keystone config-changed hook error after adding 'domain_specific_drivers_enabled = True' to keystone.conf template

[Matt Rae]

When using domains which authenticate to ldap, we need to set domain_specific_drivers_enabled = True to allow configuring the ldap settings per domain. Right now when adding the option to the keystone.conf template there will be a hook error on the leader unit when the unit when deployed. the config-changed hooks fails on authenticating to keystone with http 401. Logs to be added.

To reproduce add the domain_specific_drivers_enabled option to the keystone.conf template and deploy keystone with charm config preferred-api-version=3. keystone will have a hook error on config-changed

[identity]
domain_specific_drivers_enabled = True

[Kevin Metz (pertinent)]

The error repeated in the logs

(keystone.common.wsgi): 2016-11-18 15:44:17,108 WARNING Authorization failed. The request you have made requires authentication. from 127.0.0.1

[Felipe Reyes (freyes)]

A simplified version of the code that fails is http://pastebin.ubuntu.com/23558426/

According to the bug 1493126, comment #7, it's expected a failure when trying to get the list of users using the admin token, so we should be using the admin credentials instead to talk to keystone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/410509

[OpenStack Infra (hudson-openstack)]

Change abandoned by Edward Hope-Morley (<email address hidden>) on branch: master
Review: https://review.openstack.org/410509
Reason: The original objective of this patchset was to fix the api auth bug hit when enabling domain_specific_drivers_enabled in the charm. It subsequently has become a bit of a catchall to resolve other issues like being able to test credentials and minimise the usage of the admin token. Doing all of this at once is overcomplicating this patchset so am going abandon it in favour of the following:

  * use https://review.openstack.org/#/c/424059/ as the fix for the original issue (i have tested and it works)

  * create a new patchset for credential testing and admin password reset capability

  * open a new bug to investigate switching to a non-admin-token world