python-openstackclient

authentication fails when openstackclient prompts for a password

Bug #1473862 reported by Benoît Knecht
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
python-openstackclient
Fix Released
High
Terry Howe
python-openstackclient 1.6.0 "1.6.0"

Bug Description

Without any OS_* environment variables set, the following command (which prompts for a password) fails with an Unauthorized error, even though the password is correct:

$ openstack --os-auth-url http://localhost:35357 --os-project-name demo --os-username demo --debug token issue
DEBUG: openstackclient.shell options: Namespace(auth_type='', auth_url='http://localhost:35357', cacert='', cloud='', debug=True, default_domain='default', deferred_help=False, domain_id='', domain_name='', endpoint='', endpoint_type='', insecure=None, log_file=None, os_compute_api_version='2', os_identity_api_version='2', os_image_api_version='1', os_network_api_version='2', os_object_api_version='1', os_project_id=None, os_project_name=None, os_volume_api_version='1', password='', project_domain_id='', project_domain_name='', project_id='', project_name='demo', region_name='', timing=False, token='', trust_id='', url='', user_domain_id='', user_domain_name='', user_id='', username='demo', verbose_level=3, verify=None)
DEBUG: openstackclient.shell defaults: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'api_timeout': None, 'baremetal_api_version': '1', 'image_api_use_tasks': False, 'endpoint_type': None, 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'disable_vendor_agent': {}}
DEBUG: openstackclient.shell cloud cfg: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'timing': False, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'verbose_level': 3, 'region_name': '', 'api_timeout': None, 'baremetal_api_version': '1', 'auth': {'username': 'demo', 'tenant_name': 'demo', 'project_name': 'demo', 'auth_url': 'http://localhost:35357'}, 'default_domain': 'default', 'image_api_use_tasks': False, 'endpoint_type': None, 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'deferred_help': False, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'debug': True, 'disable_vendor_agent': {}}
DEBUG: openstackclient.shell compute API version 2, cmd group openstack.compute.v2
DEBUG: openstackclient.shell network API version 2, cmd group openstack.network.v2
DEBUG: openstackclient.shell image API version 1, cmd group openstack.image.v1
DEBUG: openstackclient.shell volume API version 1, cmd group openstack.volume.v1
DEBUG: openstackclient.shell identity API version 2, cmd group openstack.identity.v2
DEBUG: openstackclient.shell object_store API version 1, cmd group openstack.object_store.v1
INFO: openstackclient.shell command: token issue -> openstackclient.identity.v2_0.token.IssueToken
DEBUG: openstackclient.api.auth Auth plugin osc_password selected
Password:
DEBUG: openstackclient.api.auth auth_type: osc_password
INFO: openstackclient.common.clientmanager Using auth plugin: osc_password
DEBUG: openstackclient.common.clientmanager Using parameters {'username': 'demo', 'tenant_name': 'demo', 'project_name': 'demo', 'auth_url': 'http://localhost:35357'}
DEBUG: openstackclient.common.clientmanager Get auth_ref
DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://localhost:35357 -H "Accept: application/json" -H "User-Agent: python-openstackclient"
INFO: requests.packages.urllib3.connectionpool Starting new HTTP connection (1): localhost
DEBUG: requests.packages.urllib3.connectionpool "GET / HTTP/1.1" 300 589
DEBUG: keystoneclient.session RESP: [300] date: Mon, 13 Jul 2015 06:33:07 GMT vary: X-Auth-Token content-length: 589 content-type: application/json connection: keep-alive
RESP BODY: {"versions": {"values": [{"status": "stable", "updated": "2015-03-30T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}], "id": "v3.4", "links": [{"href": "http://localhost:35357/v3/", "rel": "self"}]}, {"status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}], "id": "v2.0", "links": [{"href": "http://localhost:35357/v2.0/", "rel": "self"}, {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}]}]}}

DEBUG: openstackclient.api.auth_plugin Version URL updated: http://localhost:35357/v2.0/
DEBUG: keystoneclient.auth.identity.v2 Making authentication request to http://localhost:35357/v2.0/tokens
DEBUG: requests.packages.urllib3.connectionpool "POST /v2.0/tokens HTTP/1.1" 401 114
DEBUG: keystoneclient.session Request returned failure status: 401
ERROR: openstack The request you have made requires authentication. (HTTP 401) (Request-ID: req-ce7efb24-97db-478e-9aa8-8c832acdb73f)
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/cliff/app.py", line 307, in run_subcommand
    self.prepare_to_run_command(cmd)
  File "/usr/lib/python2.7/site-packages/openstackclient/shell.py", line 357, in prepare_to_run_command
    self.client_manager.auth_ref
  File "/usr/lib/python2.7/site-packages/openstackclient/common/clientmanager.py", line 184, in auth_ref
    self._auth_ref = self.auth.get_auth_ref(self.session)
  File "/usr/lib/python2.7/site-packages/keystoneclient/auth/identity/generic/base.py", line 176, in get_auth_ref
    return self._plugin.get_auth_ref(session, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/auth/identity/v2.py", line 78, in get_auth_ref
    authenticated=False, log=False)
  File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 497, in post
    return self.request(url, 'POST', **kwargs)
  File "/usr/lib/python2.7/site-packages/openstackclient/common/session.py", line 40, in request
    resp = super(TimingSession, self).request(url, method, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/utils.py", line 336, in inner
    return func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 397, in request
    raise exceptions.from_response(resp, method, url)
Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-ce7efb24-97db-478e-9aa8-8c832acdb73f)
DEBUG: openstackclient.shell clean_up IssueToken: The request you have made requires authentication. (HTTP 401) (Request-ID: req-ce7efb24-97db-478e-9aa8-8c832acdb73f)
ERROR: openstackclient.shell Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/openstackclient/shell.py", line 152, in run
    return super(OpenStackShell, self).run(argv)
  File "/usr/lib/python2.7/site-packages/cliff/app.py", line 241, in run
    result = self.run_subcommand(remainder)
  File "/usr/lib/python2.7/site-packages/cliff/app.py", line 307, in run_subcommand
    self.prepare_to_run_command(cmd)
  File "/usr/lib/python2.7/site-packages/openstackclient/shell.py", line 357, in prepare_to_run_command
    self.client_manager.auth_ref
  File "/usr/lib/python2.7/site-packages/openstackclient/common/clientmanager.py", line 184, in auth_ref
    self._auth_ref = self.auth.get_auth_ref(self.session)
  File "/usr/lib/python2.7/site-packages/keystoneclient/auth/identity/generic/base.py", line 176, in get_auth_ref
    return self._plugin.get_auth_ref(session, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/auth/identity/v2.py", line 78, in get_auth_ref
    authenticated=False, log=False)
  File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 497, in post
    return self.request(url, 'POST', **kwargs)
  File "/usr/lib/python2.7/site-packages/openstackclient/common/session.py", line 40, in request
    resp = super(TimingSession, self).request(url, method, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/utils.py", line 336, in inner
    return func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 397, in request
    raise exceptions.from_response(resp, method, url)
Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-ce7efb24-97db-478e-9aa8-8c832acdb73f)

However, if the password is supplied on the command-line, authentication works just fine:

$ openstack --os-auth-url http://localhost:35357 --os-project-name demo --os-username demo --os-password DEMO --debug token issue
DEBUG: openstackclient.shell options: Namespace(auth_type='', auth_url='http://localhost:35357', cacert='', cloud='', debug=True, default_domain='default', deferred_help=False, domain_id='', domain_name='', endpoint='', endpoint_type='', insecure=None, log_file=None, os_compute_api_version='2', os_identity_api_version='2', os_image_api_version='1', os_network_api_version='2', os_object_api_version='1', os_project_id=None, os_project_name=None, os_volume_api_version='1', password='DEMO', project_domain_id='', project_domain_name='', project_id='', project_name='demo', region_name='', timing=False, token='', trust_id='', url='', user_domain_id='', user_domain_name='', user_id='', username='demo', verbose_level=3, verify=None)
DEBUG: openstackclient.shell defaults: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'api_timeout': None, 'baremetal_api_version': '1', 'image_api_use_tasks': False, 'endpoint_type': None, 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'disable_vendor_agent': {}}
DEBUG: openstackclient.shell cloud cfg: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'timing': False, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'verbose_level': 3, 'region_name': '', 'api_timeout': None, 'baremetal_api_version': '1', 'auth': {'username': 'demo', 'tenant_name': 'demo', 'project_name': 'demo', 'password': 'DEMO', 'auth_url': 'http://localhost:35357'}, 'default_domain': 'default', 'image_api_use_tasks': False, 'endpoint_type': None, 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'deferred_help': False, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'debug': True, 'disable_vendor_agent': {}}
DEBUG: openstackclient.shell compute API version 2, cmd group openstack.compute.v2
DEBUG: openstackclient.shell network API version 2, cmd group openstack.network.v2
DEBUG: openstackclient.shell image API version 1, cmd group openstack.image.v1
DEBUG: openstackclient.shell volume API version 1, cmd group openstack.volume.v1
DEBUG: openstackclient.shell identity API version 2, cmd group openstack.identity.v2
DEBUG: openstackclient.shell object_store API version 1, cmd group openstack.object_store.v1
INFO: openstackclient.shell command: token issue -> openstackclient.identity.v2_0.token.IssueToken
DEBUG: openstackclient.api.auth Auth plugin osc_password selected
DEBUG: openstackclient.api.auth auth_type: osc_password
INFO: openstackclient.common.clientmanager Using auth plugin: osc_password
DEBUG: openstackclient.common.clientmanager Using parameters {'username': 'demo', 'tenant_name': 'demo', 'password': 'DEMO', 'project_name': 'demo', 'auth_url': 'http://localhost:35357'}
DEBUG: openstackclient.common.clientmanager Get auth_ref
DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://localhost:35357 -H "Accept: application/json" -H "User-Agent: python-openstackclient"
INFO: requests.packages.urllib3.connectionpool Starting new HTTP connection (1): localhost
DEBUG: requests.packages.urllib3.connectionpool "GET / HTTP/1.1" 300 589
DEBUG: keystoneclient.session RESP: [300] date: Mon, 13 Jul 2015 06:33:24 GMT vary: X-Auth-Token content-length: 589 content-type: application/json connection: keep-alive
RESP BODY: {"versions": {"values": [{"status": "stable", "updated": "2015-03-30T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}], "id": "v3.4", "links": [{"href": "http://localhost:35357/v3/", "rel": "self"}]}, {"status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}], "id": "v2.0", "links": [{"href": "http://localhost:35357/v2.0/", "rel": "self"}, {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}]}]}}

DEBUG: openstackclient.api.auth_plugin Version URL updated: http://localhost:35357/v2.0/
DEBUG: keystoneclient.auth.identity.v2 Making authentication request to http://localhost:35357/v2.0/tokens
DEBUG: requests.packages.urllib3.connectionpool "POST /v2.0/tokens HTTP/1.1" 200 799
DEBUG: openstackclient.identity.v2_0.token.IssueToken take_action(Namespace(columns=[], formatter='table', max_width=0, prefix='', variables=[]))
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | 2015-07-13T07:33:24Z |
| id | da9c02a3e20e45cb913614d793d23485 |
| project_id | c720135723fe441789388694876eb465 |
| user_id | 3a9dbcda7c184831ae2dd247c312e9b3 |
+------------+----------------------------------+
DEBUG: openstackclient.shell clean_up IssueToken:

The attached patch fixes the issue.

Revision history for this message
Benoît Knecht (benoit-knecht) wrote :
Terry Howe (thowe-g)
Changed in python-openstackclient:
assignee: nobody → Terry Howe (thowe-g)
status: New → Confirmed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to python-openstackclient (master)

Fix proposed to branch: master
Review: https://review.openstack.org/201134

Changed in python-openstackclient:
status: Confirmed → In Progress
Revision history for this message
Steve Martinelli (stevemar) wrote :

What version of openstackclient was used? I recall we had an issue with this just after our 1.0 release

Revision history for this message
Terry Howe (thowe-g) wrote :

I was able to reproduce the problem on master.

Revision history for this message
Steve Martinelli (stevemar) wrote :

cool, thanks for trying it terry

Changed in python-openstackclient:
importance: Undecided → High
Revision history for this message
Benoît Knecht (benoit-knecht) wrote :

Yes, I used master as well, sorry for not saying so in the report.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-openstackclient (master)

Reviewed: https://review.openstack.org/201134
Committed: https://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=ef0cf00b3367b3656c94b4972bc757ee0026876d
Submitter: Jenkins
Branch: master

commit ef0cf00b3367b3656c94b4972bc757ee0026876d
Author: TerryHowe <email address hidden>
Date: Mon Jul 13 07:44:24 2015 -0600

    Fix interactive password prompt

    Change-Id: Ie0e7a9cd6016b5c646a111a76e8372e10602a25c
    Closes-Bug: #1473862

Changed in python-openstackclient:
status: In Progress → Fix Committed
Doug Hellmann (doug-hellmann)
Changed in python-openstackclient:
milestone: none → 1.6.0
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.