AH01630: client denied by server configuration

[men]

openstack :Newton

[root@controller01 ~]# tail -f /var/log/httpd/error_log

[Tue Jun 13 15:54:24.720280 2017] [authz_core:error] [pid 8700] [client 172.16.21.5:56228] AH01630: client denied by server configuration: /usr/bin/keystone-wsgi-public, referer: http://172.16.21.100/dashboard/admin/flavors/

[Tue Jun 13 15:54:30.433343 2017] [authz_core:error] [pid 501] [client 172.16.21.5:56346] AH01630: client denied by server configuration: /usr/bin/keystone-wsgi-public, referer: http://172.16.21.100/dashboard/identity/

Where is it wrong?

Does the refreshing update of the instances in the dashboard be related to this error?

[Kristi Nikolla (knikolla)]

It seems like an issue with your apache configuration. Can you provide more details like installation method and your apache configuration?

[men (keyi)]

https://docs.openstack.org/newton/install-guide-rdo/keystone-install.html#install-and-configure-components

Hello, my installation steps are as follows

yum install openstack-keystone httpd mod_wsgi

[root@controller01 ~]# egrep -v "^#|^$|*#" /etc/httpd/conf/httpd.conf
ServerRoot "/etc/httpd"
Listen 172.16.21.5:80
Include conf.modules.d/*.conf
User apache
Group apache
ServerAdmin root@localhost
ServerName 172.16.21.5:80
<Directory />
    AllowOverride none
    Require all denied
</Directory>
DocumentRoot "/var/www/html"
<Directory "/var/www">
    AllowOverride None
    Require all granted
</Directory>
<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>
<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>
<Files ".ht*">
    Require all denied
</Files>
ErrorLog "logs/error_log"
LogLevel warn
<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    <IfModule logio_module>
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>
    CustomLog "logs/access_log" combined
</IfModule>
<IfModule alias_module>
    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>
<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>
<IfModule mime_module>
    TypesConfig /etc/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType text/html .shtml
    AddOutputFilter INCLUDES .shtml
</IfModule>
AddDefaultCharset UTF-8
<IfModule mime_magic_module>
    MIMEMagicFile conf/magic
</IfModule>
EnableSendfile on
IncludeOptional conf.d/*.conf

[root@controller01 ~]# cat /etc/httpd/conf.d/wsgi-keystone.conf
Listen 172.16.21.5:5000
Listen 172.16.21.5:35357

<VirtualHost *:5000>
    WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-public
    WSGIScriptAlias / /usr/bin/keystone-wsgi-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    LimitRequestBody 114688
    <IfVersion >= 2.4>
      ErrorLogFormat "%{cu}t %M"
    </IfVersion>
    ErrorLog /var/log/httpd/keystone.log
    CustomLog /var/log/httpd/keystone_access.log combined

    <Directory /usr/bin>
        <IfVersion >= 2.4>
            Require all granted
        </IfVersion>
        <IfVersion < 2.4>
            Order allow,deny
            Allow from all
        </IfVersion>
    </Directory>
</VirtualHost>

<VirtualHost *:35357>
    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-admin
    WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    LimitRequestBody 114688
    <IfVersion >= 2.4>
      ErrorLogFormat "%{cu}t %M"
    </IfVersion>
    ErrorLog /var/log/httpd/keystone.log
    CustomLog /var/log/httpd/keystone_access.log combined

    <Directory /usr/bin>
        <IfVersion >= 2.4>
            Require all gra...

[Lance Bragstad (lbragstad)]

Are you able to share any traces that may be available in your apache logs?

[Launchpad Janitor (janitor)]

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]

[changlimin (changlimin)]

Try add <Directory ...>

Alias /identity /usr/bin/keystone-wsgi-public
<Directory "/usr/bin">
    Require all granted
</Directory>

[Takehiko OGASAWARA (ogalush)]

Hello.
I also experienced a similar case at Ussuri on CentOS8.
It has been fixed by the following changes.
I recommend checking to your horizon's local_settings.
```
(1) ErrorLog
----
$ sudo grep 'AH01630' /var/log/httpd/error_log | tail -n 1
[Sun Aug 02 19:01:26.551032 2020] [authz_core:error] [pid 8331:tid 140194208229120] [client 192.168.3.200:35800] AH01630: client denied by server configuration: /usr/bin/keystone-wsgi-public
$
----

(2) Fix Config
----
/etc/openstack-dashboard/local_settings
OPENSTACK_HOST = "controller ip address."
- OPENSTACK_KEYSTONE_URL = "http://%s/identity/v3" % OPENSTACK_HOST
+ OPENSTACK_KEYSTONE_URL = "http://%s:5000/identity/v3" % OPENSTACK_HOST
----

(3) My Environment
CentOS 8 + Ussuri
----
$ cat /etc/redhat-release
CentOS Linux release 8.2.2004 (Core)
$ rpm -q openstack-dashboard
openstack-dashboard-18.3.2-1.el8.noarch
----
```
regards.

[Helder Marques (hlourencomarques)]

Hello,

I also experienced a similar case at Victoria on Ubuntu.

The solution of Takehiko OGASAWARA (ogalush) worked for me too.

Edit /etc/openstack-dashboard/local_settings.py

- OPENSTACK_KEYSTONE_URL = "http://%s/identity/v3" % OPENSTACK_HOST
+ OPENSTACK_KEYSTONE_URL = "http://%s:5000/identity/v3" % OPENSTACK_HOST

Environment:
Ubuntu 20.04.1 LTS (focal)
OpenStack Victoria

Best Regards,

Helder Marques