token + service_url based authentication

[Attila Fazekas]

The keystone service provides a token which is usable for accessing all OpenStack services.
A single REST token-get response also contains all service endpoints.

So after a token-get no future keystone communication required on the client side until the token expires (24h).

The glance, neutron, and keystone clients are able to use the already acquired tokens, but the python-novaclient and python-cinderclient not yet.

Example usage with glance CLI:
https://github.com/openstack-dev/devstack/blob/master/functions#L1168

The CLI usage is not efficient with a frequent token-get, it is major issue when you use the client from a shell scripts.

IMHO token based authentication is nicer in python scripts as well.

[Joe Gordon (jogo)]

This is a two part bug, one we the keyring is disabled by default and two its broken: https://bugs.launchpad.net/python-novaclient/+bug/1039572

Once we fix the keyring we should enable it by default as long as the dependencies are there.

[Lorin Hochstein (lorinh)]

Would definitely like to be able to authenticate against an endpoint in a Python script using an existing token.

[Jacob Godin (jacobgodin)]

Has there been any traction on this? It looks like https://bugs.launchpad.net/python-novaclient/+bug/1039572 has been fixed.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/74602

[git-harry (git-harry)]

@Masco Kaliyamoorthy - you haven't updated your proposed fix in several months. I was going to rebase it for you to get things moving along, but so much has changed on the project since you submitted it I found it was easy to write a new patch. I will submit my patch but if you would like to get yours merged instead please update it and let me know and I will abandon mine.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/111051

[OpenStack Infra (hudson-openstack)]

Change abandoned by Mike Perez (<email address hidden>) on branch: master
Review: https://review.openstack.org/74602

[OpenStack Infra (hudson-openstack)]

Change abandoned by Sean McGinnis (<email address hidden>) on branch: master
Review: https://review.openstack.org/111051
Reason: This review is > 8 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Ashish Singh (ashish-singh7)]

Guys, Can somebody tell me if there are some activity going on in here? Is there any way to reuse keystone auth_token for authentication with cinder?

[Matt Riedemann (mriedem)]

Is this still valid now that python-novaclient uses keystoneauth1 with sessions?

[Sean McGinnis (sean-mcginnis)]

Same question for Cinder that Matt had. Cinder has switched over to keystoneauth1 now. Is this still an issue? Closing as Invalid for now, but if still needed please reopen it.