Must use user ID when getting a token if user is not in the default domain

[Guang Yee]

Step to reproduce:

1. create a domain foo
2. create a user foo_domain_user in domain foo
3. create a project foo_domain_project in domain foo
4. assign some role to foo_domain_user for foo_domain_project
5. run openstack token issue

For example,

vagrant@ubuntu:~$ env | grep OS_
OS_USER_DOMAIN_NAME=foo
OS_PROJECT_NAME=foo_domain_project
OS_IDENTITY_API_VERSION=3
OS_PASSWORD=secrete
OS_AUTH_URL=http://localhost:5000/
OS_USERNAME=foo_domain_user
OS_PROJECT_DOMAIN_NAME=foo

vagrant@ubuntu:~$ openstack token issue
The request you have made requires authentication. (HTTP 401) (Request-ID: req-36bc4c8b-eb87-4799-935d-848f17ae5ca1)
vagrant@ubuntu:~$ unset OS_USER_DOMAIN_NAME
vagrant@ubuntu:~$ export OS_USER_ID=279fedc94b76443ba3b10940e0aa6919
vagrant@ubuntu:~$ openstack token issue
+------------+-----------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------+
| expires | 2017-05-03T00:53:47+0000 |
| id | gAAAAABZCRwL9a_S_i- |
| | 9ZK01NP3rg9_TggEJMMwj6wVz4Ejg7kRMQnc6ilSRk1RjHNGjVLxM1BVWD-vzH7 |
| | bDbU5X04iGD9628GHtvpI8Ke_UrLw0sSH81vNj3jybrvdv_ZGhWKnpWjaNo6dTD |
| | V8BpmBRORTxkaLMUCEdsR6CSTZ0vagTr3ZBAr0 |
| project_id | 16fd7735687d404ea1d456097d9cf6d2 |
| user_id | 279fedc94b76443ba3b10940e0aa6919 |
+------------+-----------------------------------------------------------------+
vagrant@ubuntu:~$ env | grep OS_
OS_USER_ID=279fedc94b76443ba3b10940e0aa6919
OS_PROJECT_NAME=foo_domain_project
OS_IDENTITY_API_VERSION=3
OS_PASSWORD=secrete
OS_AUTH_URL=http://localhost:5000/
OS_USERNAME=foo_domain_user
OS_PROJECT_DOMAIN_NAME=foo
vagrant@ubuntu:~$

[xuhaigang (rocky0722)]

I try it again, but I don't meet any problem. Do you confuse ID and NAME? :)

[Rui Chen (kiwik-chenrui)]

Sorry, I can't reproduce the bug too, my details in paste page[1]

[1]: http://paste.openstack.org/show/612088/

[Guang Yee (guang-yee)]

Still reproducible with the latest devstack. Here's my screen grab.

vagrant@ubuntu:~$ env | grep OS_
OS_IDENTITY_API_VERSION=3
OS_PASSWORD=secrete
OS_DOMAIN_NAME=foo
OS_AUTH_TYPE=password
OS_AUTH_URL=http://localhost/identity
OS_USERNAME=foo_user
vagrant@ubuntu:~$ openstack token issue --debug
START with options: [u'token', u'issue', u'--debug']
options: Namespace(access_key='', access_secret='***', access_token='***', access_token_endpoint='', access_token_type='', auth_type='password', auth_url='http://localhost/identity', cacert=None, cert='', client_id='', client_secret='***', cloud='', code='', consumer_key='', consumer_secret='***', debug=True, default_domain='default', default_domain_id='', default_domain_name='', deferred_help=False, discovery_endpoint='', domain_id='', domain_name='foo', endpoint='', identity_provider='', identity_provider_url='', insecure=None, interface='', key='', log_file=None, openid_scope='', os_beta_command=False, os_compute_api_version='', os_identity_api_version='3', os_image_api_version='', os_network_api_version='', os_object_api_version='', os_project_id=None, os_project_name=None, os_volume_api_version='', passcode='', password='***', profile='', project_domain_id='', project_domain_name='', project_id='', project_name='', protocol='', redirect_uri='', region_name='', service_provider_endpoint='', service_provider_entity_id='', timing=False, token='***', trust_id='', url='', user_domain_id='', user_domain_name='', user_id='', username='foo_user', verbose_level=3, verify=None)
Auth plugin password selected
auth_config_hook(): {'auth_type': 'password', 'beta_command': False, u'compute_api_version': u'2', u'orchestration_api_version': u'1', u'database_api_version': u'1.0', u'metering_api_version': u'2', 'auth_url': 'http://localhost/identity', u'network_api_version': u'2', u'message': u'', u'image_format': u'qcow2', 'networks': [], u'image_api_version': u'2', 'verify': True, u'dns_api_version': u'2', u'object_store_api_version': u'1', u'status': u'active', u'container_infra_api_version': u'1', 'verbose_level': 3, 'region_name': '', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {'domain_name': 'foo', 'user_domain_id': 'default', 'project_domain_id': 'default'}, 'default_domain': 'default', u'container_api_version': u'1', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', 'key': None, 'timing': False, 'password': '***', u'application_catalog_api_version': u'1', 'cacert': None, u'key_manager_api_version': u'v1', u'workflow_api_version': u'2', 'deferred_help': False, u'identity_api_version': '3', u'volume_api_version': u'2', 'username': 'foo_user', 'cert': None, u'secgroup_source': u'neutron', 'debug': True, u'interface': None, u'disable_vendor_agent': {}}
defaults: {u'auth_type': 'password', u'status': u'active', u'compute_api_version': u'2', 'key': None, u'database_api_version': u'1.0', 'api_timeout': None, u'baremetal_api_version': u'1', u'image_api_version': u'2', u'container_infra_api_version': u'1', u'metering_api_version': u'2', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', u'orchestration_api_version': u'1', 'cacert': None, u'network_api_version': u'2',...

[Guang Yee (guang-yee)]

Seems like it's still using domain id "default" somewhere

Using auth plugin: password
Using parameters {'username': 'foo_user', 'user_domain_id': 'default', 'domain_name': 'foo', 'auth_url': 'http://localhost/identity', 'password': '***', 'project_domain_id': 'default'}
Get auth_ref