cron trigger uses trust-scoped token to create another token

[Boris Bobrov]

Mistral from RDO repo centos-openstack-ocata, package openstack-mistral-all.

I am trying to use a cron trigger. All actions are performed by user "admin" on project "admin". Workflow works fine when launched manually. The workflow is this: http://paste.openstack.org/show/609537/ . When launched using cron trigger with project_id=<id of project "admin">, i am getting this error: http://paste.openstack.org/show/609534/

[John Fulton (jfulton-org)]

This is also relevant if Heat calls Mistral [1], which produces the following same error when calling mistral.environments_get:

You are not authorized to perform the requested action: Using trust-scoped token to create another token. Create a new trust-scoped token instead.

If Heat is configured to not use Trusts, then the problem does not occur. Perhaps it can be addressed in mistral/mistralclient. I am using mistral custom action to get around the issue for now.

[1]
"""
heat_template_version: ocata
resources:
  workflow:
    type: OS::Mistral::Workflow
    properties:
      type: direct
      tasks:
        - name: task1
          action: mistral.environments_get name='my_env'
          publish:
            env: <% task(task1).result.variables %>
          on_sucess: [task2]
        - name: task2
          action: std.echo output=<% $.env %>
  execution:
    type: OS::Mistral::ExternalResource
    properties:
      actions:
        CREATE:
          workflow: {get_resource: workflow}
"""

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/447399
Committed: https://git.openstack.org/cgit/openstack/mistral/commit/?id=f2c8e0c2a17462a2b0a0ca8d22eee2342f41e149
Submitter: Jenkins
Branch: master

commit f2c8e0c2a17462a2b0a0ca8d22eee2342f41e149
Author: Andras Kovi <email address hidden>
Date: Wed Jun 14 16:31:30 2017 +0200

    Centralize session creation and authorization from OS clients

    Recently novaclient moved to keystoneauth. When a token is passed to it,
    an instance of Token auth plugin is used to handle it. The problem is
    that it tries to reauthenticate using the token. It is not possible
    with trust-scoped token.

    Here we centralize the session establishment for service client creation
    in most actions that enables the reuse of the existing token.

    Change-Id: Ibe9ee28a027e7a782adb8d8120d745259c4608da
    Co-Authored-By: Andras Kovi <email address hidden>
    Closes-Bug: 1690787

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/mistral 5.0.0.0b3 development milestone.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Dougal Matthews (<email address hidden>) on branch: master
Review: https://review.openstack.org/465521
Reason: Abandoning this patch per the Mistral Patch Abandonment guidelines
(https://specs.openstack.org/openstack/mistral-specs/specs/policy/patch-abandonment.html).
If you wish to have this restored and cannot do so yourself, please reach
out via #openstack-mistral on freenode or the OpenStack Dev mailing list.