Puppet's manifest puppet-keystone/manifests/wsgi/apache.pp doesn't enforce $keystone_wsgi_script_path permissions. In the case of more restrictive, system-wide umask setting directory may become inaccessible for web-server resulting in keystone failures.
This has been confirmed when I was working with Red Hat OpenStack Platform 9 including this code:
$ umask
0077
drwx------. 2 keystone 51 Nov 28 05:44 /var/www/cgi-bin/keystone
during the deployment with RH OSP director:
Notice: /Stage[main]/Keystone::Service/Service[keystone]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Apache::Service/Service[httpd]/ensure: ensure changed 'stopped' to 'running'
Notice: /Stage[main]/Keystone::Deps/Anchor[keystone::service::end]: Triggered 'refresh' from 26 events
Error: Could not prefetch keystone_service provider 'openstack': Could not authenticate
Error: Not managing Keystone_service[Image Service] due to earlier Keystone API failures.
Error: /Stage[main]/Glance::Keystone::Auth/Keystone::Resource::Service_identity[glance]/Keystone_service[Image Service::image]/ensure: change from absent to present failed: Not managing Keys
tone_service[Image Service] due to earlier Keystone API failures.
in /var/log/httpd/keystone_wsgi_main_error.log:
[Mon Nov 28 05:46:05.899651 2016] [core:error] [pid 23270] (13)Permission denied: [client 192.168.111.1:46948] AH00035: access to /v2.0/tokens denied (filesystem path '/var/www/cgi-bin/keyst
one/keystone-public') because search permissions are missing on a component of the path
[Mon Nov 28 05:46:20.907486 2016] [core:error] [pid 23264] (13)Permission denied: [client 192.168.111.1:46982] AH00035: access to /v2.0 denied (filesystem path '/var/www/cgi-bin/keystone/key
stone-public') because search permissions are missing on a component of the path
[Mon Nov 28 05:46:20.911575 2016] [core:error] [pid 23269] (13)Permission denied: [client 192.168.111.1:46984] AH00035: access to /v2.0/tokens denied (filesystem path '/var/www/cgi-bin/keyst
one/keystone-public') because search permissions are missing on a component of the path
[Mon Nov 28 05:46:35.907123 2016] [core:error] [pid 23270] (13)Permission denied: [client 192.168.111.1:46988] AH00035: access to /v2.0 denied (filesystem path '/var/www/cgi-bin/keystone/key
stone-public') because search permissions are missing on a component of the path
Fix proposed to branch: master
Review: https:/