Fuel for OpenStack

Fuel 11 MOS - horizon not able to browse projects or admin

Bug #1675284 reported by Luca Cervigni on 2017-03-23

This bug report is a duplicate of: Bug #1677677: keystone gets defined with the 2.0 api which makes horizon to break. Edit Remove

This bug affects 6 people

Affects		Status	Importance	Assigned to	Milestone
	Fuel for OpenStack	Confirmed	High	Michael Polenchuk	Fuel for OpenStack 11.x-updates

Bug Description

Environment deployed with fuel 11 + MOS OCATA.

After logging in with the admin user in Horizon, when I try to browse projects or admin I get kicked out of horizon with "Unauthorized. Please try logging in again."

In the horizon logs:

2017-03-23 07:05:54,864 8900 INFO openstack_auth.views Logging out user "admin".
2017-03-23 07:06:00,636 8900 WARNING openstack_auth.forms Login failed for user "admin", remote address 10.4.78.210.
2017-03-23 07:06:05,967 8901 WARNING openstack_auth.backend The Keystone URL in service catalog points to a v2.0 Keystone endpoint, but v3 is specified as the API version to use by Horizon. Using v3 endpoint for authentication.
2017-03-23 07:06:05,969 8901 INFO openstack_auth.forms Login successful for user "admin", remote address 10.4.78.210.
2017-03-23 07:06:06,133 8900 WARNING openstack_auth.utils The Keystone URL (either in Horizon settings or in service catalog) points to a v2.0 Keystone endpoint, but v3 is specified as the API version to use by Horizon. Using v3 endpoint for authentication.
2017-03-23 07:06:06,203 8900 WARNING openstack_auth.utils The Keystone URL (either in Horizon settings or in service catalog) points to a v2.0 Keystone endpoint, but v3 is specified as the API version to use by Horizon. Using v3 endpoint for authentication.
2017-03-23 07:06:06,222 8900 WARNING openstack_auth.utils The Keystone URL (either in Horizon settings or in service catalog) points to a v2.0 Keystone endpoint, but v3 is specified as the API version to use by Horizon. Using v3 endpoint for authentication.
2017-03-23 07:06:06,341 8900 WARNING openstack_auth.utils The Keystone URL (either in Horizon settings or in service catalog) points to a v2.0 Keystone endpoint, but v3 is specified as the API version to use by Horizon. Using v3 endpoint for authentication.
2017-03-23 07:06:06,558 8900 WARNING novaclient.v2.client Property `management_url` is deprecated for SessionClient. It should be set via `endpoint_override` variable while class initialization.
2017-03-23 07:06:06,720 8900 ERROR openstack_dashboard.dashboards.admin.aggregates.panel Call to list supported extensions failed. This is likely due to a problem communicating with the Nova endpoint. Host Aggregates panel will not be displayed.
2017-03-23 07:06:10,382 8900 WARNING openstack_auth.utils The Keystone URL (either in Horizon settings or in service catalog) points to a v2.0 Keystone endpoint, but v3 is specified as the API version to use by Horizon. Using v3 endpoint for authentication.
2017-03-23 07:06:10,395 8900 WARNING openstack_auth.utils The Keystone URL (either in Horizon settings or in service catalog) points to a v2.0 Keystone endpoint, but v3 is specified as the API version to use by Horizon. Using v3 endpoint for authentication.
2017-03-23 07:06:10,578 8900 ERROR horizon.exceptions Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-37e817d1-f509-4a8d-965a-d1b24ca2455a)
Traceback (most recent call last):
  File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/dashboards/admin/instances/views.py", line 116, in get_data
    all_tenants=True)
  File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/api/nova.py", line 702, in server_list
    for s in c.servers.list(True, search_opts)]
  File "/usr/lib/python2.7/dist-packages/novaclient/v2/servers.py", line 861, in list
    "servers")
  File "/usr/lib/python2.7/dist-packages/novaclient/base.py", line 254, in _list
    resp, body = self.api.client.get(url)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/adapter.py", line 217, in get
    return self.request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/dist-packages/novaclient/client.py", line 74, in request
    **kwargs)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/adapter.py", line 374, in request
    resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/adapter.py", line 142, in request
    return self.session.request(url, method, **kwargs)
  File "/usr/lib/python2.7/dist-packages/positional/__init__.py", line 101, in inner
    return wrapped(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/session.py", line 491, in request
    auth_headers = self.get_auth_headers(auth)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/session.py", line 818, in get_auth_headers
    return auth.get_headers(self, **kwargs)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/plugin.py", line 90, in get_headers
    token = self.get_token(session)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/identity/base.py", line 90, in get_token
    return self.get_access(session).auth_token
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/identity/base.py", line 136, in get_access
    self.auth_ref = self.get_auth_ref(session)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/identity/generic/base.py", line 198, in get_auth_ref
    return self._plugin.get_auth_ref(session, **kwargs)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/identity/v2.py", line 65, in get_auth_ref
    authenticated=False, log=False)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/session.py", line 766, in post
    return self.request(url, 'POST', **kwargs)
  File "/usr/lib/python2.7/dist-packages/positional/__init__.py", line 101, in inner
    return wrapped(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/keystoneauth1/session.py", line 655, in request
    raise exceptions.from_response(resp, method, url)
Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-37e817d1-f509-4a8d-965a-d1b24ca2455a)

In the KEYSTONE LOGS:

2017-03-23 07:06:05.712 8898 WARNING oslo_config.cfg [req-64d141d9-810d-4f0f-a481-6e67650aedf0 - - - - -] Option "rpc_backend" from group "DEFAULT" is deprecated for removal. Its value may be silently ignored in the future.
2017-03-23 07:06:05.715 8898 WARNING oslo_config.cfg [req-64d141d9-810d-4f0f-a481-6e67650aedf0 - - - - -] Option "public_port" from group "DEFAULT" is deprecated. Use option "public_port" from group "eventlet_server".
2017-03-23 07:06:05.716 8898 WARNING oslo_config.cfg [req-64d141d9-810d-4f0f-a481-6e67650aedf0 - - - - -] Option "public_port" from group "eventlet_server" is deprecated for removal. Its value may be silently ignored in the future.
2017-03-23 07:06:05.717 8898 WARNING oslo_config.cfg [req-64d141d9-810d-4f0f-a481-6e67650aedf0 - - - - -] Option "admin_port" from group "DEFAULT" is deprecated. Use option "admin_port" from group "eventlet_server".
2017-03-23 07:06:05.718 8898 WARNING oslo_config.cfg [req-64d141d9-810d-4f0f-a481-6e67650aedf0 - - - - -] Option "admin_port" from group "eventlet_server" is deprecated for removal. Its value may be silently ignored in the future.
2017-03-23 07:06:05.719 8898 WARNING oslo_config.cfg [req-64d141d9-810d-4f0f-a481-6e67650aedf0 - - - - -] Option "public_bind_host" from group "DEFAULT" is deprecated. Use option "public_bind_host" from group "eventlet_server".
2017-03-23 07:06:05.721 8898 WARNING oslo_config.cfg [req-64d141d9-810d-4f0f-a481-6e67650aedf0 - - - - -] Option "public_bind_host" from group "eventlet_server" is deprecated for removal. Its value may be silently ignored in the future.
2017-03-23 07:06:05.722 8898 WARNING oslo_config.cfg [req-64d141d9-810d-4f0f-a481-6e67650aedf0 - - - - -] Option "admin_bind_host" from group "DEFAULT" is deprecated. Use option "admin_bind_host" from group "eventlet_server".
2017-03-23 07:06:05.723 8898 WARNING oslo_config.cfg [req-64d141d9-810d-4f0f-a481-6e67650aedf0 - - - - -] Option "admin_bind_host" from group "eventlet_server" is deprecated for removal. Its value may be silently ignored in the future.
2017-03-23 07:06:05.801 8899 INFO keystone.common.wsgi [req-743a4b63-be17-416f-aaf4-b8dcd3368626 - - - - -] GET http://10.4.78.210:5000/v3/
2017-03-23 07:06:05.821 8898 INFO keystone.common.wsgi [req-13ba82f4-7261-4e72-bbf5-0ee1142bb31f - - - - -] GET http://10.4.78.210:5000/v3/users/3c3a86198d0049f395aedb0b96a1f241/projects
2017-03-23 07:06:05.909 8899 INFO keystone.common.wsgi [req-64199580-49fe-4005-9b50-e306b2f743db - - - - -] GET http://node-22.cloud.pawsey.org.au/v3/
2017-03-23 07:06:05.933 8898 INFO keystone.common.wsgi [req-0ea9bf28-2311-4d97-987b-d3e49476bbcc - - - - -] POST http://10.4.78.210:5000/v3/auth/tokens
2017-03-23 07:06:06.400 8899 WARNING py.warnings [req-64199580-49fe-4005-9b50-e306b2f743db - - - - -] /usr/lib/python2.7/dist-packages/keystonemiddleware/auth_token/__init__.py:440: UserWarning: Implementations of auth_token must set kwargs_to_fetch_token this will be the required and assumed in Pike.
warnings.warn(m)

2017-03-23 07:06:06.420 8899 INFO keystone.common.wsgi [req-901d34e1-4192-4eaa-a014-1972d73a42ee - - - - -] GET http://public-virtual.cloud.pawsey.org.au:5000/v3/users/3c3a86198d0049f395aedb0b96a1f241/projects
2017-03-23 07:06:06.502 8898 INFO keystone.common.wsgi [req-9b7f5761-d5fc-42aa-845e-31c4a3c7586e - - - - -] GET http://node-22.cloud.pawsey.org.au/v3/
2017-03-23 07:06:06.572 8899 INFO keystone.common.wsgi [req-d4b3af92-74dd-47e4-a2e5-95fe8cac4930 - - - - -] GET http://public-virtual.cloud.pawsey.org.au:5000/v2.0/
2017-03-23 07:06:06.594 8898 INFO keystone.common.wsgi [req-d5efeff5-9eb9-46f3-9cdc-f5a056240588 - - - - -] POST http://public-virtual.cloud.pawsey.org.au:5000/v2.0/tokens
2017-03-23 07:06:06.596 8898 WARNING oslo_log.versionutils [req-d5efeff5-9eb9-46f3-9cdc-f5a056240588 - - - - -] Deprecated: authenticate of the v2 Authentication APIs is deprecated as of Mitaka in favor of a similar function in the v3 Authentication APIs.
2017-03-23 07:06:06.715 8898 WARNING keystone.common.wsgi [req-d5efeff5-9eb9-46f3-9cdc-f5a056240588 - - - - -] Authorization failed. The request you have made requires authentication. from 10.4.78.210
2017-03-23 07:06:10.482 8899 INFO keystone.common.wsgi [req-37e817d1-f509-4a8d-965a-d1b24ca2455a - - - - -] POST http://public-virtual.cloud.pawsey.org.au:5000/v2.0/tokens
2017-03-23 07:06:10.484 8899 WARNING oslo_log.versionutils [req-37e817d1-f509-4a8d-965a-d1b24ca2455a - - - - -] Deprecated: authenticate of the v2 Authentication APIs is deprecated as of Mitaka in favor of a similar function in the v3 Authentication APIs.
2017-03-23 07:06:10.573 8899 WARNING keystone.common.wsgi [req-37e817d1-f509-4a8d-965a-d1b24ca2455a - - - - -] Authorization failed. The request you have made requires authentication. from 10.4.78.210

ENDPOINTS:

Is there a workaround for this? I do not understand where the problem is coming from.
Everything CLI related seems to be working ok.

are more logs required?

Tags:

Oleksiy Molchanov (omolchanov) on 2017-03-23

Changed in fuel:
milestone:	none → 11.x-updates
assignee:	nobody → Fuel Sustaining (fuel-sustaining-team)
importance:	Undecided → High
status:	New → Confirmed
tags:	added: area-library

Revision history for this message

Luca Cervigni (cervigni) wrote on 2017-03-23:

Oleksiy,

Do you know of any workaround to solve momentarily this issue?

Many thanks

Michael Polenchuk (mpolenchuk) on 2017-04-03

Changed in fuel:
assignee:	Fuel Sustaining (fuel-sustaining-team) → Michael Polenchuk (mpolenchuk)

Revision history for this message

Derek Leuridan (leuridan) wrote on 2017-05-17:

Facing same issue. Updating keystone endpoints to be versionless as per https://bugs.launchpad.net/fuel/+bug/1677677 does not work as a stand-alone fix.

Revision history for this message

Vojislav Kosanovic (jontra) wrote on 2017-07-07:

Same issue. Tested with latest Fuel 11,12.
Following fix https://bugs.launchpad.net/fuel/+bug/1677677 enables Neutron, Glance, Cinder, Heat to work. But Nova still fails. Maybe keystone v3 endpoints required?

Report a bug

This report contains Public information

Everyone can see this information.

Duplicate of bug #1677677 Remove

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.