switching projects via project switcher does not work

[Matthias Runge]

I have a user, being member in 2 projects
loggin in works, but when switching to the other project, I get a trace:

[07/Oct/2015 07:30:46] "GET /auth/switch/5152e1ca69ad4c9c894becf2e60a6230/?next=/project/ HTTP/1.1" 302 0
Unable to retrieve project list.
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/openstack_auth/user.py", line 318, in authorized_tenants
    is_federated=self.is_federated)
  File "/usr/lib/python2.7/site-packages/openstack_auth/utils.py", line 139, in wrapper
    result = func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/openstack_auth/utils.py", line 324, in get_project_list
    projects = client.tenants.list()
  File "/usr/lib/python2.7/site-packages/keystoneclient/v2_0/tenants.py", line 123, in list
    tenant_list = self._list('/tenants%s' % query, 'tenants')
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 124, in _list
    resp, body = self.client.get(url, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/adapter.py", line 170, in get
    return self.request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/adapter.py", line 206, in request
    resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/adapter.py", line 95, in request
    return self.session.request(url, method, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/utils.py", line 337, in inner
    return func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 401, in request
    raise exceptions.from_response(resp, method, url)
Unauthorized: The request you have made requires authentication. (Disable debug mode to suppress these details.) (HTTP 401) (Request-ID: req-18cdb92c-54ca-442d-b4d0-e95122a04064)
DEBUG:oslo_policy.policy:Rule [telemetry:compute_statistics] does not exist
DEBUG:oslo_policy.policy:Rule [default] does not exist
DEBUG:oslo_policy.policy:Rule [telemetry:get_meter] does not exist
DEBUG:oslo_policy.policy:Rule [default] does not exist
Unable to retrieve project list.
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/openstack_auth/user.py", line 318, in authorized_tenants
    is_federated=self.is_federated)
  File "/usr/lib/python2.7/site-packages/openstack_auth/utils.py", line 139, in wrapper
    result = func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/openstack_auth/utils.py", line 324, in get_project_list
    projects = client.tenants.list()
  File "/usr/lib/python2.7/site-packages/keystoneclient/v2_0/tenants.py", line 123, in list
    tenant_list = self._list('/tenants%s' % query, 'tenants')
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 124, in _list
    resp, body = self.client.get(url, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/adapter.py", line 170, in get
    return self.request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/adapter.py", line 206, in request
    resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/adapter.py", line 95, in request
    return self.session.request(url, method, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/utils.py", line 337, in inner
    return func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 401, in request
    raise exceptions.from_response(resp, method, url)
Unauthorized: The request you have made requires authentication. (Disable debug mode to suppress these details.) (HTTP 401) (Request-ID: req-d6b1136b-6944-4815-9fe2-64a0f47b7e52)
Unable to retrieve project list.
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/openstack_auth/user.py", line 318, in authorized_tenants
    is_federated=self.is_federated)
  File "/usr/lib/python2.7/site-packages/openstack_auth/utils.py", line 139, in wrapper
    result = func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/openstack_auth/utils.py", line 324, in get_project_list
    projects = client.tenants.list()
  File "/usr/lib/python2.7/site-packages/keystoneclient/v2_0/tenants.py", line 123, in list
    tenant_list = self._list('/tenants%s' % query, 'tenants')
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 124, in _list
    resp, body = self.client.get(url, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/adapter.py", line 170, in get
    return self.request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/adapter.py", line 206, in request
    resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/adapter.py", line 95, in request
    return self.session.request(url, method, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/utils.py", line 337, in inner
    return func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 401, in request
    raise exceptions.from_response(resp, method, url)
Unauthorized: The request you have made requires authentication. (Disable debug mode to suppress these details.) (HTTP 401) (Request-ID: req-46d8bc67-5b2b-4132-912e-e79c97fd6a9e)
[07/Oct/2015 07:30:46] "GET /project/ HTTP/1.1" 200 19779
[07/Oct/2015 07:30:46] "GET /i18n/js/horizon+openstack_dashboard/ HTTP/1.1" 200 2372

This is current master codebase, aka liberty rc1.

[Matthias Runge (mrunge)]

seems to be a pki token issue, not reproducible with uuid tokens

[Brad Pokorny (bpokorny)]

I validated the same error happens for me using PKI tokens. When I get the error, the project actually does get switched, but the project switcher has no projects except the one that I just switched to.

I validated that setting this in the local_settings.py file resolves the error:

OPENSTACK_TOKEN_HASH_ENABLED = False

So the issue has something to do with the hashing of PKI tokens, and disabling hashed tokens is a workaround for now. However, disabling hashing permanently isn't ideal and can cause other issues.

[Brad Pokorny (bpokorny)]

I don't think this is related, but I'll mention it here just in case. The checkmark on the project picker has changed positions in some cases. I opened a separate bug for that:

https://bugs.launchpad.net/horizon/+bug/1504234

[Einar Forselv (eforselv)]

It's because django-openstack-auth re-hashes the unscoped token (used for retrieving project list) re-hashes the token every time you switch the project. The unscoped token can for example end up being an md5 of an md5.

https://bugs.launchpad.net/django-openstack-auth/+bug/1487372

[Doug Fish (drfish)]

Agree this is a duplicate.