Horizon shows stacktrace instead of 401: unauthorized

[Nicolas Vila]

In Icehouse if a user is unauthorized to access volumes, horizon shows a popup upon login as well as when accesing volumes. In Juno, horizon shows no warning upon login, and as one access volumes it shows a stacktrace.

One way to reproduce it is to edit on the cinder host the /etc/cinder/api-paste.ini file, and in the "filter:authtoken" section configure an auth_host that is not keystone.

[Wu Wenxiang (wu-wenxiang)]

Could you paste the callstack information in your environments?

[Alejandro Comisario (alejandro-f)]

I'll be happy to, can you tell me how to do that ? thanks!

[Alejandro Comisario (alejandro-f)]

This is what horizon gives me in JUNO.

[Sun Jan 25 16:39:29.721251 2015] [:error] [pid 20915:tid 140058809657088] INFO:urllib3.connectionpool:Starting new HTTP connection (1): 10.128.20.120
[Sun Jan 25 16:39:29.724623 2015] [:error] [pid 20915:tid 140058809657088] DEBUG:urllib3.connectionpool:Setting read timeout to None
[Sun Jan 25 16:39:29.921796 2015] [:error] [pid 20915:tid 140058809657088] DEBUG:urllib3.connectionpool:"GET /v1/d33439483804410f9e8e42f24a150573/volumes/detail HTTP/1.1" 401 23
[Sun Jan 25 16:39:29.924656 2015] [:error] [pid 20915:tid 140058809657088] INFO:urllib3.connectionpool:Starting new HTTP connection (1): 10.128.20.120
[Sun Jan 25 16:39:29.926233 2015] [:error] [pid 20915:tid 140058809657088] DEBUG:urllib3.connectionpool:Setting read timeout to None
[Sun Jan 25 16:39:29.932071 2015] [:error] [pid 20915:tid 140058809657088] DEBUG:urllib3.connectionpool:"GET /v1/d33439483804410f9e8e42f24a150573 HTTP/1.1" 401 23
[Sun Jan 25 16:39:29.936727 2015] [:error] [pid 20915:tid 140058809657088] Internal Server Error: /project/volumes/
[Sun Jan 25 16:39:29.936840 2015] [:error] [pid 20915:tid 140058809657088] Traceback (most recent call last):
[Sun Jan 25 16:39:29.936928 2015] [:error] [pid 20915:tid 140058809657088] File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 112, in get_response
[Sun Jan 25 16:39:29.937013 2015] [:error] [pid 20915:tid 140058809657088] response = wrapped_callback(request, *callback_args, **callback_kwargs)
[Sun Jan 25 16:39:29.937082 2015] [:error] [pid 20915:tid 140058809657088] File "/usr/local/lib/python2.7/dist-packages/openstack_dashboard/wsgi/../../horizon/decorators.py", line 36, in dec
[Sun Jan 25 16:39:29.937145 2015] [:error] [pid 20915:tid 140058809657088] return view_func(request, *args, **kwargs)
[Sun Jan 25 16:39:29.937208 2015] [:error] [pid 20915:tid 140058809657088] File "/usr/local/lib/python2.7/dist-packages/openstack_dashboard/wsgi/../../horizon/decorators.py", line 52, in dec
[Sun Jan 25 16:39:29.937270 2015] [:error] [pid 20915:tid 140058809657088] return view_func(request, *args, **kwargs)
[Sun Jan 25 16:39:29.937331 2015] [:error] [pid 20915:tid 140058809657088] File "/usr/local/lib/python2.7/dist-packages/openstack_dashboard/wsgi/../../horizon/decorators.py", line 36, in dec
[Sun Jan 25 16:39:29.937393 2015] [:error] [pid 20915:tid 140058809657088] return view_func(request, *args, **kwargs)
[Sun Jan 25 16:39:29.937452 2015] [:error] [pid 20915:tid 140058809657088] File "/usr/local/lib/python2.7/dist-packages/openstack_dashboard/wsgi/../../horizon/decorators.py", line 84, in dec
[Sun Jan 25 16:39:29.937536 2015] [:error] [pid 20915:tid 140058809657088] return view_func(request, *args, **kwargs)
[Sun Jan 25 16:39:29.937598 2015] [:error] [pid 20915:tid 140058809657088] File "/usr/local/lib/python2.7/dist-packages/django/views/generic/base.py", line 69, in view
[Sun Jan 25 16:39:29.937658 2015] [:error] [pid 20915:tid 140058809657088] return self.dispatch(request, *args, **kwargs)
[Sun Jan 25 16:39:29.937719 2015] [:error] [pid 20915:tid 140058809657088] File "/usr/local/lib/python2.7/dist-packages/django/views/gene...

[Wu Wenxiang (wu-wenxiang)]

Thanks for your paste

After checking the codes & stack traces in your environment, I found maybe it's by design.

In cindy api codes, it will catch all exception include 401, then tell you "Unable to retrieve volume list".

class VolumeTableMixIn(object):
    def _get_volumes(self, search_opts=None):
        try:
            return api.cinder.volume_list(self.request,
                                          search_opts=search_opts)
        except Exception:
            exceptions.handle(self.request,
                              _('Unable to retrieve volume list.'))
            return []

[Matt Borland (palecrow)]

I think that the current behavior is appropriate; if for some reason we're calling getVolumes when the user doesn't have access, there should be some sort of stack trace on the server logs. The bug is more whether we should be checking something to help prevent that call from being made, not to change the getVolumes behavior.