horizon login fails with TLS enabled

[bjolo]

everything works without TLS. Destroy and deploy and TLS works on commandline and also curl -i -H with admin and password inside the horizon container works. However, login to the web UI does not work.

Error message on horizon UI is: "Unable to establish connection to keystone endpoint."

horizon debug log.
http://paste.openstack.org/show/582247/

Keystone log show nothing, like horizon does not even try to contact keystone. i.e. it really fails to find keystone.

[zhubingbing (zhubingbing)]

i can't reproduce this bug, can you give me more information ?

[bjolo (bjorn-lofdahl)]

have not tried since i created the bug report, but that was a while ago. Let me try again to see if i can reproduce.

[Paul Bourke (pauldbourke)]

I see from the logs:

[Tue Sep 20 15:53:06.670637 2016] [:error] [pid 19] Unable to establish connection to https://foglight.mydomain.net:5000/v3/auth/tokens

Is that the correct domain for your keystone endpoint?

[bjolo (bjorn-lofdahl)]

hi all,

can confirm that i just reproduced the bug. centos source; kolla master

pbourke: no that is not my real domain, but the DNS is working properly. As stated initially, a deployment w/o TLS works just fine. Then I enable TLS in globals.yml and login to horizon does not work.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/386975

[Steven Dake (sdake)]

bjolo,

Can you verify by cherrypicking the proposed patches and see if they resolve the TLS problem? Hit me up on IRC if you need any help so we can get this fixed and closed out for 3.0.0.

Thanks!
-steve

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/386975
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=cc2dde0854e72ed3361f8a7b54cde091a04e17cc
Submitter: Jenkins
Branch: master

commit cc2dde0854e72ed3361f8a7b54cde091a04e17cc
Author: Dave McCowan <email address hidden>
Date: Sat Oct 15 18:50:41 2016 -0400

    OpenStack Services Should Use keystone_internal_url for auth

    Horizon and Neutron mistakenly were using keystone_public_url
    for authentication. This works without error in deployments
    when the internal services happen to have access to the
    public network, but it is still wrong. This fails to work
    when the internal services can not access the public URLs,
    for example when TLS is enabled on the public endppoints.

    This patches corrects horizon and neutron to use
    keystone_internal_url for auth.

    Change-Id: I59b9094364bef375036028ba86a771dabf28c963
    Closes-bug: #1625648

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/387051
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=c6cd09b3c0a0b9e3327f63056ee6d649b222d463
Submitter: Jenkins
Branch: stable/newton

commit c6cd09b3c0a0b9e3327f63056ee6d649b222d463
Author: Dave McCowan <email address hidden>
Date: Sat Oct 15 18:50:41 2016 -0400

    OpenStack Services Should Use keystone_internal_url for auth

    Horizon and Neutron mistakenly were using keystone_public_url
    for authentication. This works without error in deployments
    when the internal services happen to have access to the
    public network, but it is still wrong. This fails to work
    when the internal services can not access the public URLs,
    for example when TLS is enabled on the public endppoints.

    This patches corrects horizon and neutron to use
    keystone_internal_url for auth.

    Change-Id: I59b9094364bef375036028ba86a771dabf28c963
    Closes-bug: #1625648

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 3.0.0.0rc3 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 4.0.0.0b1 development milestone.