OAUTH functional tests are broken on stable/ocata and stable/newton

[Colleen Murphy]

Example failed job: http://logs.openstack.org/06/482606/1/check/gate-keystone-dsvm-functional-ubuntu-xenial/3bfe409/

Example failure: http://paste.openstack.org/show/615277/

Relevant logs: http://paste.openstack.org/show/615276/

[Lance Bragstad (lbragstad)]

Those tests were recently added to the keystone-tempest-plugin [0]. It could be that they didn't pass against stable/ocata or stable/newton, but they just weren't tested.

Not much has changed in stable/ocata or stable/newton recently.

[0] https://review.openstack.org/#/c/473245/

[Lance Bragstad (lbragstad)]

It looks like anything dealing with the request_token is failing:

http://logs.openstack.org/06/482606/1/check/gate-keystone-dsvm-functional-ubuntu-xenial/3bfe409/logs/apache/access.txt.gz

[Lance Bragstad (lbragstad)]

One possible solution until we figure out exactly what is going on would be to revert https://review.openstack.org/#/c/473245/3.

FWIW - I'm not sure how much of a difference this makes yet - but the request to create a request token are getting made to the identity_v2_admin endpoint. Other requests are being made to identity/v3/. I'm sure that just how devstack and tempest are configured though, they should route to the same v3 path.

[Lance Bragstad (lbragstad)]

Actually - https://review.openstack.org/#/c/473245/3 was proposed because we asked Hemanth to add functional tests for another bug he was fixing [0]. That bug was dealing with a case where creating a request token resulted in a 401. I don't think the patch for that fix was backported to stable/ocata or stable/newton, which would make complete sense as to why both of those branches are failing with 401s in the OAUTH1 tests.

I'll backport the original fix [1] to bug 1687593.

[0] https://bugs.launchpad.net/keystone/+bug/1687593
[1] https://review.openstack.org/#/c/461736/

[Lance Bragstad (lbragstad)]

I've attempted to summarize what I've found on the mailing list [0].

[0] http://lists.openstack.org/pipermail/openstack-dev/2017-July/119684.html

[Jeremy Stanley (fungi)]

To avoid similar wedges, changes to the openstack/tempest repository's master branch (the only branch it has) are tested against supported stable branch versions of some tempest jobs like gate-tempest-dsvm-neutron-full-ubuntu-xenial-ocata and gate-tempest-dsvm-neutron-full-ubuntu-xenial-newton. You might consider creating branch-overridden versions of gate-keystone-dsvm-functional-ubuntu-xenial along those lines.

[Lance Bragstad (lbragstad)]

Thanks for the information, Jeremy. Would that be using the BRANCH_OVERRIDE bits [0]? I'm going to mark this as fixed since the issue it resolve, but I'll continue following up so we get the coverage describing in comment #6.

[0] https://github.com/openstack-infra/project-config/blob/cb33e387046dffb5fa23cd50bb624b323c5def68/jenkins/jobs/keystone.yaml#L23