Fix install guide filter:authtoken config example

[Matthew Oliver]

Since newton the install guide uses keystones bootstrap which creates a default domain which looks like:

  (openstack) domain show default
  +-------------+--------------------+
  | Field | Value |
  +-------------+--------------------+
  | description | The default domain |
  | enabled | True |
  | id | default |
  | name | Default |
  +-------------+--------------------+

Note the specifically:

  id = default
  name = Default

These are the values we should be using when defining configuration options in keystone's auth_token middleware. Namely:

  project_domain_id = default
  user_domain_id = default

NOTE: id = default

and:

  project_domain_name = Default
  user_domain_name = Default

NOTE: name = Default.

Currently the install_guide uses:

     project_domain_name = default
     user_domain_name = default

Which is incorrect. It must be one of the previous examples.

For example, the swift example in the install guild should read:

  [filter:authtoken]
  paste.filter_factory = keystonemiddleware.auth_token:filter_factory
  ...
  auth_uri = http://controller:5000
  auth_url = http://controller:35357
  memcached_servers = controller:11211
  auth_type = password
  project_domain_name = Default
  user_domain_name = Default
  project_name = service
  username = swift
  password = SWIFT_PASS
  delay_auth_decision = True

OR:

  [filter:authtoken]
  paste.filter_factory = keystonemiddleware.auth_token:filter_factory
  ...
  auth_uri = http://controller:5000
  auth_url = http://controller:35357
  memcached_servers = controller:11211
  auth_type = password
  project_domain_id = default
  user_domain_id = default
  project_name = service
  username = swift
  password = SWIFT_PASS
  delay_auth_decision = True

The first version (*_domain_name = Default) is a better choice as apparently the name 'Default' cannot be changed in bootstrap where the id can potentially depending on ones keystone config.

[Matthew Oliver (matt-0)]

I have personally confirmed this with a keystone + Swift dev environment, while reviewing patch https://review.openstack.org/#/c/454386:

firstly the default values are defined:
<snip from Colleen Murphy's comment in above patch>

The name of the default domain is defined here:
http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/core.py?id=69d03670d1ddcf428063d81a0f25b6196650876e#n841

The default ID of the default domain is defined here:
http://git.openstack.org/cgit/openstack/keystone/tree/keystone/conf/identity.py?id=69d03670d1ddcf428063d81a0f25b6196650876e#n21
</snip>

So params ending in _id are default and the -name are Default.. which I find annoying. But there you go. Our sample doc uses _id = default which "should" be correct.

What do others use, well according to https://docs.openstack.org/developer/keystonemiddleware/api/keystonemiddleware.auth_token.html
it gives a sample, apparently from nova that:

  [keystone_authtoken]
  auth_plugin = password
  auth_url = http://keystone:35357/
  username = nova
  user_domain_id = default
  password = whyarewestillusingpasswords
  project_name = service
  project_domain_id = default

Which using using "default" against the *_id versions of the configuration.

Now if I pop into my test keystone server, and take a look:

  (openstack) domain list
  +---------+---------+---------+--------------------+
  | ID | Name | Enabled | Description |
  +---------+---------+---------+--------------------+
  | default | Default | True | The default domain |
  +---------+---------+---------+--------------------+
  (openstack) domain show default
  +-------------+--------------------+
  | Field | Value |
  +-------------+--------------------+
  | description | The default domain |
  | enabled | True |
  | id | default |
  | name | Default |
  +-------------+--------------------+

Now lets do some keystone config tests in Swift.
First using:

  [filter:authtoken]
  paste.filter_factory = keystonemiddleware.auth_token:filter_factory
  auth_url = http://localhost:35357
  auth_uri = http://localhost:5000
  auth_plugin = password
  project_name = service
  username = swift
  password = Sekr3tPass
  delay_auth_decision = True
  user_domain_id = default
  project_domain_id = default

It works:

  $ swift stat
                 Account: KEY_fce1546e0675483bb3862a54a2ed68f6
              Containers: 0
                 Objects: 0
                   Bytes: 0
         X-Put-Timestamp: 1491904442.67731
             X-Timestamp: 1491904442.67731
              X-Trans-Id: tx0814c8d8f3694f47a13d9-0058eca7ba
            Content-Type: text/plain; charset=utf-8
  X-Openstack-Request-Id: tx0814c8d8f3694f47a13d9-0058eca7ba

Change to _id = Default:

  [filter:authtoken]
  paste.filter_factory = keystonemiddleware.auth_token:filter_factory
  auth_url = http://localhost:35357
  auth_uri = http://localhost:5000
  auth_plugin = password
  project_name = service
  username = swift
  password = Sekr3tPass
  delay_auth_decision = True
  user_domain_id = Default
  project_domain_id = Default

And:

  $ swift stat
  Account HEA...

[Alistair Coles (alistair-coles)]

Related bug https://bugs.launchpad.net/swift/+bug/1604674

My research confirms that since Newton (and before Mitaka?) the keystone install guide has default keystone domain created with id 'default' and name 'Default'. This is how our sample configs and docs have described the options since [1], but the swift install guide uses domain name 'default', which was the recommended config in Mitaka install guide.

[1] https://review.openstack.org/#/c/261395/

[Alistair Coles (alistair-coles)]

Somehow we failed to have a Closes-Bug patch on the patch. This is fixed by:
 https://review.openstack.org/#/c/454386