Keystone fails negative tests with unauthenticated users

[Sylvain Bauza]

Some regression seemed to have been introduced yesterday with all Tempest negative tests for Keystone unauthenticated users.

Eg.

2016-05-04 08:12:02.993 | tempest.api.identity.admin.v2.test_roles_negative.RolesNegativeTestJSON.test_list_user_roles_request_without_token[id-682adfb2-fd5f-4b0a-a9ca-322e9bebb907,negative]
2016-05-04 08:12:02.994 | --------------------------------------------------------------------------------------------------------------------------------------------------------------------
2016-05-04 08:12:02.994 |
2016-05-04 08:12:02.994 | Captured pythonlogging:
2016-05-04 08:12:02.994 | ~~~~~~~~~~~~~~~~~~~~~~~
2016-05-04 08:12:02.994 | 2016-05-04 08:01:51,024 20000 INFO [tempest.lib.common.rest_client] Request (RolesNegativeTestJSON:test_list_user_roles_request_without_token): 401 POST http://127.0.0.1:35357/v2.0/tenants 0.172s
2016-05-04 08:12:02.994 | 2016-05-04 08:01:51,024 20000 DEBUG [tempest.lib.common.rest_client] Request - Headers: {'Content-Type': 'application/json', 'X-Auth-Token': '<omitted>', 'Accept': 'application/json'}
2016-05-04 08:12:02.994 | Body: {"tenant": {"name": "tempest-test_tenant-5956195", "description": "tempest-desc-1124620353", "enabled": true}}
2016-05-04 08:12:02.995 | Response - Headers: {'content-type': 'application/json', 'content-location': 'http://127.0.0.1:35357/v2.0/tenants', 'vary': 'X-Auth-Token', 'www-authenticate': 'Keystone uri="http://127.0.0.1:35357"', 'status': '401', 'connection': 'close', 'x-openstack-request-id': 'req-f48a58b7-4b21-4edb-8d46-d5d67b07e4bf', 'server': 'Apache/2.4.7 (Ubuntu)', 'content-length': '114', 'date': 'Wed, 04 May 2016 08:01:50 GMT'}
2016-05-04 08:12:02.995 | Body: {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
2016-05-04 08:12:02.995 |
2016-05-04 08:12:02.995 |
2016-05-04 08:12:02.995 | Captured traceback:
2016-05-04 08:12:02.995 | ~~~~~~~~~~~~~~~~~~~
2016-05-04 08:12:02.996 | Traceback (most recent call last):
2016-05-04 08:12:02.996 | File "tempest/api/identity/admin/v2/test_roles_negative.py", line 238, in test_list_user_roles_request_without_token
2016-05-04 08:12:02.996 | (user, tenant, role) = self._get_role_params()
2016-05-04 08:12:02.996 | File "tempest/api/identity/admin/v2/test_roles_negative.py", line 25, in _get_role_params
2016-05-04 08:12:02.996 | self.data.setup_test_user()
2016-05-04 08:12:02.996 | File "tempest/api/identity/base.py", line 254, in setup_test_user
2016-05-04 08:12:02.996 | self.setup_test_tenant()
2016-05-04 08:12:02.997 | File "tempest/api/identity/base.py", line 261, in setup_test_tenant
2016-05-04 08:12:02.997 | description=data_utils.rand_name('desc'))['tenant']
2016-05-04 08:12:02.997 | File "tempest/services/identity/v2/json/tenants_client.py", line 36, in create_tenant
2016-05-04 08:12:02.997 | resp, body = self.post('tenants', post_body)
2016-05-04 08:12:02.997 | File "tempest/lib/common/rest_client.py", line 259, in post
2016-05-04 08:12:02.997 | return self.request('POST', url, extra_headers, headers, body)
2016-05-04 08:12:02.998 | File "tempest/lib/common/rest_client.py", line 641, in request
2016-05-04 08:12:02.998 | resp, resp_body)
2016-05-04 08:12:02.998 | File "tempest/lib/common/rest_client.py", line 684, in _error_checker
2016-05-04 08:12:02.998 | raise exceptions.Unauthorized(resp_body, resp=resp)
2016-05-04 08:12:02.998 | tempest.lib.exceptions.Unauthorized: Unauthorized
2016-05-04 08:12:02.998 | Details: {u'title': u'Unauthorized', u'message': u'The request you have made requires authentication.', u'code': 401}
2016-05-04 08:12:02.998 |
http://logs.openstack.org/09/312009/2/check/gate-tempest-dsvm-postgres-full/918ec76/console.html#_2016-05-04_08_12_02_998

That impacts a lot of projects co-gating like Nova.
http://logstash.openstack.org/#/dashboard/file/logstash.json?from=86400s&query=message:\%22Details:%20{u%27title%27:%20u%27Unauthorized%27,%20u%27code%27:%20401,%20u%27message%27:%20u%27The%20request%20you%20have%20made%20requires%20authentication.%27}\%22

[Matt Riedemann (mriedem)]

This started in the gate around 4/29 which is when devstack was changed to use fernet tokens by default:

https://github.com/openstack-dev/devstack/commit/5b83e986de80cffb26ac717121458545c78d6245

[Matt Riedemann (mriedem)]

Possibly related to bug 1577558 .