return invalid user token error code to user (401) due to internal server error (500)

[Samuel XJ]

When a client executes a "nova boot" command, nova-api needs to communicate with keystone (via keystone/middleware/auth_token.py in essex version) to authenticate the user's token. If some internal error happens at the keystone side, for example, if keystone cannot connect to the database backend (mysqld in our case), then keystone will return a 500 status code to nova-api, indicating a server internal error.

However, when nova-api receives the response from keystone (in _validate_user_token in keystone/middleware/auth_token.py), it checks the response status code and in this case raises an InvalidUserToken exception, which in turn causes the external user (issuing "nova boot") to receive a 401 error code from nova-api.

It seems that in the above scenario, the external user should receive a 500 status code instead of a 401 status code from nova-api. The client's token is indeed valid so a 401 status code is confusing in this case.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/21235

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/30113

[Dolph Mathews (dolph)]

The first patch above merged in https://github.com/openstack/python-keystoneclient/commit/d3583cad27b1f667965573a737e4c6e5971e4285 but that does not address this bug.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/101206

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ajaya Agrawal (<email address hidden>) on branch: master
Review: https://review.openstack.org/101206

[Dolph Mathews (dolph)]

Has the above change been proposed against keystonemiddleware? If so, can someone provide a link here? Thanks!

[Ajaya Agrawal (ajayaa)]

dolphm: https://review.openstack.org/#/c/106010/

[Morgan Fainberg (mdrnstm)]

Adding bits of my comment from the review here:

I am not convinced that 500 because keystone is unavailable is the correct return code. The token was unable to be validated, this is a 401. It is an auth error not a Nova internal server error. In any case where we can't validate a token it should be 401.

Why would Nova return a 500 on an invalid token? It is not a failure within Nova.

[Ajaya Agrawal (ajayaa)]

++ Morgan Fainberg
This bug should be marked invalid.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Morgan Fainberg (<email address hidden>) on branch: master
Review: https://review.openstack.org/106010
Reason: Change is abandoned. This can be restored (by the author or a core member) if the conversation should continue.