 'object_api_version': '1'}
DEBUG: openstackclient.shell cloud cfg: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verbose_level': 3, 'region_name': 'RegionOne', 'baremetal_api_version': '1', 'auth': {'username': '<email address hidden>', 'password': 'somepassword', 'pr
oject_name': 'xion', 'auth_url': 'https://public.de:4430/v2.0'}, 'default_domain': 'default', 'image_api_use_tasks': False, 'floating_ip_source': 'neutron', 'timing': False, 'deferred_help': False, 'identity_api_version': '2', 'volume_api_version': '1', 'debug': True}
DEBUG: openstackclient.shell compute API version 2, cmd group openstack.compute.v2
DEBUG: openstackclient.shell network API version 2, cmd group openstack.network.v2
DEBUG: openstackclient.shell image API version 1, cmd group openstack.image.v1
DEBUG: openstackclient.shell volume API version 1, cmd group openstack.volume.v1
DEBUG: openstackclient.shell identity API version 2, cmd group openstack.identity.v2
DEBUG: openstackclient.shell object_store API version 1, cmd group openstack.object_store.v1
INFO: openstackclient.shell command: security group list -> openstackclient.compute.v2.security_group.ListSecurityGroup
DEBUG: openstackclient.api.auth Auth plugin osc_password selected
DEBUG: openstackclient.api.auth auth_type: osc_password
INFO: openstackclient.common.clientmanager Using auth plugin: osc_password
DEBUG: openstackclient.common.clientmanager Get auth_ref
DEBUG: keystoneclient.session REQ: curl -g -i -X GET https://public.de:4430/v2.0 -H "Accept: application/json" -H "User-Agent: python-openstackclient"
INFO: requests.packages.urllib3.connectionpool Starting new HTTPS connection (1): public.de
DEBUG: requests.packages.urllib3.connectionpool "GET /v2.0 HTTP/1.1" 200 629
DEBUG: keystoneclient.session RESP: [200] content-length: 629 vary: X-Auth-Token keep-alive: timeout=5, max=100 connection: Keep...

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/186385
Committed: https://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=b2cf651100b2a6dc1b934b86390eff94ef9f8fdc
Submitter: Jenkins
Branch: master

commit b2cf651100b2a6dc1b934b86390eff94ef9f8fdc
Author: TerryHowe <email address hidden>
Date: Thu May 28 07:27:24 2015 -0600

    Fix security group list command

    Security group list command tries to get a project list and
    this may fail with a multitude of exceptions including but
    not limited to 401, 404, ConnectionRefused and EndpointNotFound.
    Rather than try to capture every possibility, this patch just
    catches the base class. Converting project ids to names is
    less important than having a working security group list command.

    Change-Id: I68214d2680bad907f9d04ad3ca2f62cf3feee028
    Closes-Bug: #1459629