Unexpected keyword argument 'user_domain_id' from openstack CLI using token auth

[Brant Knudson]

$ openstack --debug --os-token secrete --os-auth-url http://localhost:5000/v3 --os-identity-api-version=3 user list

...
ERROR: openstackclient.shell Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/openstackclient/shell.py", line 178, in run
    return super(OpenStackShell, self).run(argv)
  File "/usr/local/lib/python2.7/dist-packages/cliff/app.py", line 199, in run
    self.initialize_app(remainder)
  File "/usr/local/lib/python2.7/dist-packages/openstackclient/shell.py", line 300, in initialize_app
    pw_func=prompt_for_password,
  File "/usr/local/lib/python2.7/dist-packages/openstackclient/common/clientmanager.py", line 142, in __init__
    self.auth = auth_plugin.load_from_options(**self._auth_params)
  File "/opt/stack/python-keystoneclient/keystoneclient/auth/base.py", line 209, in load_from_options
    return cls(**kwargs)
  File "/opt/stack/python-keystoneclient/keystoneclient/auth/identity/v3/token.py", line 55, in __init__
    super(Token, self).__init__(auth_url, token=token, **kwargs)
  File "/opt/stack/python-keystoneclient/keystoneclient/auth/identity/v3/base.py", line 243, in __init__
    super(AuthConstructor, self).__init__(auth_url, [method], **kwargs)
  File "/opt/stack/python-keystoneclient/keystoneclient/auth/identity/v3/base.py", line 118, in __init__
    super(Auth, self).__init__(auth_url=auth_url, **kwargs)
  File "/opt/stack/python-keystoneclient/keystoneclient/utils.py", line 318, in inner
    return func(*args, **kwargs)
TypeError: __init__() got an unexpected keyword argument 'user_domain_id'

This should have worked... probably should ignore extra keyword arguments rather than raising.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/168756

[Jamie Lennox (jamielennox)]

This seems like OSC is passing information that it shouldn't, which would be OSC's fault.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Brant Knudson (<email address hidden>) on branch: master
Review: https://review.openstack.org/168756
Reason: aww

[Steve Martinelli (stevemar)]

based on jamies comment, marking this as invalid for KSC

[Lin Hua Cheng (lin-hua-cheng)]

I was able to reproduce this from devstack, but I suspect maybe it has an older version.

Using master I can get the user list to work using admin_token.

I got it to work using this command: openstack --debug --os-token secrete --os-url http://localhost:35357/v3 --os-identity-api-version=3 user list

Couple of changes from the given command in bug report:
1. Change --os-auth-url to --os-url . For token/endpoint the argument should be os-url. Described here: http://docs.openstack.org/developer/python-openstackclient/authentication.html

2. Change the port from 5000 to 35357, since your doing an admin operation.

Marking this as invalid since I can't reproduce the issue now in master.

[Jamie Lennox (jamielennox)]

Reopening for OSC, but feel free to shut it down if you feel it has been sufficiently handled.

Looking at the initial stack trace:

File "/opt/stack/python-keystoneclient/keystoneclient/auth/identity/v3/token.py", line 55, in __init__
    super(Token, self).__init__(auth_url, token=token, **kwargs)
...
TypeError: __init__() got an unexpected keyword argument 'user_domain_id'

user_domain_id is not a parameter of the Token plugin, only of the password plugins. This makes sense if you think about the parameters, you don't pass user information along with an existing token. Whatever combination of events led to user_domain_id being passed to the Token plugin is wrong and a bug

[Lin Hua Cheng (lin-hua-cheng)]

I agree something wrong is going on. I dig around a bit more and found there was a fixed made to resolve this issue:

https://github.com/openstack/python-openstackclient/commit/4771feb7c4af6f718efb2a687c99b3bf5387bb2f#diff-9e2bb5e172a83dc4c219b5c634aa1bea

         if (self._api_version.get('identity') == '3' and
+ self.auth_plugin_name.endswith('password') and
             not self._auth_params.get('user_domain_id') and
                 not self._auth_params.get('user_domain_name')):
             self._auth_params['user_domain_id'] = default_domain

The user_domain_id was always getting added for keystone v3, not an additional is added to only added the user_domain_id if the auth_plugin is password auth type.

[Anne Gentle (annegentle)]

I'm using OpenStack CLI 3.9.0, and using any combination of the above I still get this error on a v3 endpoint.

Steps to duplicate:

As an admin user, do:

$ openstack token issue -f value -c id

Copy the token from the returned value.

Run a catalog list command, get this message:
__init__() got an unexpected keyword argument 'user_domain_id'

When I use --os-auth-url and admin port:
$ openstack catalog list --os-auth-type token --os-auth-url http://identity-endpoint:5000/v3 --os-token gAAAAABY...W-fzydtynQ

Note I didn't need to use --os-identity-api-version=3, probably because I have OS_IDENTITY_API_VERSION=3 set in the env.

If the client is 3.9.0, what's different about my cloud? I can run this same command on an okata cloud and get the catalog back.

[Anne Gentle (annegentle)]

I think this isn't a duplicate bug.

[Lance Bragstad (lbragstad)]

It doesn't look like the diff in comment #7 is still relevant? It might have gotten refactored somewhere and that code could still be causing the problem.

[Gabriel Barbutti (gbarbutti)]

This bug also affects me on OpenStack CLI 3.12.0 running in Ubuntu 16.04 and v3 endpoints. The steps to replicate are the same as described by the comment #8

[Dantali0n (dantalion)]

I resolved this issue by unsetting the USER_DOMAIN_ID & USER_DOMAIN_NAME environment variables in my rc scripts.

[Vadym Markov (vmarkov)]

Seems to be broken again since Queens. https://github.com/openstack/python-openstackclient/commit/f38c51c1b90576e6b13ac6086386884c09f5813a totally refactors related code. Probably we should check arguments in keystoneauth1