heat integrationtests should support keystone v3

[Guoping Jia]

Heat integrationtests is running by default using keystone v2.0. If running the tests using keystone v3, all tests fail with Authorizationfailure (below a sample tracestack of a failed test):

heat_integrationtests.functional.test_template_validate.StackTemplateValidateTest.test_template_validate_nested_off
-------------------------------------------------------------------------------------------------------------------

Captured traceback:
~~~~~~~~~~~~~~~~~~~
    Traceback (most recent call last):
      File "/home/stack/guoping/heat-scripts/heat-testcase/hos-qa-tests/heat/testcase/heat_integrations/heat_integrationtests/functional/functional_base.py", line 19, in setUp
        super(FunctionalTestsBase, self).setUp()
      File "/home/stack/guoping/heat-scripts/heat-testcase/hos-qa-tests/heat/testcase/heat_integrations/heat_integrationtests/common/test.py", line 84, in setUp
        self.manager = clients.ClientManager(self.conf)
      File "/home/stack/guoping/heat-scripts/heat-testcase/hos-qa-tests/heat/testcase/heat_integrations/heat_integrationtests/common/clients.py", line 40, in __init__
        self.identity_client = self._get_identity_client()
      File "/home/stack/guoping/heat-scripts/heat-testcase/hos-qa-tests/heat/testcase/heat_integrations/heat_integrationtests/common/clients.py", line 80, in _get_identity_client
        cacert=self.ca_file)
      File "/home/stack/guoping/heat-scripts/heat-testcase/hos-qa-tests/heat/testcase/heat_integrations/.tox/integration/local/lib/python2.7/site-packages/keystoneclient/v2_0/client.py", line 166, in __init__
        self.authenticate()
      File "/home/stack/guoping/heat-scripts/heat-testcase/hos-qa-tests/heat/testcase/heat_integrations/.tox/integration/local/lib/python2.7/site-packages/positional/__init__.py", line 94, in inner
        return func(*args, **kwargs)
      File "/home/stack/guoping/heat-scripts/heat-testcase/hos-qa-tests/heat/testcase/heat_integrations/.tox/integration/local/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 584, in authenticate
        resp = self.get_raw_token_from_identity_service(**kwargs)
      File "/home/stack/guoping/heat-scripts/heat-testcase/hos-qa-tests/heat/testcase/heat_integrations/.tox/integration/local/lib/python2.7/site-packages/keystoneclient/v2_0/client.py", line 210, in get_raw_token_from_identity_service
        _("Authorization Failed: %s") % e)
    keystoneauth1.exceptions.auth.AuthorizationFailure: Authorization Failed: The resource could not be found. (HTTP 404) (Request-ID: req-c0a3a8ee-4c4b-49c3-ab4c-b441aa2e7b54)

[Rabi Mishra (rabi)]

This seems to be working fine with latest devstack and v3 enabled.

Do you have the following options in your heat_integrationtests.conf?

# Full URI of the OpenStack Identity API (Keystone) (string value)
auth_url = http://x.x.x.x:5000/v3

# User/project domain name, if keystone v3 auth_urlis used (string value)
domain_name = default

if not specified, it picks up OS_AUTH_URL env variable for the auth_url and uses 'default' as the domain name?

By any chance your OS_AUTH_URL pointing to v2.0 or you've the wrong options set in heat_integrationtests.conf?

[Guoping Jia (guoping-jia)]

Thank you for your comments.

This issue actually is from stable/liberty. I did not specify the auth_url in the heat_integrationtests.conf, however, the osrc has the following environments defined:

export OS_AUTH_URL=https://x.x.x.x:5000/v3
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default

Did you ever try the keystone v3 against stable/liberty ? There is no user/project domain name options in the heat_integrationtests.conf .

[Rabi Mishra (rabi)]

I don't think the patches are backported to stable/liberty yet. If you want, you can try with these two patches in your setup.

https://review.openstack.org/#/c/274159/
https://review.openstack.org/#/c/295373/

[Guoping Jia (guoping-jia)]

Thanks Rabi,

I definitely will have a try those 2 patches. Is there any plan to back-port them to stable/liberty ?

[Guoping Jia (guoping-jia)]

After merged with those 2 patches, the v3 auth support works for heat integration testing.

I've been started back-porting those patches into our product that's stable/liberty based.

Let me know if you want me to back port those patches in to stabl/liberty.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/295373
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=55713b94bf31409b4b0f8d3ba9ea9bc3b598f34a
Submitter: Jenkins
Branch: master

commit 55713b94bf31409b4b0f8d3ba9ea9bc3b598f34a
Author: Rabi Mishra <email address hidden>
Date: Mon Mar 21 21:09:20 2016 +0530

    Use domain env variables as defaults

    Use OS_USER_DOMAIN_NAME and OS_PROJECT_DOMAIN_NAME
    env variables as the defaults for keystone v3 in
    integration tests.

    Change-Id: Idb58431cf95988a91504ccac5116e0f8e339578f
    Closes-Bug: #1560032

[Anant Patil (ananta)]

I have squashed the changes https://review.openstack.org/#/c/274159/ and https://review.openstack.org/#/c/295373/ into one and back-ported to stable/liberty: https://review.openstack.org/#/c/296979/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/296979
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=6de960c37ef217464dfe19d683ea6dad228e841b
Submitter: Jenkins
Branch: stable/liberty

commit 6de960c37ef217464dfe19d683ea6dad228e841b
Author: Rabi Mishra <email address hidden>
Date: Fri Jan 29 22:23:21 2016 +0530

    Accommodate v2 and v3 auth for integration tests

    This patch has two reviews:

    1. devstack has moved default Keystone API version to v3[1].
    [1] https://github.com/openstack-dev/devstack/commit/f4ce44bf3fbf06e53c2ae3ec6aa4996831cf4605
    Though the above patch has been reverted, this would help
    if devstack removes v2 support in the future.

    2. use domain env variables as defaults.
    Use OS_USER_DOMAIN_NAME and OS_PROJECT_DOMAIN_NAME
    env variables as the defaults for keystone v3 in
    integration tests.

    Squash of commit e80d27213cf4489aeeda48e2bdb5a890d8b56433
    and commit 55713b94bf31409b4b0f8d3ba9ea9bc3b598f34a

    Closes-Bug: #1539692
    Closes-Bug: #1560032

    Change-Id: I393750d00b3712a015e48a3cf38ab5f95bb61dae

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/heat 7.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/heat 5.0.2 release.