EmptyCatalog raised when the catalog is not empty

[Dmitry Tantsur]

I'm creating a session inside of a Mistral action with something like

 Session(auth=Token(context.auth_uri, context.auth_token))

(where Token is keystoneauth.identity.v3.Token). When I (or rather ironicclient) call get_endpoint on it, I get

2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor File "/usr/lib/python2.7/site-packages/ironicclient/client.py", line 139, in get_client
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor region_name=os_region_name
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 223, in get_endpoint
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor return self.session.get_endpoint(auth or self.auth, **kwargs)
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 1077, in get_endpoint
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor return auth.get_endpoint(self, **kwargs)
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor File "/usr/lib/python2.7/site-packages/keystoneauth1/identity/base.py", line 380, in get_endpoint
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor allow_version_hack=allow_version_hack, **kwargs)
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor File "/usr/lib/python2.7/site-packages/keystoneauth1/identity/base.py", line 279, in get_endpoint_data
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor service_name=service_name)
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor File "/usr/lib/python2.7/site-packages/keystoneauth1/access/service_catalog.py", line 425, in endpoint_data_for
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor raise exceptions.EmptyCatalog('The service catalog is empty.')
2018-07-25 14:58:43.128 6277 ERROR mistral.executors.default_executor EmptyCatalog: The service catalog is empty.

Whatever causes it, the exception is not true: I certainly have a populated catalog. If the problem is on the caller side, a clearer exception is needed.

[Dmitry Tantsur (divius)]

What I figured out so far is that Token creates unscoped auth_refs even if the initial token was project scoped. And the service catalog is indeed not present. However, it's still confusing for the caller, and I still have no clue what to fix.

[Morgan Fainberg (mdrnstm)]

Unscoped tokens do not have a catalog. It is something we are looking at in Keystone's server. If a token isn't explicitly scoped this is the correct behavior. I understand it is confusing but not something keystoneauth is doing incorrectly.

[Morgan Fainberg (mdrnstm)]

Ensure that any calls to rescope the token always include a desired scope and no "just get a token" intermediate step.