V3 token fails with KeyError 'expires'

[Brant Knudson]

If I get a token using the V3 API and then pass that token to nova, it fails with a 401 error.

A valid token generated using the V3 API shoud work with nova.

The stack trace in n-api looks like this:

2013-03-28 17:06:32 DEBUG [keystoneclient.middleware.auth_token] Token validation failure.
Traceback (most recent call last):
  File "/opt/stack/python-keystoneclient/keystoneclient/middleware/auth_token.py", line 693, in _validate_user_token
    self._cache_put(token_id, data)
  File "/opt/stack/python-keystoneclient/keystoneclient/middleware/auth_token.py", line 937, in _cache_put
    timestamp = data['token']['expires']
KeyError: 'expires'

I'm using devstack and have not changed the config.

Here's the command to get a token:

curl -i \
 -d '
{
"auth": {
    "identity": {
        "methods": [ "password" ],
        "password": {
            "user": {
                "name": "admin", "password": "mypassword",
                "domain": { "id": "default" }
              }
          }
      },
    "scope": {
        "project": {
            "domain": { "id": "default" },
            "name": "admin"
          }
      }
  }
}' \
 -H "Content-Type: application/json" \
 http://localhost:35357/v3/auth/tokens

Then I pass it on to nova (I get the token ID from the header, and put it in TOKEN_V3=).

curl \
 -H "X-Auth-Token: $TOKEN_V3" \
 http://localhost:8774/v2/46ef56389b264799b5f4f9539ac4267f/servers/detail

I also tried with a V2 token, which works.

[Brant Knudson (blk-u)]

I didn't find a review in openstack either... maybe the problem is the token format and not the auth_token middleware?

[Brant Knudson (blk-u)]

Here's the testcase: https://review.openstack.org/#/c/25681/

[Brant Knudson (blk-u)]

The Jenkins failure for the tempest testcase shows the error, see http://logs.openstack.org/25681/2/check/gate-tempest-devstack-vm-full/10955/logs/screen-n-api.txt.gz ,

2013-03-29 02:50:56 DEBUG [keystoneclient.middleware.auth_token] Token validation failure.
Traceback (most recent call last):
  File "/opt/stack/new/python-keystoneclient/keystoneclient/middleware/auth_token.py", line 693, in _validate_user_token
    self._cache_put(token_id, data)
  File "/opt/stack/new/python-keystoneclient/keystoneclient/middleware/auth_token.py", line 937, in _cache_put
    timestamp = data['token']['expires']
KeyError: 'expires'

[Brant Knudson (blk-u)]

identity api spec v3 says the field is "expires_at", see
https://github.com/openstack/identity-api/blame/master/openstack-identity-api/src/markdown/identity-api-v3.md#L797

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/25761

[Brant Knudson (blk-u)]

was fixed with https://review.openstack.org/#/c/24192/ so abandoned the other change.

Rebased the tempest change which should pass now.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/25681
Committed: http://github.com/openstack/tempest/commit/c7ca3347f176df94ba7edd3e24e928fdea59ebac
Submitter: Jenkins
Branch: master

commit c7ca3347f176df94ba7edd3e24e928fdea59ebac
Author: Brant Knudson <email address hidden>
Date: Thu Mar 28 21:08:50 2013 -0500

    identity v3 token

    Adds a test where get a token using identity api v3,
    and use that to perform an operation using compute api.

    Fixes bug 1161633

    Change-Id: I5d8121d1734ec7f1991758360b829c7889540c71