Without any OS_* environment variables set, the following command (which prompts for a password) fails with an Unauthorized error, even though the password is correct:
$ openstack --os-auth-url http://localhost:35357 --os-project-name demo --os-username demo --debug token issue
DEBUG: openstackclient.shell options: Namespace(auth_type='', auth_url='http://localhost:35357', cacert='', cloud='', debug=True, default_domain='default', deferred_help=False, domain_id='', domain_name='', endpoint='', endpoint_type='', insecure=None, log_file=None, os_compute_api_version='2', os_identity_api_version='2', os_image_api_version='1', os_network_api_version='2', os_object_api_version='1', os_project_id=None, os_project_name=None, os_volume_api_version='1', password='', project_domain_id='', project_domain_name='', project_id='', project_name='demo', region_name='', timing=False, token='', trust_id='', url='', user_domain_id='', user_domain_name='', user_id='', username='demo', verbose_level=3, verify=None)
DEBUG: openstackclient.shell defaults: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'api_timeout': None, 'baremetal_api_version': '1', 'image_api_use_tasks': False, 'endpoint_type': None, 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'disable_vendor_agent': {}}
DEBUG: openstackclient.shell cloud cfg: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'timing': False, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'verbose_level': 3, 'region_name': '', 'api_timeout': None, 'baremetal_api_version': '1', 'auth': {'username': 'demo', 'tenant_name': 'demo', 'project_name': 'demo', 'auth_url': 'http://localhost:35357'}, 'default_domain': 'default', 'image_api_use_tasks': False, 'endpoint_type': None, 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'deferred_help': False, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'debug': True, 'disable_vendor_agent': {}}
DEBUG: openstackclient.shell compute API version 2, cmd group openstack.compute.v2
DEBUG: openstackclient.shell network API version 2, cmd group openstack.network.v2
DEBUG: openstackclient.shell image API version 1, cmd group openstack.image.v1
DEBUG: openstackclient.shell volume API version 1, cmd group openstack.volume.v1
DEBUG: openstackclient.shell identity API version 2, cmd group openstack.identity.v2
DEBUG: openstackclient.shell object_store API version 1, cmd group openstack.object_store.v1
INFO: openstackclient.shell command: token issue -> openstackclient.identity.v2_0.token.IssueToken
DEBUG: openstackclient.api.auth Auth plugin osc_password selected
Password:
DEBUG: openstackclient.api.auth auth_type: osc_password
INFO: openstackclient.common.clientmanager Using auth plugin: osc_password
DEBUG: openstackclient.common.clientmanager Using parameters {'username': 'demo', 'tenant_name': 'demo', 'project_name': 'demo', 'auth_url': 'http://localhost:35357'}
DEBUG: openstackclient.common.clientmanager Get auth_ref
DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://localhost:35357 -H "Accept: application/json" -H "User-Agent: python-openstackclient"
INFO: requests.packages.urllib3.connectionpool Starting new HTTP connection (1): localhost
DEBUG: requests.packages.urllib3.connectionpool "GET / HTTP/1.1" 300 589
DEBUG: keystoneclient.session RESP: [300] date: Mon, 13 Jul 2015 06:33:07 GMT vary: X-Auth-Token content-length: 589 content-type: application/json connection: keep-alive
RESP BODY: {"versions": {"values": [{"status": "stable", "updated": "2015-03-30T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}], "id": "v3.4", "links": [{"href": "http://localhost:35357/v3/", "rel": "self"}]}, {"status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}], "id": "v2.0", "links": [{"href": "http://localhost:35357/v2.0/", "rel": "self"}, {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}]}]}}
DEBUG: openstackclient.api.auth_plugin Version URL updated: http://localhost:35357/v2.0/
DEBUG: keystoneclient.auth.identity.v2 Making authentication request to http://localhost:35357/v2.0/tokens
DEBUG: requests.packages.urllib3.connectionpool "POST /v2.0/tokens HTTP/1.1" 401 114
DEBUG: keystoneclient.session Request returned failure status: 401
ERROR: openstack The request you have made requires authentication. (HTTP 401) (Request-ID: req-ce7efb24-97db-478e-9aa8-8c832acdb73f)
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/cliff/app.py", line 307, in run_subcommand
self.prepare_to_run_command(cmd)
File "/usr/lib/python2.7/site-packages/openstackclient/shell.py", line 357, in prepare_to_run_command
self.client_manager.auth_ref
File "/usr/lib/python2.7/site-packages/openstackclient/common/clientmanager.py", line 184, in auth_ref
self._auth_ref = self.auth.get_auth_ref(self.session)
File "/usr/lib/python2.7/site-packages/keystoneclient/auth/identity/generic/base.py", line 176, in get_auth_ref
return self._plugin.get_auth_ref(session, **kwargs)
File "/usr/lib/python2.7/site-packages/keystoneclient/auth/identity/v2.py", line 78, in get_auth_ref
authenticated=False, log=False)
File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 497, in post
return self.request(url, 'POST', **kwargs)
File "/usr/lib/python2.7/site-packages/openstackclient/common/session.py", line 40, in request
resp = super(TimingSession, self).request(url, method, **kwargs)
File "/usr/lib/python2.7/site-packages/keystoneclient/utils.py", line 336, in inner
return func(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 397, in request
raise exceptions.from_response(resp, method, url)
Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-ce7efb24-97db-478e-9aa8-8c832acdb73f)
DEBUG: openstackclient.shell clean_up IssueToken: The request you have made requires authentication. (HTTP 401) (Request-ID: req-ce7efb24-97db-478e-9aa8-8c832acdb73f)
ERROR: openstackclient.shell Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/openstackclient/shell.py", line 152, in run
return super(OpenStackShell, self).run(argv)
File "/usr/lib/python2.7/site-packages/cliff/app.py", line 241, in run
result = self.run_subcommand(remainder)
File "/usr/lib/python2.7/site-packages/cliff/app.py", line 307, in run_subcommand
self.prepare_to_run_command(cmd)
File "/usr/lib/python2.7/site-packages/openstackclient/shell.py", line 357, in prepare_to_run_command
self.client_manager.auth_ref
File "/usr/lib/python2.7/site-packages/openstackclient/common/clientmanager.py", line 184, in auth_ref
self._auth_ref = self.auth.get_auth_ref(self.session)
File "/usr/lib/python2.7/site-packages/keystoneclient/auth/identity/generic/base.py", line 176, in get_auth_ref
return self._plugin.get_auth_ref(session, **kwargs)
File "/usr/lib/python2.7/site-packages/keystoneclient/auth/identity/v2.py", line 78, in get_auth_ref
authenticated=False, log=False)
File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 497, in post
return self.request(url, 'POST', **kwargs)
File "/usr/lib/python2.7/site-packages/openstackclient/common/session.py", line 40, in request
resp = super(TimingSession, self).request(url, method, **kwargs)
File "/usr/lib/python2.7/site-packages/keystoneclient/utils.py", line 336, in inner
return func(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 397, in request
raise exceptions.from_response(resp, method, url)
Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-ce7efb24-97db-478e-9aa8-8c832acdb73f)
However, if the password is supplied on the command-line, authentication works just fine:
$ openstack --os-auth-url http://localhost:35357 --os-project-name demo --os-username demo --os-password DEMO --debug token issue
DEBUG: openstackclient.shell options: Namespace(auth_type='', auth_url='http://localhost:35357', cacert='', cloud='', debug=True, default_domain='default', deferred_help=False, domain_id='', domain_name='', endpoint='', endpoint_type='', insecure=None, log_file=None, os_compute_api_version='2', os_identity_api_version='2', os_image_api_version='1', os_network_api_version='2', os_object_api_version='1', os_project_id=None, os_project_name=None, os_volume_api_version='1', password='DEMO', project_domain_id='', project_domain_name='', project_id='', project_name='demo', region_name='', timing=False, token='', trust_id='', url='', user_domain_id='', user_domain_name='', user_id='', username='demo', verbose_level=3, verify=None)
DEBUG: openstackclient.shell defaults: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'api_timeout': None, 'baremetal_api_version': '1', 'image_api_use_tasks': False, 'endpoint_type': None, 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'disable_vendor_agent': {}}
DEBUG: openstackclient.shell cloud cfg: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'timing': False, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'verbose_level': 3, 'region_name': '', 'api_timeout': None, 'baremetal_api_version': '1', 'auth': {'username': 'demo', 'tenant_name': 'demo', 'project_name': 'demo', 'password': 'DEMO', 'auth_url': 'http://localhost:35357'}, 'default_domain': 'default', 'image_api_use_tasks': False, 'endpoint_type': None, 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'deferred_help': False, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'debug': True, 'disable_vendor_agent': {}}
DEBUG: openstackclient.shell compute API version 2, cmd group openstack.compute.v2
DEBUG: openstackclient.shell network API version 2, cmd group openstack.network.v2
DEBUG: openstackclient.shell image API version 1, cmd group openstack.image.v1
DEBUG: openstackclient.shell volume API version 1, cmd group openstack.volume.v1
DEBUG: openstackclient.shell identity API version 2, cmd group openstack.identity.v2
DEBUG: openstackclient.shell object_store API version 1, cmd group openstack.object_store.v1
INFO: openstackclient.shell command: token issue -> openstackclient.identity.v2_0.token.IssueToken
DEBUG: openstackclient.api.auth Auth plugin osc_password selected
DEBUG: openstackclient.api.auth auth_type: osc_password
INFO: openstackclient.common.clientmanager Using auth plugin: osc_password
DEBUG: openstackclient.common.clientmanager Using parameters {'username': 'demo', 'tenant_name': 'demo', 'password': 'DEMO', 'project_name': 'demo', 'auth_url': 'http://localhost:35357'}
DEBUG: openstackclient.common.clientmanager Get auth_ref
DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://localhost:35357 -H "Accept: application/json" -H "User-Agent: python-openstackclient"
INFO: requests.packages.urllib3.connectionpool Starting new HTTP connection (1): localhost
DEBUG: requests.packages.urllib3.connectionpool "GET / HTTP/1.1" 300 589
DEBUG: keystoneclient.session RESP: [300] date: Mon, 13 Jul 2015 06:33:24 GMT vary: X-Auth-Token content-length: 589 content-type: application/json connection: keep-alive
RESP BODY: {"versions": {"values": [{"status": "stable", "updated": "2015-03-30T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}], "id": "v3.4", "links": [{"href": "http://localhost:35357/v3/", "rel": "self"}]}, {"status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}], "id": "v2.0", "links": [{"href": "http://localhost:35357/v2.0/", "rel": "self"}, {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}]}]}}
DEBUG: openstackclient.api.auth_plugin Version URL updated: http://localhost:35357/v2.0/
DEBUG: keystoneclient.auth.identity.v2 Making authentication request to http://localhost:35357/v2.0/tokens
DEBUG: requests.packages.urllib3.connectionpool "POST /v2.0/tokens HTTP/1.1" 200 799
DEBUG: openstackclient.identity.v2_0.token.IssueToken take_action(Namespace(columns=[], formatter='table', max_width=0, prefix='', variables=[]))
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | 2015-07-13T07:33:24Z |
| id | da9c02a3e20e45cb913614d793d23485 |
| project_id | c720135723fe441789388694876eb465 |
| user_id | 3a9dbcda7c184831ae2dd247c312e9b3 |
+------------+----------------------------------+
DEBUG: openstackclient.shell clean_up IssueToken:
The attached patch fixes the issue.
Fix proposed to branch: master /review. openstack. org/201134
Review: https:/