V2 Endpoint creation with missing region returns 500

[Jorge Munoz]

Keystone returns a 500 if optional attribute region is not passed in on endpoint creation.

Curl:
export SERVICE_ID=1234
export PUBLIC_URL='https://publicurl/v1'
export ADMIN_URL='https://adminurl/v1'
export INTERNAL_URL='https://internalurl/v1'

#Create endpoint
curl -X POST $ENDPOINT/v2.0/endpoints -d '{ "endpoint": {"service_id": "'$SERVICE_ID'", "publicurl": "'$PUBLIC_URL'", "adminurl": "'$ADMIN_URL'", "internalurl": "'$INTERNAL_URL'"}}' -H "Content-Type: application/json" -H "Accept: application/json" -H "X-Auth-Token: $ADMIN_TOKEN" -k -v | json

Response:
< HTTP/1.1 500 Internal Server Error [264/1952]
< Vary: X-Auth-Token
< Content-Type: application/json
< Content-Length: 143
< X-Openstack-Request-Id: req-f0006f4e-25b5-47ae-acb8-5072967b0778
< Date: Mon, 14 Mar 2016 21:24:48 GMT
<
{ [data not shown]
100 348 100 143 100 205 2097 3007 --:--:-- --:--:-- --:--:-- 3059
* Connection #0 to host 127.0.0.1 left intact
{
    "error": {
        "code": 500,
        "message": "An unexpected error prevented the server from fulfilling your request.",
        "title": "Internal Server Error"
    }
}

Attempting to pop attribute that does not exist.
https://github.com/openstack/keystone/blob/a2a06d05310ab9bd8d0360a59f769563a1393e03/keystone/catalog/controllers.py#L180

[Steve Martinelli (stevemar)]

logs ? curl request / response?

[Prosunjit Biswas (prosun-csedu)]

I tried following to regenerate the bug:

1. Create a redundant Identity service
2. Create endpoints (admin url, public url and internal url) with region unspecified.

I found that it creates endpoints with region "None". So, I think, the bug does not recur at least for the "openstack" client.

-------------------------------Details---------------------------------

I am using openstack client and Identity API v2.0. Following are details.

commands:

##Create a redundant Identity service##
 openstack service create identity --name redundant-keystone --description "this is for experiment"
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | this is for experiment |
| enabled | True |
| id | 80ac66cdbf374892a7c6a0a8ab42db44 |
| name | redundant-keystone |
| type | identity |
+-------------+----------------------------------+

##Create endpoints with region unspecified ##
openstack endpoint create 80ac66cdbf374892a7c6a0a8ab42db44 --publicurl http://10.0.0.52:1000/v2.0 --adminurl http://10.0.0.52:2000/v2.0 --internalurl http://10.0.0.52:3000/v2.0

+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| adminurl | http://10.0.0.52:2000/v2.0 |
| id | 1f688eca7f774d348599412b74fe7ef5 |
| internalurl | http://10.0.0.52:3000/v2.0 |
| publicurl | http://10.0.0.52:1000/v2.0 |
| region | None |
| service_id | 80ac66cdbf374892a7c6a0a8ab42db44 |
| service_name | redundant-keystone |
| service_type | identity |
+--------------+----------------------------------+

Following is my variables for: env | grep OS

OS_REGION_NAME=RegionOne
OS_PROJECT_NAME=admin
OS_IDENTITY_API_VERSION=2.0
OS_PASSWORD=admin
OS_AUTH_URL=http://10.0.0.52:5000/v2.0
OS_USERNAME=admin
OS_TENANT_NAME=admin
OS_VOLUME_API_VERSION=2
OS_NO_CACHE=1

[Prosunjit Biswas (prosun-csedu)]

 I am trying to understand the curl command to regenerate the bug.

I wonder why $ENDPOINT/v2.0/endpoints (as specified in the bug description) is the resource URL for generating endpoints.

As I can see in OpenStack API Complete Reference[1], only Identity API v2.0 extensions[2] specifies creation of endpoints. It specifies following two resource urls for creating endpoints.

(a) /v2.0/tenants/​{tenantId}​/OS-KSCATALOG/endpoints
(b) /v2.0/OS-KSCATALOG/endpointTemplates

Then how we get $ENDPOINT/v2.0/endpoints for creating endpoints in V2.0?

Refs:
[1] http://developer.openstack.org/api-ref-identity-v2-ext.html
[2] http://developer.openstack.org/api-ref-identity-v2-ext.html

[Kanika Singh (kanikasingh-1490)]

If you debug endpoint-create command:

openstack --debug endpoint create 65caa9b20ec04672bdfbce67820ec7f3 --publicurl http://10.0.32.37:5000/v2.0

We can see that cinder client generates the follwing curl command:

curl -g -i -X POST http://192.168.52.131:35357/v2.0/endpoints -H "User-Agent: python-keystoneclient" -H "Content-Type: application/json" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}67fc8dbb979442740597bda6b4df9465e0960cc3" -d '{"endpoint": {"adminurl": null, "service_id": "65caa9b20ec04672bdfbce67820ec7f3", "region": null, "internalurl": null, "publicurl": "http://10.0.32.37:5000/v2.0"}}'

In this curl we have "region" set to null. Try to execute this curl without specifying "region". We get the following error:

HTTP/1.1 500 Internal Server Error
Date: Fri, 01 Apr 2016 10:41:30 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux)
Vary: X-Auth-Token
x-openstack-request-id: req-3e2cdd75-69ad-4cfb-a900-c8e87fcc2141
Content-Length: 143
Connection: close

[Prosunjit Biswas (prosun-csedu)]

This is a nice explanation Kanika Singh.

I wonder why this API URL (/v2.0/endpoints in this case) is not listed in official Identity API v2.0[1] or its extensions[2] or Identity Admin API 2.0 [3]?

Refs:
[1] http://developer.openstack.org/api-ref-identity-v2.html
[2] http://developer.openstack.org/api-ref-identity-v2-ext.html
[3] http://developer.openstack.org/api-ref-identity-admin-v2.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/304489

[Srushti Gadadare (srushti-gadadare)]

Is anyone working on this bug?

[Kanika Singh (kanikasingh-1490)]

Yes. Fix has been proposed. I am writing the test case.

[Steve Martinelli (stevemar)]

link to patch: https://review.openstack.org/#/c/304489/

[Lance Bragstad (lbragstad)]

Unassigning so that if someone else has bandwidth to pick this up, they can.

[Lance Bragstad (lbragstad)]

Triaging this as Low since it is a bug within v2.0 - which is deprecated.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/304489
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=3039e6c4bc9b1d721ecd2dc95d949072866ec8f1
Submitter: Jenkins
Branch: master

commit 3039e6c4bc9b1d721ecd2dc95d949072866ec8f1
Author: Kanika Singh <email address hidden>
Date: Tue Apr 12 15:18:30 2016 +0530

    Handling of 'region' parameter as None

    In V2 Endpoint creation it returns 500 error due to missing
    'region'. So, changed the way of fetching the same parameter to handle
    None case.

    Change-Id: I5c9ef206193072da73d3990d5f77003124db8265
    Closes-Bug: #1557166

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 11.0.0.0b3 development milestone.