openstackclient fails with --os-token and --os-url

[Alfredo Moralejo]

Since https://github.com/openstack/python-openstackclient/commit/6ae0d2e8a54fd5139e63a990ab4bdce634e73c5e was merged, authentication using admin token is failing.

Test:

export OS_IMAGE_API_VERSION=1
export OS_IDENTITY_API_VERSION=3
export OS_TOKEN=57562bf156da4e09899b37cca5a63ba5
export OS_URL=http://127.0.0.1:35357/v3

Try any operation:

[root@packstack2 ~]# openstack service list
WARNING: openstackclient.common.exceptions is deprecated and will be removed after Jun 2017. Please use osc_lib.exceptions
WARNING: openstackclient.common.utils is deprecated and will be removed after Jun 2017. Please use osc_lib.utils
'StrOpt' object has no attribute 'deprecated'

And returns 1.

With a version before merging that patch:

# openstack service create compute
WARNING: openstackclient.common.exceptions is deprecated and will be removed after Jun 2017. Please use osc_lib.exceptions
WARNING: openstackclient.common.utils is deprecated and will be removed after Jun 2017. Please use osc_lib.utils
+---------+----------------------------------+
| Field | Value |
+---------+----------------------------------+
| enabled | True |
| id | 780dab36834b45fe981aaadec54365bc |
| name | |
| type | compute |
+---------+----------------------------------+
[root@packstack2 ~]# openstack service list
WARNING: openstackclient.common.exceptions is deprecated and will be removed after Jun 2017. Please use osc_lib.exceptions
WARNING: openstackclient.common.utils is deprecated and will be removed after Jun 2017. Please use osc_lib.utils
+----------------------------------+------+---------+
| ID | Name | Type |
+----------------------------------+------+---------+
| 780dab36834b45fe981aaadec54365bc | | compute |
+----------------------------------+------+---------+

Note this is having a high impact as this mechanism is used to bootstrap keystone in different deployment tools.

[Dean Troyer (dtroyer)]

This is one of those things that has multiple causes, uncovered by the commit referenced above in the report.

* KSA (and KSC before it) auth plugins have never properly supported the original token/endpoint authentication. KSA now has token_endpoint.Token which handles the plugin part correctly, however there is no compatible loader for it. I4ddb2dbbb3bf2ab37494468eaf65cef9213a6e00 attempted to convert the TokenEndpoint plugin in OSC to a loader, but was incomplete.
* os-client-config performs KSA plugin loading (!!!!!) causing things to happen way before OSC is ready. OSC already had common.client_config.OSC_Config ready to add a hook to o-c-c's get_one_cloud() method that lets us replace select_auth_plugin() and build_auth_params() and call them at the right time in the o-c-c handling flow.

The plan is to fix the TokenEndpoint auth plugin loader and switch to using OSC_Config. These two changes (combined) will get the auth arguments set up correctly for o-c-c to do its thing and not choke on --os-url and --os-token options.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/331387

[Jamie Lennox (jamielennox)]

For various reasons and compromises the token_endpoint.Token loader is called admin_token, in which --os-url is deprecated in favour of --os-endpoint - but it should all work.

[Jamie Lennox (jamielennox)]

It'd be great to figure out what you need from osc-lib or osc to happen before os-client-config gets called because then all other users of os-c-c will benefit from it.

[Dean Troyer (dtroyer)]

a) admin_token is not compatible with OSC because of the deprecation.

b) o-c-c went off in a weird direction last year while I was away and was too far down the road when I found it to fix it without breaking its other users. I really still don't think it should be loading auth plugins. Querying for args is one thing, loading the auth code is quite different.

So now I need to resume my refactoring of it _and_ OSC to get things to work in the right order and a compatible way.

[Jamie Lennox (jamielennox)]

when you say not compatible because of the deprecation - why is that? The param isn't removed just deprecated and os-c-c should handle that correctly.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/331387
Committed: https://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=cefe715031cc4b1b79a8a68fdb2b93d94fb128f0
Submitter: Jenkins
Branch: master

commit cefe715031cc4b1b79a8a68fdb2b93d94fb128f0
Author: Dean Troyer <email address hidden>
Date: Tue Jun 21 14:54:27 2016 -0500

    Fix token/endpoint auth plugin

    [This is not quite reduced from the original proposed fix as some
    changes have merged that complicate the switch to OSC_Config and
    v2 auth broke anyway.]

    Fix the --os-token --os-url breakage in the switch to ksa.

    Closes-bug: 1593664
    Change-Id: I3ac23234fbf647fb145c7bd151d53c5c105462bf

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/python-openstackclient 3.0.0 release.