openstack CLI only works if OS_PASSWORD is set

[Matthew Edmonds]

as demonstrated below, the openstack CLI works when OS_PASSWORD is set:

# env | grep OS_
OS_REGION_NAME=RegionOne
OS_NETWORK_API_VERSION=2.0
OS_USER_DOMAIN_NAME=Default
OS_IMAGE_API_VERSION=2
OS_PROJECT_NAME=myproject
OS_IDENTITY_API_VERSION=3
OS_PASSWORD=mypassword
OS_AUTH_URL=https://myhostname:5000/v3/
OS_COMPUTE_API_VERSION=2.25
OS_USERNAME=myuser
OS_TENANT_NAME=myproject
OS_VOLUME_API_VERSION=2
OS_CACERT=/etc/pki/tls/certs/mycert.crt
OS_PROJECT_DOMAIN_NAME=Default
# openstack token issue
+------------+-----------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------+
| expires | 2016-08-26 21:43:49.479211+00:00 |
| id | gAAAAABXwGO19rB9BPIwj00wiBgm2pB-Cnnq_E4geMo9vXq0ew_b8OVcXC4s3oT |
| | 4i0jS2RqAEKiloj8S6NaoKbE7Njbw2tIrXEOU3PI_VJUZIrvauUuDCiAVLUsgrp |
| | vNmf1QTiekM09GA-8HWyLtc7SsVbppqQuOMXTbxYOz7gzhjDbK5fDzsR0IIIsJU |
| | jYPLc3HVFukBNAFdAWoAJzVpD-fRpMNIJ-1Bsm_7DJcnIXgNw98SUkGPsI |
| project_id | 5449a9e696014d84ab25bac66d84ed9c |
| user_id | 0688b01e6439ca32d698d20789d52169126fb41fb1a4ddafcebb97d854e836c |
| | 9 |
+------------+-----------------------------------------------------------------+

but as soon as I unset it things break:

# unset OS_PASSWORD
# openstack token issue
Password:
must be string or buffer, not None (HTTP 400) (Request-ID: req-c765742c-2f89-4384-bf74-98a8395987a0)

I'm sure that the correct password was entered at the prompt (and a different error should have been surfaced anyway if it wasn't). I believe this is new with version 3.0.1. I don't remember seeing this with openstackclient 2.6.0.

Adding --debug yields this trace data:

Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/cliff/app.py", line 380, in run_subcommand
    self.prepare_to_run_command(cmd)
  File "/usr/lib/python2.7/site-packages/osc_lib/shell.py", line 434, in prepare_to_run_command
    self.client_manager.auth_ref
  File "/usr/lib/python2.7/site-packages/osc_lib/clientmanager.py", line 195, in auth_ref
    self._auth_ref = self.auth.get_auth_ref(self.session)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/identity/generic/base.py", line 181, in get_auth_ref
    return self._plugin.get_auth_ref(session, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/identity/v3/base.py", line 167, in get_auth_ref
    authenticated=False, log=False, **rkwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 675, in post
    return self.request(url, 'POST', **kwargs)
  File "/usr/lib/python2.7/site-packages/osc_lib/session.py", line 40, in request
    resp = super(TimingSession, self).request(url, method, **kwargs)
  File "/usr/lib/python2.7/site-packages/positional/__init__.py", line 94, in inner
    return func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 570, in request
    raise exceptions.from_response(resp, method, url)
BadRequest: must be string or buffer, not None (HTTP 400) (Request-ID: req-ac6a3813-96e5-4b37-8a91-448ae2483cf4)
clean_up IssueToken: must be string or buffer, not None (HTTP 400) (Request-ID: req-ac6a3813-96e5-4b37-8a91-448ae2483cf4)
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/osc_lib/shell.py", line 135, in run
    ret_val = super(OpenStackShell, self).run(argv)
  File "/usr/lib/python2.7/site-packages/cliff/app.py", line 267, in run
    result = self.run_subcommand(remainder)
  File "/usr/lib/python2.7/site-packages/osc_lib/shell.py", line 180, in run_subcommand
    ret_value = super(OpenStackShell, self).run_subcommand(argv)
  File "/usr/lib/python2.7/site-packages/cliff/app.py", line 380, in run_subcommand
    self.prepare_to_run_command(cmd)
  File "/usr/lib/python2.7/site-packages/osc_lib/shell.py", line 434, in prepare_to_run_command
    self.client_manager.auth_ref
  File "/usr/lib/python2.7/site-packages/osc_lib/clientmanager.py", line 195, in auth_ref
    self._auth_ref = self.auth.get_auth_ref(self.session)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/identity/generic/base.py", line 181, in get_auth_ref
    return self._plugin.get_auth_ref(session, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/identity/v3/base.py", line 167, in get_auth_ref
    authenticated=False, log=False, **rkwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 675, in post
    return self.request(url, 'POST', **kwargs)
  File "/usr/lib/python2.7/site-packages/osc_lib/session.py", line 40, in request
    resp = super(TimingSession, self).request(url, method, **kwargs)
  File "/usr/lib/python2.7/site-packages/positional/__init__.py", line 94, in inner
    return func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 570, in request
    raise exceptions.from_response(resp, method, url)
BadRequest: must be string or buffer, not None (HTTP 400) (Request-ID: req-ac6a3813-96e5-4b37-8a91-448ae2483cf4)

[Dean Troyer (dtroyer)]

This is a casualty of os-client-config loading auth plugins waaaaaay earlier than we used to. The fix is to transition to using the KSa plugin prompt mechanism, which will have to live in os-client-config.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/362243
Committed: https://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=bec206fa0a0214d856259661c5e32086f33d2f62
Submitter: Jenkins
Branch: master

commit bec206fa0a0214d856259661c5e32086f33d2f62
Author: Dean Troyer <email address hidden>
Date: Mon Aug 29 11:07:49 2016 -0500

    Fix auth prompt brokenness

    We start by fixing this in the already-present OSC_Config class so OSC
    can move forward. This change needs to get ported down into
    os-client-config in the near future, maybe even soon enough to make the
    client library freeze this week.

    * Add the pw-func argument to the OSC_Config (or OpenStackConfig) __init__()
    * When looping through the auth options from the KSA plugin look for any
      that have a prompt defined and do not have a value already, so ask for one.

    Closes-bug: #1617384
    Change-Id: Ic86d56b8a6844516292fb74513712b486fec4442

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/python-openstackclient 3.2.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/python-openstackclient 3.2.0 release.