Multi-region management from Horizon requires endless authentications

[Sukhdev Kapur]

I am deploying Horizon to manage multiple regions by updating AVAILABLE_REGIONS in /opt/stack/horizon/openstack_dashboard/local/local_settings.py.

I notice that it asks for authentication for each region to login - which is OK. However, once authenticated for all regions, when I try to switch to an already authenticated region, it asks for authentication regardless. This makes this solution very annoying.

Once authenticated for all regions, it should not require to keep authenticating.

Is there a work around for this?

[David Lyle (david-lyle)]

The preferred solution is to have a shared keystone across regions.

The main issue with maintaining multiple active tokens is size constraints. The default implementation for Horizon is to used signed cookies for session storage. This has an upper limit of ~4KB. One uncompressed PKI token takes up most of that, but even not using PKI it is easy to run into problems where there is more session data than can fit in a cookie. The errors when this happens are not always immediately evident and can manifest in all sorts of nasty ways.

As for hope for improvement. Couple of things, compressed tokens and potentially having the service catalog removed from the token. But these are items in varying degrees of completion.

If you are using a session backend other than signed cookies, you could store more tokens. This would take change in Horizon and django_openstack_auth to make work.

[Timur Sufiev (tsufiev-x)]

I've noticed the behavior that is somewhat different from the one mentioned in Bug Description: Switch Region dropdown in top right corner doesn't work for me.

Suppose I login into the Region1, then when I try to switch to Region2, it redirects me to the login view of django-openstack-auth https://github.com/openstack/horizon/blob/2014.2.rc1/horizon/templates/horizon/common/_region_selector.html#L11 and there I am being immediately redirected to the settings.LOGIN_REDIRECT_URL because I am already authenticated at Region1, so I cannot view Region2 resources if I switch to it via top right dropdown. Selecting region at login page works though.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/127544

[Timur Sufiev (tsufiev-x)]

I've filed a separate bug https://bugs.launchpad.net/horizon/+bug/1381413 for the behavior I had encountered.

[Brad Pokorny (bpokorny)]

I'm going to close this one as won't fix, as there hasn't been any activity on the original issue for a while, and there's no good way to solve this in Horizon.

As David mentions, if Keystone tokens can't be authenticated across regions, the only way to not require logging into a previously logged in region would be to store extra tokens in the session. That's highly undesirable.

We deal with this issue in our production environment currently (we currently use PKI tokens), and our plan is to use Fernet tokens. Fernet tokens should enable tokens to be authenticated across different Keystones, as long as the Keystones share Fernet keys.