cron trigger failed on Authorization failed in stack-update when using resource-signal

[Limor Stotland]

step for reproduce:
1) create stack with the next template:
heat_template_version: 2013-05-23

resources:

  noop_wf:
    type: OS::Mistral::Workflow
    properties:
      name: "noop_wf"
      type: direct
      tasks:
        - name: nothing
          action: std.noop
Api: heat stack-create -f stak1.yaml stack1
2) create stack with the next template:
heat_template_version: 2013-05-23

resources:
  scaling_wf:
    type: OS::Mistral::Workflow
    properties:
        name: { "list_join": ["_", [ "check_stack_state_scaling", { get_param: "OS::stack_name" } ]] }
        type: direct
        input:
          stack_id: {STACK_ID_FROM_1}
          scaleout_template: { get_file: f1 }
        tasks:
          - name: get_stack_and_check_status
            action: heat.stacks_get stack_id=<% $.stack_id %>
            publish:
              status: <% $.get_stack_and_check_status.stack_status %>
          - name: update_stack
            action: heat.stacks_update
            input:
              stack_id: <% $.stack_id %>
              template: <% $.scaleout_template %>
              existing: true
            publish:
              stack_update_response: <% $.update_stack %>
Api: heat stack-create -f stak2.yaml stack2

3)run heat resource-signal stack2 scaling_wf

when signaling to scaling_wf stack update will be triggered from mistral.

This bug happened because : security.add_trust_id(values) when creating cron trigger(mistral/services/triggers.py:108).
In some point in this step (/usr/local/lib/python2.7/dist-packages/keystoneclient/v3/client.py:226) mistral ask as the user for new token from keystone. But it use an auth token that is a trust between heat and the user (for example admin) and then keystone return Authorization failed: You are not authorized to perform the requested action. (HTTP 403)

[anil (anil-setti)]

hi Limor,

Can you provide scaleout_template(f1 in your case) to reproduce the bug