Document should report that Users must have at least one role

[David Kranz]

I'm not sure if this is a code/design bug or a doc bug. If a user has no role then 'nova list' fails with

ERROR: Invalid OpenStack Nova credentials.

The keystone log says:

(root): 2012-03-23 10:19:36,903 DEBUG ******************** REQUEST BODY ********************
(root): 2012-03-23 10:19:36,903 DEBUG {"auth": {"tenantName": "users", "passwordCredentials": {"username": "tester", "password": "testing"}}}
(root): 2012-03-23 10:19:36,903 DEBUG
(root): 2012-03-23 10:19:36,904 DEBUG arg_dict: {}
(root): 2012-03-23 10:19:36,948 WARNING Invalid tenant

This message is enough out-of-whack with the actual issue that I wasn't sure if this was a bug or not. If this is expected
then the docs should say that at least one role is required.

[Dolph Mathews (dolph)]

I think the error message is misleading - the credentials may be accurate (proper authentication), but it looks like it's authorization on the tenant which has failed (hence the "WARNING Invalid tenant").

[Joseph Heck (heckj)]

David -

It's intentional - all users are expected to be associated with at least one tenant, potentially more.

[Joseph Heck (heckj)]

David - want to take a stab at updating the docs? I'd recommend looking at doc/source/configuration.rst

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/5874

[David Kranz (david-kranz)]

Joe, I guess I am not up to fixing this. I am a keystone newbie.

[Dolph Mathews (dolph)]

I think this was documented pretty well pre-redux (on a page called Concepts, as I recall), however I don't see any remnants of that documentation?

Regarding the error message, I think this is a bug against novaclient, as it appears that nova is perhaps suppressing/ignoring a more useful error message from keystone? (given the "Invalid tenant" warning in the OP's log)

[Launchpad Janitor (janitor)]

[Expired for Keystone because there has been no activity for 60 days.]