Token authentication fails with 500 error

[Taekyun Kim]

Token authentication fails when using a token issued via application credential.

Below code demonstrate the failure.
(I used keystoneauth1 but plain HTTP requests with curl will also fail.)

=== Beginning of code ===

from keystoneauth1 import identity
from keystoneauth1 import session

app_cred = identity.V3ApplicationCredential(
    auth_url='http://10.11.22.100/identity',
    application_credential_id='<app-cred-id>',
    application_credential_secret='<app-cred-secret>',
)

session_app_cred = session.Session(auth=app_cred)
ref = app_cred.get_auth_ref(session=session_app_cred)

token = identity.Token(
    auth_url='http://10.11.22.100/identity',
    token=ref.auth_token,
    project_name='demo',
    project_domain_name='default',
)

session_token = session.Session(auth=token)
res = token.get_auth_ref(session=session_token)
print(res.auth_token)

=== End of code ===

The error was caused by below code line.
https://opendev.org/openstack/keystone/src/commit/0bc2af48d5eabb59627f0b733a9fec42ff3759aa/keystone/api/_shared/authentication.py#L212

If it is the case that the token should not be authenticated, correct error response should be produced.
Otherwise, the authentication should be successful.

I made a simple fix to this problem and applied to my deployment.
Please check the problem and feel free to ask me for any futher details.

Thanks.

[David Wilde (dave-wilde)]

Hi,

I think you are correct, the exception should be caught and handled correctly. Are you able to provide the fix you have implemented?

Thanks!

[Taekyun Kim (podain)]

Yes sure, will post patch on the gerrit soon.

[Taekyun Kim (podain)]

This is a duplicate of https://bugs.launchpad.net/keystone/+bug/1878438
Any further discussions will continue on the original issue.