Juniper Openstack

R3.1-build-19-mitaka-keystonev3 with multi-domain- horizon not displaying project with user login creds

Series trunk
Bug #1612853

Bug #1612853 reported by shajuvk on 2016-08-12

This bug affects 4 people

	Status	Importance	Assigned to	Milestone
Juniper Openstack	Status tracked in Trunk
R3.1	Fix Committed	High	Deepinder Setia	Juniper Openstack r3.1.2.0
R3.2	Fix Committed	High	Deepinder Setia	Juniper Openstack r3.2.0.0-fcs "r3.2.0.0"
Trunk	Fix Committed	High	Deepinder Setia	Juniper Openstack r4.0.0.0-fcs "r4.0.0.0"

Bug Description

Hi All,

While I am testing keystone v3 with Rbac, seeing below issue on horizon, do I need any other configuration to resolve below issues? Attached the screenshot of both the issues.

Issue 1:
Project tab not displayed the project name (screenshot- issue1)
Steps:
1. Create a domain (name:mydomain) and project (name:project1-mydomain) and add a user (name:user1-project1-mydomain) as admin in project1-mydomain
2. Login to horizon as mydomain and user credentials , click on project tab (project1-mydomain not listed)

Issue 2: If I add the above user (user1-project1-mydomain) as an admin to the domain (mydomain). Horizon page shows something went wrong. (screenshot –issue2)

Horizon exception (apache2/error.lg) on Issue2
==========================

[Fri Aug 12 22:13:04.350108 2016] [:error] [pid 3755:tid 140284044183296] Deleted token 9de2cca079a14df0891daf551b137839
[Fri Aug 12 22:13:23.973484 2016] [:error] [pid 3757:tid 140284044183296] Login successful for user "user1-project1-mydomain".
[Fri Aug 12 22:13:25.239978 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.240704 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.241225 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.276170 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.276738 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.278068 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.278624 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.321291 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.321836 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.322383 2016] [:error] [pid 3757:tid 140284119717632] Failed to create user from domain scoped token.
[Fri Aug 12 22:13:25.345193 2016] [:error] [pid 3757:tid 140284119717632] Pure project admin doesn't have a domain token
[Fri Aug 12 22:13:25.345762 2016] [:error] [pid 3757:tid 140284119717632] Internal Server Error: /horizon/identity/
[Fri Aug 12 22:13:25.345783 2016] [:error] [pid 3757:tid 140284119717632] Traceback (most recent call last):
[Fri Aug 12 22:13:25.345791 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/lib/python2.7/dist-packages/django/core/handlers/base.py", line 132, in get_response
[Fri Aug 12 22:13:25.345798 2016] [:error] [pid 3757:tid 140284119717632] response = wrapped_callback(request, *callback_args, **callback_kwargs)
[Fri Aug 12 22:13:25.345805 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/decorators.py", line 36, in dec
[Fri Aug 12 22:13:25.345813 2016] [:error] [pid 3757:tid 140284119717632] return view_func(request, *args, **kwargs)
[Fri Aug 12 22:13:25.345820 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/decorators.py", line 52, in dec
[Fri Aug 12 22:13:25.345827 2016] [:error] [pid 3757:tid 140284119717632] return view_func(request, *args, **kwargs)
[Fri Aug 12 22:13:25.345834 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/decorators.py", line 36, in dec
[Fri Aug 12 22:13:25.345843 2016] [:error] [pid 3757:tid 140284119717632] return view_func(request, *args, **kwargs)
[Fri Aug 12 22:13:25.345856 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/lib/python2.7/dist-packages/django/views/generic/base.py", line 71, in view
[Fri Aug 12 22:13:25.345877 2016] [:error] [pid 3757:tid 140284119717632] return self.dispatch(request, *args, **kwargs)
[Fri Aug 12 22:13:25.345883 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/lib/python2.7/dist-packages/django/views/generic/base.py", line 89, in dispatch
[Fri Aug 12 22:13:25.345889 2016] [:error] [pid 3757:tid 140284119717632] return handler(request, *args, **kwargs)
[Fri Aug 12 22:13:25.345894 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 159, in get
[Fri Aug 12 22:13:25.345901 2016] [:error] [pid 3757:tid 140284119717632] handled = self.construct_tables()
[Fri Aug 12 22:13:25.345906 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 150, in construct_tables
[Fri Aug 12 22:13:25.345913 2016] [:error] [pid 3757:tid 140284119717632] handled = self.handle_table(table)
[Fri Aug 12 22:13:25.345919 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 121, in handle_table
[Fri Aug 12 22:13:25.345924 2016] [:error] [pid 3757:tid 140284119717632] data = self._get_data_dict()
[Fri Aug 12 22:13:25.345930 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 187, in _get_data_dict
[Fri Aug 12 22:13:25.345936 2016] [:error] [pid 3757:tid 140284119717632] self._data = {self.table_class._meta.name: self.get_data()}
[Fri Aug 12 22:13:25.345943 2016] [:error] [pid 3757:tid 140284119717632] File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/dashboards/identity/projects/views.py", line 115, in get_data
[Fri Aug 12 22:13:25.345951 2016] [:error] [pid 3757:tid 140284119717632] t.domain_name = domain_lookup.get(t.domain_id)
[Fri Aug 12 22:13:25.345958 2016] [:error] [pid 3757:tid 140284119717632] AttributeError: 'NoneType' object has no attribute 'get'

Thanks,
Shaju

Tags:

shajuvk (shajuvk) on 2016-08-12

tags:

added: config horizon rbac

Ritam Gangopadhyay (ritam) on 2016-10-13

tags:

added: keystonev3

Revision history for this message

Deepinder Setia (dsetia) wrote on 2016-11-18:

Download full text (3.3 KiB)

I tried this on nodeb5 (3.1.1.0-42, Mitaka, Keystone V3 and RBAC) today. I don't think contrail RBAC is related to my observations. I created a domain (dsetia-domain) and a project in it (dsetia-project). I also created a user called dsetia-user. If dsetia-user is assigned a role in domain, I was unable to login to Horizon UI. The browser screen showed an error and following trace appears in logs:

Pure project admin doesn't have a domain token
Internal Server Error: /horizon/identity/
Traceback (most recent call last):
   File "/usr/lib/python2.7/dist-packages/django/core/handlers/base.py", line 132, in get_response
     response = wrapped_callback(request, *callback_args, **callback_kwargs)
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/decorators.py", line 36, in dec
     return view_func(request, *args, **kwargs)
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/decorators.py", line 52, in dec
     return view_func(request, *args, **kwargs)
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/decorators.py", line 36, in dec
     return view_func(request, *args, **kwargs)
   File "/usr/lib/python2.7/dist-packages/django/views/generic/base.py", line 71, in view
     return self.dispatch(request, *args, **kwargs)
   File "/usr/lib/python2.7/dist-packages/django/views/generic/base.py", line 89, in dispatch
     return handler(request, *args, **kwargs)
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 159, in get
     handled = self.construct_tables()
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 150, in construct_tables
     handled = self.handle_table(table)
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 121, in handle_table
     data = self._get_data_dict()
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 187, in _get_data_dict
     self._data = {self.table_class._meta.name: self.get_data()} File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/dashboards/identity/projects/views.py", line 115, in get_data
     t.domain_name = domain_lookup.get(t.domain_id)
AttributeError: 'NoneType' object has no attribute 'get'

If I remove role assignment from domain and instead assign role to dsetia-user in dsetia-project, I am able to login. However, post login there is error in fetching projects. THIS I believe is expected since listing of projects is likely a cloud-admin operation.

The behavior when user is member of no-default domain is surprising and I believe this used to work. If fact, that scenario should trigger a domain scope token (if user isn't member of any project) which should allow domain wide access.

Pure project admin doesn't have a domain token 
 Internal Server Error: /horizon/identity/ 
 Traceback (most recent call last):
   File "/usr/lib/python2.7/dist-packages/django/core/handlers/base.py", line 132, in get_response
     response = wrapped_callback(request, *callback_args, **callback_kwargs)   
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/decorators.py", line 36, in dec
     return view_func(request, *args, **kwargs) 
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/decorators.py", line 52, in dec
     return view_func(request, *args, **kwargs) 
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/decorators.py", line 36, in dec
     return view_func(request, *args, **kwargs) 
   File "/usr/lib/python2.7/dist-packages/django/views/generic/base.py", line 71, in view
     return self.dispatch(request, *args, **kwargs)
   File "/usr/lib/python2.7/dist-packages/django/views/generic/base.py", line 89, in dispatch
     return handler(request, *args, **kwargs)
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 159, in get
     handled = self.construct_tables()
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 150, in construct_tables
     handled = self.handle_table(table)
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 121, in handle_table
     data = self._get_data_dict() 
   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../horizon/tables/views.py", line 187, in _get_data_dict
     self._data = {self.table_class._meta.name: self.get_data()}   File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/dashboards/identity/projects/views.py", line 115, in get_data
     t.domain_name = domain_lookup.get(t.domain_id)
 AttributeError: 'NoneType' object has no attribute 'get'

I also installed devstack (stable/mitaka) and created same non-default domain, project and user. With user a member of domain alone, I was able to login to horizon. However when I navigate to see users etc, I see same error as above in logs. I did not see domains tab at all. Clicking on projects sort of lead to hung state. I am not totally sure if did everything in devstack to enable multi-domain support in horizon. I did try to make the same setting in openstack-dashboard/local_settings.py as we did for contrail

Revision history for this message

Deepinder Setia (dsetia) wrote on 2016-11-23:

Another observation - I am able to login to non-default domain as admin as long as there is no project in that domain. The moment I create a project, login as domain admin fails. This appears to be somehow related to identity:list_domains rule in policy.json

Revision history for this message

Deepinder Setia (dsetia) wrote on 2016-11-24:

https://bugs.launchpad.net/oslo.policy/+bug/1547684

Sudheendra Rao (sudheendra-k) on 2016-11-30

information type:	Proprietary → Public
tags:	added: blocker

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2016-11-30: [Review update] R3.2

Review in progress for https://review.opencontrail.org/26633
Submitter: Deepinder Setia (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2016-12-03: A change has been merged

Reviewed: https://review.opencontrail.org/26633
Committed: http://github.org/Juniper/contrail-provisioning/commit/659fc9185e1114d58e6910cf5bb7cd2004315a12
Submitter: Zuul (<email address hidden>)
Branch: R3.2

commit 659fc9185e1114d58e6910cf5bb7cd2004315a12
Author: Deepinder Setia <email address hidden>
Date: Wed Nov 30 14:07:12 2016 -0800

keystobe V3: make horizon identity policy file consistent with what is
used by keystone. Also, make the workaround suggested in the openstack bug
https://bugs.launchpad.net/oslo.policy/+bug/1547684

Change-Id: I20920887a63b84531ffb789877934aaa7099a3a8
Closes-Bug: #1612853

Revision history for this message

Deepinder Setia (dsetia) wrote on 2016-12-06:

Aswani,

I think the behavior is expected. Consider the following rule in keystone policy.json:

"identity:list_projects": "rule:cloud_admin or rule:admin_and_matching_domain_id”,
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s",

When user has role in project alone, s project scope token is generated. Thus the above rule will not match and UI will not be able to list own or any other project in the domain. The domain id in rule above is missing in a project scoped token.

If user is made admin of domain also, upon login, project tab and protect list will be visible as domain id is present in token and above rule matches.

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2016-12-06: [Review update] master

Review in progress for https://review.opencontrail.org/26851
Submitter: Deepinder Setia (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2016-12-12: [Review update] R3.2

#10

Review in progress for https://review.opencontrail.org/27150
Submitter: Deepinder Setia (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2016-12-13: A change has been merged

#12

Reviewed: https://review.opencontrail.org/27150
Committed: http://github.org/Juniper/contrail-provisioning/commit/b372c3adfa50625ca0449d133d6d4f1bfd5d82a5
Submitter: Zuul (<email address hidden>)
Branch: R3.2

commit b372c3adfa50625ca0449d133d6d4f1bfd5d82a5
Author: Deepinder Setia <email address hidden>
Date: Mon Dec 12 13:32:39 2016 -0800

Propagate the V3 keystone policy.json to Centos etc.

Change-Id: I9509e212f9537005cae1b362f506d6d84cad9aa0
Closes-Bug: #1612853

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-01-09: [Review update] R3.1

#13

Review in progress for https://review.opencontrail.org/27761
Submitter: Deepinder Setia (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-01-18: A change has been merged

#15

Reviewed: https://review.opencontrail.org/26851
Committed: http://github.org/Juniper/contrail-provisioning/commit/f09b077a1e51b6f28f5d72fc16c46b779e9ab877
Submitter: Zuul (<email address hidden>)
Branch: master

commit f09b077a1e51b6f28f5d72fc16c46b779e9ab877
Author: Deepinder Setia <email address hidden>
Date: Wed Nov 30 14:07:12 2016 -0800

keystobe V3: make horizon identity policy file consistent with what is
used by keystone. Also, make the workaround suggested in the openstack bug
https://bugs.launchpad.net/oslo.policy/+bug/1547684

Change-Id: I20920887a63b84531ffb789877934aaa7099a3a8
Closes-Bug: #1612853
(cherry picked from commit 659fc9185e1114d58e6910cf5bb7cd2004315a12)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-01-19:

#16

Reviewed: https://review.opencontrail.org/27761
Committed: http://github.org/Juniper/contrail-provisioning/commit/840101953ec7464e7e91948eca87856cad0d0cf6
Submitter: Zuul (<email address hidden>)
Branch: R3.1

commit 840101953ec7464e7e91948eca87856cad0d0cf6
Author: Deepinder Setia <email address hidden>
Date: Wed Nov 30 14:07:12 2016 -0800

keystobe V3: make horizon identity policy file consistent with what is
used by keystone. Also, make the workaround suggested in the openstack bug
https://bugs.launchpad.net/oslo.policy/+bug/1547684

Change-Id: I20920887a63b84531ffb789877934aaa7099a3a8
Closes-Bug: #1612853
(cherry picked from commit 659fc9185e1114d58e6910cf5bb7cd2004315a12)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-01-21: [Review update] R3.1

#17

Review in progress for https://review.opencontrail.org/28079
Submitter: Deepinder Setia (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-01-21: A change has been merged

#19

Reviewed: https://review.opencontrail.org/28079
Committed: http://github.org/Juniper/contrail-provisioning/commit/967e5409511371ebf8ce01e805be3a8c2985074d
Submitter: Zuul (<email address hidden>)
Branch: R3.1

commit 967e5409511371ebf8ce01e805be3a8c2985074d
Author: Deepinder Setia <email address hidden>
Date: Mon Dec 12 13:32:39 2016 -0800

Propagate the V3 keystone policy.json to Centos etc.

Change-Id: I9509e212f9537005cae1b362f506d6d84cad9aa0
Closes-Bug: #1612853
(cherry picked from commit b372c3adfa50625ca0449d133d6d4f1bfd5d82a5)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-03-08: [Review update] master

#20

Review in progress for https://review.opencontrail.org/29449
Submitter: Deepinder Setia (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-03-13: A change has been merged

#22

Reviewed: https://review.opencontrail.org/29449
Committed: http://github.org/Juniper/contrail-provisioning/commit/3e67a1350d84c8fa01d3198cb783fc1e0c3e11af
Submitter: Zuul (<email address hidden>)
Branch: master

commit 3e67a1350d84c8fa01d3198cb783fc1e0c3e11af
Author: Deepinder Setia <email address hidden>
Date: Mon Dec 12 13:32:39 2016 -0800

Propagate the V3 keystone policy.json to Centos etc.

Change-Id: I9509e212f9537005cae1b362f506d6d84cad9aa0
Closes-Bug: #1612853
(cherry picked from commit b372c3adfa50625ca0449d133d6d4f1bfd5d82a5)
(cherry picked from commit 967e5409511371ebf8ce01e805be3a8c2985074d)

Report a bug

This report contains Public information

Everyone can see this information.

Duplicates of this bug

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.