When authenticating against v3, if the domain is excluded a 401 Unauthenticated is returned

[Ian Cordasco]

Example code:

http://paste.openstack.org/show/333596/

Steps to reproduce:

0. Set-up Keystone from master
1. Create a keystoneclient.v3.client.Client instance with a valid token
1. i. test that the token is valid by listing something (e.g., users.list())
2. Call keystone.users.create(name='...', password='...', project='...')
3. Keystone returns a 401 Unauthenticated.

This is clearly incorrect. A 422 might be closer to the truth if it were used a Validation Failed status code (as GitHub and others use it).

The client is authenticated and authentication will not fail. There is something missing from the request though.

[Henry Nash (henry-nash)]

So it's not quite as simple as that. First a 401/403 basically means "you don't have authorization to do the thing you just tried to do". This could be that you are not authenticated, or that your are authenticated but don't have the role assignments (I.e. authorization) needed to carry out the action of the API".

For user/group API create calls, the Identity spec says that if the domain is not provided in the request body, then the domain that the token is scoped to will be used. So in this case, keystone is trying to say "So you didn't put the domain_id in the request body, and I looked at the token and the you don't have the required roles on the domain the token is scoped to execute that call on that domain". I guess you could argue that if the token is not domain scoped (i.e. project scoped), then we should issue a validation error. However, for backward compatibility reasons, in the case where you only have a project scoped token, we default to trying the default domain (this is not nice, and I'd like us to deprecate this bit). So in fact, what keystone is telling you is:

"So you didn't put the domain_id in the request body, and I looked at the token and the you don't have the required roles on the domain the token is scoped to execute that call on that domain, or if it's a project scoped token, then I checked the default domain and you don't have the required roles there either."

Since you have a valid token, I would have actually executed a 403 from your call (although I have a suspision we might coerce, in non debug mode, things to a 401 to not give attackers any clue as to where they are going wrong.....I need to check if that is true)

[jiaxi (tjxiter)]

If the domain is excluded, keystone will use the default domain.It works fine in my development environment.

[Morgan Fainberg (mdrnstm)]

401 should only occur if the token is either invalid or non-existent. 403 should be the return if the current scope is not allowed (aka, you do not have access to the domain [default]?).

Likely this should be a 400 (bad request) as the domain should be required?

[Kent Wang (k.wang)]

I was researching this bug. Looks like Henry Nash submitted another bug report for this issue here: https://bugs.launchpad.net/keystone/+bug/1482330 with his patch merged: https://review.openstack.org/#/c/209848/6