public base URL is returned in the links even though request is coming from admin URL

[Guang Yee]

Public base URL is returned in the links even though the request is coming from admin URL. Set both admin_endpoint and public_endpoint in keystone.conf and notice that public_endpoint is always use as the base URL in the links. i.e.

$curl -k -s -H 'X-Auth-Token: d5363c1fe9524972b891900002242087' http://localhost:5000/v3/policies | python -mjson.tool
{
    "links": {
        "next": null,
        "previous": null,
        "self": "https://public:5000/v3/policies"
    },
    "policies": []
}

$ curl -k -s -H 'X-Auth-Token: d5363c1fe9524972b891900002242087' http://localhost:35357/v3/policies | python -mjson.tool
{
    "links": {
        "next": null,
        "previous": null,
        "self": "https://public:5000/v3/policies"
    },
    "policies": []
}

This is related to https://bugs.launchpad.net/keystone/+bug/1381961

See

https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L419

[Brant Knudson (blk-u)]

Is keystone running under eventlet or apache mod_wsgi?

[Guang Yee (guang-yee)]

apache mod_wsgi

[Kent Wang (k.wang)]

Looks like similar bug and patch here: https://review.openstack.org/#/c/226464/

[Guang Yee (guang-yee)]

This bug can be addressed outside of Keystone by passing the appropriate X-Forwarded-* headers from the proxy or LB.