Tempest client with new user credentials always gets 'Unauthorized'

[Udi Kalifon]

I am writing a tempest scenario for keystone. In this scenario I create a domain, project and a user with admin rights on the project. I then try to instantiate a Manager, to have all the tempest clients with the new user credentials, but the clients constantly fail on every call with an 'Unauthorized' reply. I made sure that the permissions are fine by manually getting a token for this user and making a few calls successfully.

My code is provided below, in the hopes that someone will be able to fix it:

from tempest.test import BaseTestCase
from tempest import clients
from tempest.common.utils import data_utils
from tempest.exceptions import Unauthorized
from tempest.auth import KeystoneV3Credentials
from tempest.auth import KeystoneV3AuthProvider

class TestRbac (BaseTestCase):
    _interface = 'json'

    @classmethod
    def setUpClass(cls):
        super(TestRbac, cls).setUpClass()
        cls.os_adm = clients.AdminManager(interface=cls._interface)
        cls.os = clients.Manager(interface=cls._interface)

    def setUp(self):
        super(TestRbac, self).setUp()

    def tearDown(self):
        super(TestRbac, self).tearDown()

    def _delete_domain(self, domain_id):
        # It is necessary to disable the domain before deleting,
        # or else it would result in unauthorized error
        self.os_adm.identity_v3_client.update_domain(domain_id, enabled=False)
        self.os_adm.identity_v3_client.delete_domain(domain_id)

    def test_v3_identity(self):
        # create a domain
        dom_name = data_utils.rand_name('dom-')
        resp, domain = self.os_adm.identity_v3_client.create_domain(dom_name)
        dom_id = domain['id']
        self.addCleanup(self._delete_domain, dom_id)

        # create a project in the domain
        proj_name = data_utils.rand_name('proj-')
        resp, body = self.os_adm.identity_v3_client.create_project(proj_name, domain_id=dom_id)
        proj_id = body['id']
        self.addCleanup(self.os_adm.identity_v3_client.delete_project, proj_id)

        # create a user in the domain, with the previous project as his default project
        user_name = data_utils.rand_name('user-')
        resp, body = self.os_adm.identity_v3_client.create_user(user_name, password=user_name, domain_id=dom_id, project_id=proj_id)
        user_id = body['id']
        self.addCleanup(self.os_adm.identity_v3_client.delete_user, user_id)

        # get roles and find the admin role
        resp, body = self.os_adm.identity_v3_client.list_roles()
        role_ids = [role['id'] for role in body if role['name'] == "admin"]
        admin_role_id = role_ids[0]

        # grant the admin role to the user on his project
        resp, body = self.os_adm.identity_v3_client.assign_user_role_on_project(proj_id, user_id, admin_role_id)

        # create a new client with the new user's credentials
        creds = KeystoneV3Credentials(username=user_name, password=user_name, domain_name=dom_name, user_domain_name=dom_name, tenant_name=proj_name)
        auth_provider = KeystoneV3AuthProvider(creds)
        creds = auth_provider.fill_credentials()
        admin_client = clients.Manager(interface=self._interface, credentials=creds)

        # list domains with the new credentials
        resp, body = admin_client.identity_v3_client.list_domains() # UNAUTHORIZED HERE !!