auth_token defaults auth_uri config to point to admin endpoint if not set

[Dolph Mathews]

auth_uri is used to direct unauthenticated clients to an endpoint where they can authenticate. If an auth_uri is not configured, then auth_token falls back on the admin API endpoint, and provides this to clients... who may not have visibility of the admin endpoint, much less be able to properly authenticate against it.

Specifically, this configuration is a complete failure when a keystone user does not have an assigned default tenant, the client is not aware of the tenants the user has access to, and the admin API is incapable of listing those tenants (the admin API will attempt to list all tenants in the system, which a normal user does not have authorization to do).

When the fallback configuration is utilized, a warning should be logged until "support" for behavior can be safely removed.

[Dolph Mathews (dolph)]

Unassigning due to inactivity.

[Steve Martinelli (stevemar)]

this impacts keystonemiddleware not keystoneclient

[Morgan Fainberg (mdrnstm)]

In the scope of the general direction of keystone, this seems to be towards the realm of "wont fix" as in V3 there is no distinction between the admin and non-admin endpoints. Perhaps this should be looking for a specific interface? "Internal"?

[Morgan Fainberg (mdrnstm)]

Is this really still an issue?

[Launchpad Janitor (janitor)]

[Expired for keystonemiddleware because there has been no activity for 60 days.]