keystone is set up incorrectly under Apache

[Sergey Kolekonov]

Currently Apache configuration files for Keystone miss the required options WSGIApplicationGroup and WSGIPassAuthorization which are suggested in the sample configuration file:
https://github.com/openstack/keystone/blob/master/httpd/wsgi-keystone.conf#L8
Without this options Keystone doesn't work under Apache, the following error is observed in Apache logs:
[Fri Oct 02 19:49:37.677555 2015] [:error] [pid 15349:tid 140661902604032] [remote 192.168.0.2:45934] ImportError: cannot import name dispatcher

The solution is to pass these options.

[Sergey Kolekonov (skolekonov)]

The issue is resolved here https://review.openstack.org/#/c/230633/

[Toni Ylenius (toni-ylenius)]

The fix should be backported to kilo branch of the puppet module, as we found the same issue in kilo release also. The older version python-keystone-2015.1.1 works fine, but the newer version python-keystone-2015.1.2 needs WSGIApplicationGroup or it will show

maalis 17 06:52:56 osdr-master0 httpd[16741]: [Thu Mar 17 06:52:56.203118 2016] [:error] [pid 16744] [remote 10.26.28.60:61898] ArgsAlreadyParsedError: arguments already parsed: cannot register CLI option

errors. We found the error after upgrading packages.

The commit in keystone that caused the issues is http://git.openstack.org/cgit/openstack/keystone/commit/?id=575da87ad5de9248ea1873bda6e45fb521987b6a (see http://git.openstack.org/cgit/openstack/keystone/log/?h=stable/kilo to check that the commit is in 2015.1.2). I verified manually that reverting this commit makes keystone to work without WSGIApplicationGroup.