Great. This looks like your fix will not require reverting the PKIZ change.<div><br></div><div>Thanks!</div><div>--Morgan <br><br>On Saturday, June 21, 2014, Lyle, David <<a href="mailto:david.lyle@hp.com">david.lyle@hp.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I released django_openstack_auth 1.1.6 on Friday to fix the login issue<br>
with PKIZ. Part of that release contained a pep8 cleanup that broke<br>
Horizon, ultimately because we were doing something stupid in Horizon. We<br>
added a fix to Horizon to correct the issue on trunk<br>
<a href="https://github.com/openstack/horizon/commit/0bd4350cb308d57b6afc69daee4a782
3055be5a9" target="_blank">https://github.com/openstack/horizon/commit/0bd4350cb308d57b6afc69daee4a782<br>
3055be5a9</a>. However, to allow older versions of Horizon to work with newer<br>
django_openstack_auth versions, I currently have a patch up to restore the<br>
strange import in openstack_auth <a href="https://review.openstack.org/#/c/101715/" target="_blank">https://review.openstack.org/#/c/101715/</a><br>
once that merges I will release django_openstack_auth 1.1.7 and all gates<br>
should work again.<br>
<br>
David<br>
<br>
<br>
From: Morgan Fainberg <<a href="javascript:;" onclick="_e(event, 'cvml', 'morgan.fainberg@gmail.com')">morgan.fainberg@gmail.com</a>><br>
Reply-To: OpenStack List <<a href="javascript:;" onclick="_e(event, 'cvml', 'openstack-dev@lists.openstack.org')">openstack-dev@lists.openstack.org</a>><br>
Date: Saturday, June 21, 2014 at 12:27 PM<br>
To: OpenStack List <<a href="javascript:;" onclick="_e(event, 'cvml', 'openstack-dev@lists.openstack.org')">openstack-dev@lists.openstack.org</a>><br>
Subject: Re: [openstack-dev] horizon failing on icehouse 100%, currently<br>
blocking all patches<br>
<br>
<br>
The issue with the login page simply refreshing was due to a change in<br>
Keystone that updated the type of Token issued by default from PKI to PKIZ<br>
(compressed PKI/ASN1). The update to the django auth module was intended<br>
to correct that specific<br>
issue with Keystone and Horizon (Juno).<br>
<br>
The bug fix (not sure if another review is to blame with the<br>
django_openstack_auth module tha t is currently happening) that addressed<br>
your specific issue is:<br>
<a href="https://bugs.launchpad.net/horizon/+bug/1331406" target="_blank">https://bugs.launchpad.net/horizon/+bug/1331406</a><br>
<br>
<br>
I have proposed a fix for Keystone that would revert the PKIZ default:<br>
<a href="https://review.openstack.org/#/c/101714/" target="_blank">https://review.openstack.org/#/c/101714/</a><br>
<<a href="https://review.openstack.org/#/c/101714/" target="_blank">https://review.openstack.org/#/c/101714/</a>><br>
<br>
<br>
Depending on the fixes upcoming for the django_openstack_auth module, it<br>
may make sense to temporarily revert the PKIZ provider default until we<br>
can solve the issues with the django auth module and horizon when PKIZ is<br>
enabled. If this review is not needed<br>
based on how the horizon issues are corrected, it will be abandoned.<br>
<br>
<br>
I think this is also showing some gaps in our testing, notably that the<br>
django_openstack_auth module isn't being exercised on the integration<br>
tests. I'll aim to hit up Horizon team and work with them and the QA folks<br>
to make sure we cover this gap in the<br>
future.<br>
<br>
<br>
--Morgan<br>
<br>
<br>
On Saturday, June 21, 2014, Mike Spreitzer <<a href="javascript:;" onclick="_e(event, 'cvml', 'mspreitz@us.ibm.com')">mspreitz@us.ibm.com</a>> wrote:<br>
<br>
Since Friday I have been getting this misbehavior: enter username and<br>
password, hit login, and it shows you the login page again.<br>
<br>
<br>
Sean Dague --- [openstack-dev] horizon failing on icehouse 100%, currently<br>
blocking all patches ---<br>
<br>
<br>
<br>
<br>
From:"Sean Dague" <<a href="javascript:;" onclick="_e(event, 'cvml', 'sean@dague.net')">sean@dague.net</a>>To"openstack-dev"<br>
<<a href="javascript:;" onclick="_e(event, 'cvml', 'openstack-dev@lists.openstack.org')">openstack-dev@lists.openstack.org</a>>Date:Sat, Jun 21, 2014<br>
12:54Subject[openstack-dev] horizon failing on icehouse 100%, currently<br>
blocking all patches________________________________________<br>
<br>
Horizon in icehouse is now 100% failing<br>
<br>
[Sat Jun 21 16:17:35 2014] [error] Internal Server Error: /<br>
[Sat Jun 21 16:17:35 2014] [error] Traceback (most recent call last):<br>
[Sat Jun 21 16:17:35 2014] [error] File<br>
"/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py",<br>
line 112, in get_response<br>
[Sat Jun 21 16:17:35 2014] [error] response =<br>
wrapped_callback(request, *callback_args, **callback_kwargs)<br>
[Sat Jun 21 16:17:35 2014] [error] File<br>
"/usr/local/lib/python2.7/dist-packages/django/views/decorators/vary.py",<br>
line<br>
36, in inner_func<br>
[Sat Jun 21 16:17:35 2014] [error] response = func(*args, **kwargs)<br>
[Sat Jun 21 16:17:35 2014] [error] File<br>
"/opt/stack/old/horizon/openstack_dashboard/wsgi/../../openstack_dashboard/<br>
views.py",<br>
line 35, in splash<br>
[Sat Jun 21 16:17:35 2014] [error] form = views.Login(request)<br>
[Sat Jun 21 16:17:35 2014] [error] AttributeError: 'module' object has<br>
no attribute 'Login'<br>
<br>
This suspiciously times with django_openstack_auth 1.1.6 being released.<br>
<a href="http://logstash.openstack.org/#eyJzZWFyY2giOiJcIkF0dHJpYnV0ZUVycm9yOiAnbW9k
dWxlJyBvYmplY3QgaGFzIG5vIGF0dHJpYnV0ZSAnTG9naW4nXCIiLCJmaWVsZHMiOltdLCJvZmZ" target="_blank">http://logstash.openstack.org/#eyJzZWFyY2giOiJcIkF0dHJpYnV0ZUVycm9yOiAnbW9k<br>
dWxlJyBvYmplY3QgaGFzIG5vIGF0dHJpYnV0ZSAnTG9naW4nXCIiLCJmaWVsZHMiOltdLCJvZmZ</a><br>
zZXQiOjAsInRpbWVmcmFtZSI6IjYwNDgwMCIsImdyYXBobW9kZSI6ImNvdW50IiwidGltZSI6ey<br>
J1c2VyX2ludGVydmFsIjowfSwic3RhbXAiOjE0MDMzNjk0MjQ4NjR9<br>
<br>
Because this breaks smoke tests on icehouse, it means that any project<br>
with upgrade testing fails.<br>
<br>
Would be great if horizon folks code make this a top priority. Also, in<br>
future, releasing new library versions on a saturday maybe best avoided. :)<br>
<br>
-Sean<br>
<br>
--<br>
Sean Dague<br>
<a href="http://dague.net" target="_blank">http://dague.net</a><br>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="javascript:;" onclick="_e(event, 'cvml', 'OpenStack-dev@lists.openstack.org')">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
<br>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="javascript:;" onclick="_e(event, 'cvml', 'OpenStack-dev@lists.openstack.org')">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote></div>