OpenStack Identity (keystone)

kilo version swift doesn't work showing swiftclient:Authorrization Failure the resource could not be found

Bug #1469974 reported by Yao Long
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Invalid
Undecided
Unassigned
python-swiftclient
Incomplete
Undecided
Unassigned

Bug Description

# swift --debug list
DEBUG:keystoneclient.auth.identity.v2:Making authentication request to http://swift-test-keystone:35357/v3/tokens
INFO:urllib3.connectionpool:Starting new HTTP connection (1): swift-test-keystone
DEBUG:urllib3.connectionpool:"POST /v3/tokens HTTP/1.1" 404 93
DEBUG:keystoneclient.session:Request returned failure status: 404
ERROR:swiftclient:Authorization Failure. Authorization Failed: The resource could not be found. (HTTP 404) (Request-ID: req-93f815b5-7c3b-462e-b3c9-8c0ecf9f4da3)
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 1235, in _retry
    self.url, self.token = self.get_auth()
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 1209, in get_auth
    insecure=self.insecure)
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 406, in get_auth
    auth_version=auth_version)
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 341, in get_auth_keystone
    raise ClientException('Authorization Failure. %s' % err)
ClientException: Authorization Failure. Authorization Failed: The resource could not be found. (HTTP 404) (Request-ID: req-93f815b5-7c3b-462e-b3c9-8c0ecf9f4da3)
Authorization Failure. Authorization Failed: The resource could not be found. (HTTP 404) (Request-ID: req-93f815b5-7c3b-462e-b3c9-8c0ecf9f4da3)

Setup of this environment is based on installation guide of kilo version. The openstack service on keystone node works just fine but swift doesn't.

After then I modified the openstack client enviroment scripts from
export OS_AUTH_URL=http://controller:35357/v3
to
export OS_AUTH_URL=http://controller:35357/v2.0

the debug info is as below

DEBUG:keystoneclient.auth.identity.v2:Making authentication request to http://swift-test-keystone:35357/v2.0/tokens
INFO:urllib3.connectionpool:Starting new HTTP connection (1): swift-test-keystone
DEBUG:urllib3.connectionpool:"POST /v2.0/tokens HTTP/1.1" 200 1213
DEBUG:iso8601.iso8601:Parsed 2015-06-30T08:21:48Z into {'tz_sign': None, 'second_fraction': None, 'hour': u'08', 'daydash': u'30', 'tz_hour': None, 'month': None, 'timezone': u'Z', 'second': u'48', 'tz_minute': None, 'year': u'2015', 'separator': u'T', 'monthdash': u'06', 'day': None, 'minute': u'21'} with default timezone <iso8601.iso8601.Utc object at 0x7f070f511590>
DEBUG:iso8601.iso8601:Got u'2015' for 'year' with default None
DEBUG:iso8601.iso8601:Got u'06' for 'monthdash' with default 1
DEBUG:iso8601.iso8601:Got 6 for 'month' with default 6
DEBUG:iso8601.iso8601:Got u'30' for 'daydash' with default 1
DEBUG:iso8601.iso8601:Got 30 for 'day' with default 30
DEBUG:iso8601.iso8601:Got u'08' for 'hour' with default None
DEBUG:iso8601.iso8601:Got u'21' for 'minute' with default None
DEBUG:iso8601.iso8601:Got u'48' for 'second' with default None
INFO:urllib3.connectionpool:Starting new HTTP connection (1): swift-test-proxynode1
DEBUG:urllib3.connectionpool:"GET /v1/AUTH_c29f928f72f146fc9411e35c515c00a7?format=json HTTP/1.1" 401 131
INFO:swiftclient:REQ: curl -i http://swift-test-proxynode1:8080/v1/AUTH_c29f928f72f146fc9411e35c515c00a7?format=json -X GET -H "X-Auth-Token: a09f170245314c3583c477ac36b5508b"
INFO:swiftclient:RESP STATUS: 401 Unauthorized
INFO:swiftclient:RESP HEADERS: [('content-length', '131'), ('connection', 'keep-alive'), ('x-trans-id', 'tx2c1fe6ed35674405a65c3-005592438c'), ('date', 'Tue, 30 Jun 2015 07:21:48 GMT'), ('content-type', 'text/html; charset=UTF-8'), ('www-authenticate', 'Swift realm="AUTH_c29f928f72f146fc9411e35c515c00a7"')]
INFO:swiftclient:RESP BODY: <html><h1>Unauthorized</h1><p>This server could not verify that you are authorized to access the document you requested.</p></html>
DEBUG:keystoneclient.auth.identity.v2:Making authentication request to http://swift-test-keystone:35357/v2.0/tokens
INFO:urllib3.connectionpool:Starting new HTTP connection (1): swift-test-keystone
DEBUG:urllib3.connectionpool:"POST /v2.0/tokens HTTP/1.1" 200 1213
DEBUG:iso8601.iso8601:Parsed 2015-06-30T08:21:49Z into {'tz_sign': None, 'second_fraction': None, 'hour': u'08', 'daydash': u'30', 'tz_hour': None, 'month': None, 'timezone': u'Z', 'second': u'49', 'tz_minute': None, 'year': u'2015', 'separator': u'T', 'monthdash': u'06', 'day': None, 'minute': u'21'} with default timezone <iso8601.iso8601.Utc object at 0x7f070f511590>
DEBUG:iso8601.iso8601:Got u'2015' for 'year' with default None
DEBUG:iso8601.iso8601:Got u'06' for 'monthdash' with default 1
DEBUG:iso8601.iso8601:Got 6 for 'month' with default 6
DEBUG:iso8601.iso8601:Got u'30' for 'daydash' with default 1
DEBUG:iso8601.iso8601:Got 30 for 'day' with default 30
DEBUG:iso8601.iso8601:Got u'08' for 'hour' with default None
DEBUG:iso8601.iso8601:Got u'21' for 'minute' with default None
DEBUG:iso8601.iso8601:Got u'49' for 'second' with default None
INFO:urllib3.connectionpool:Starting new HTTP connection (1): swift-test-proxynode1
DEBUG:urllib3.connectionpool:"GET /v1/AUTH_c29f928f72f146fc9411e35c515c00a7?format=json HTTP/1.1" 401 131
INFO:swiftclient:REQ: curl -i http://swift-test-proxynode1:8080/v1/AUTH_c29f928f72f146fc9411e35c515c00a7?format=json -X GET -H "X-Auth-Token: da37d9a994574b04be2cd5f5c2ef5af4"
INFO:swiftclient:RESP STATUS: 401 Unauthorized
INFO:swiftclient:RESP HEADERS: [('content-length', '131'), ('connection', 'keep-alive'), ('x-trans-id', 'tx74abf5b51bea41f0976bd-005592438d'), ('date', 'Tue, 30 Jun 2015 07:21:49 GMT'), ('content-type', 'text/html; charset=UTF-8'), ('www-authenticate', 'Swift realm="AUTH_c29f928f72f146fc9411e35c515c00a7"')]
INFO:swiftclient:RESP BODY: <html><h1>Unauthorized</h1><p>This server could not verify that you are authorized to access the document you requested.</p></html>
ERROR:swiftclient:Account GET failed: http://swift-test-proxynode1:8080/v1/AUTH_c29f928f72f146fc9411e35c515c00a7?format=json 401 Unauthorized [first 60 chars of response] <html><h1>Unauthorized</h1><p>This server could not verify t
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 1243, in _retry
    rv = func(self.url, self.token, *args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 496, in get_account
    http_response_content=body)
ClientException: Account GET failed: http://swift-test-proxynode1:8080/v1/AUTH_c29f928f72f146fc9411e35c515c00a7?format=json 401 Unauthorized [first 60 chars of response] <html><h1>Unauthorized</h1><p>This server could not verify t
Account GET failed: http://swift-test-proxynode1:8080/v1/AUTH_c29f928f72f146fc9411e35c515c00a7?format=json 401 Unauthorized [first 60 chars of response] <html><h1>Unauthorized</h1><p>This server could not verify t

See original description
Yao Long (yao.long)
description: updated
Revision history for this message
Alistair Coles (alistair-coles) wrote :

Could you be specific about the environment variables you have set for the first example you give?

Also, please confirm that when using OS_AUTH_URL=http://controller:35357/v3 you are also setting the auth version to 3 as shown in the swift client usage examples:

```
  swift --os-auth-url https://api.example.com/v3 --auth-version 3\
      --os-project-name project1 --os-project-domain-name domain1 \
      --os-username user --os-user-domain-name domain1 \
      --os-password password list

  swift --os-auth-url https://api.example.com/v3 --auth-version 3\
      --os-project-id 0123456789abcdef0123456789abcdef \
      --os-user-id abcdef0123456789abcdef0123456789 \
      --os-password password list
```

Changed in python-swiftclient:
status: New → Incomplete
Revision history for this message
Yao Long (yao.long) wrote :

Hi Alistair, I'm using 5 VMs for the setup. 1 for mariadb, one for keystone, and proxy-server & swift node are all installed on the other 3. I'm following the installation guide of kilo version on ubuntu1404. The openstack apache2 service instead of keystone service is running on keystone node. The openstack client enviroment scripts on keystone is as below:

export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=admin
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=password@123
export OS_AUTH_URL=http://swift-test-keystone:35357/v3

keystone endpoint configurationis as below

+--------------+----------------------------------+
| Field | Value |
 +--------------+----------------------------------+
| adminurl | http://swift-test-keystone:35357 |
| enabled | True |
| id | e153027294644a2fac2f543c996a4f1c |
| internalurl | http://swift-test-keystone:5000 |
| publicurl | http://swift-test-keystone:5000 |
| region | RegionOne |
| service_id | 051c84ee0775433c91fc6e352e0af85f |
| service_name | keystone |
| service_type | identity |
 +--------------+----------------------------------+

swift endpoint configuration is as below

+--------------+---------------------------------------------------------+
| Field | Value |
 +--------------+---------------------------------------------------------+
| adminurl | http://swift-test-proxynode1:8080 |
| enabled | True |
| id | b3ebf6c7b6554d3695c35bc3c1ada008 |
| internalurl | http://swift-test-proxynode1:8080/v1/AUTH_%(tenant_id)s |
| publicurl | http://swift-test-proxynode1:8080/v1/AUTH_%(tenant_id)s |
| region | RegionOne |
| service_id | 63db3fd78a784a77a33f33ad44cecaa6 |
| service_name | swift |
| service_type | object-store |
 +--------------+---------------------------------------------------------+

proxy-server.conf on swift-proxynode is as below
[filter:authtoken]
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
auth_uri = http://swift-test-keystone:5000
auth_url = http://swift-test-keystone:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = swift
password = ****
delay_auth_decision = true

also I tried your method using the auth version 3 still got the 401 unauthorized failure.

Revision history for this message
Wu Hong Guang (whg) wrote :

append --auth-version 3 to swift cmd works for me

John Dickinson (notmyname)
no longer affects: swift
Revision history for this message
Steve Martinelli (stevemar) wrote :

sounds like this was user error in the way auth_version was being passed in, doesn't affect keystone

Changed in keystone:
status: New → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.