<div dir="ltr">Hi,<div><br></div><div>Problem resolved. </div><div><br></div><div>curl <a href="http://10.16.37.221:5000">10.16.37.221:5000</a> returned access denied. So I added a no proxy for the host ip in the browser after which it began returning the JSON data.</div><div>After this I exported the same in my keystone_adminrc file as Chinmaya pointed out. That solved the problem and it no longer gives the forbidden error.</div><div><br></div><div>But the funny thing here is that I have had this setup running for quite some time now and I have not added a no_proxy for the host ip and I also haven't faced this issue before. So I am not sure what triggered this error here now.</div><div><br></div><div>Thanks a lot for your inputs.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 27, 2016 at 5:30 PM, Dolph Mathews <span dir="ltr"><<a href="mailto:dolph.mathews@gmail.com" target="_blank">dolph.mathews@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote"><span class="">On Wed, Apr 27, 2016 at 6:53 AM, Dhvanan Shah <span dir="ltr"><<a href="mailto:dhvanan@gmail.com" target="_blank">dhvanan@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>Enabling the debug flag didn't give any additional information.</div><div><br></div><div>2 node Cluster means that I have one controller that also runs the compute and an additional compute node, thus 2 node OpenStack Cluster.</div><div><br></div><div>The problem here is not with the password as I am able to log in through the dashboard. Any action performed gives a Forbidden error and authorization failed for keystone. </div><div><br></div><div>Any other things that I could look at? </div></div></blockquote><div><br></div></span><div>Another long shot, but you might have an unintended surprise in your environment.</div><div><br></div><div><b> </b><span>$ </span><span>env | grep ^OS_</span></div>
<div><br></div><div>More likely though, I'm guessing you don't actually have the "admin" role on the "admin" tenant that you're expecting. The 403 is indicating that you are authenticated successfully (your password is correct), but you don't have authorization to make the request (listing users, for example). You'd be able to login to horizon and spin up a VM, or do the same from the CLI, but not make the requests you're using to exercise the cloud admin role.</div><div><div class="h5"><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 27, 2016 at 4:55 PM, Dolph Mathews <span dir="ltr"><<a href="mailto:dolph.mathews@gmail.com" target="_blank">dolph.mathews@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Depending on which release of keystone you're running, try enabling either insecure_debug (more recent releases) or debug (older releases) to true in keystone.conf to get more detailed error messages from keystone.<div><br></div><div><a href="https://github.com/openstack/keystone/blob/3c4fe622ac5da00b04ccc8bc4e207a2e9ab0f863/etc/keystone.conf.sample#L87-L91" target="_blank">https://github.com/openstack/keystone/blob/3c4fe622ac5da00b04ccc8bc4e207a2e9ab0f863/etc/keystone.conf.sample#L87-L91</a><br></div><div><br></div><div>That said, your configuration looks entirely correct to me, so I'm curious what the outcome is here. The only other red flag I see is that you mentioned a "2 node OpenStack cluster", and I'm not sure what that means in this context, exactly. How are the 2 nodes utilized?</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 27, 2016 at 5:43 AM, Dhvanan Shah <span dir="ltr"><<a href="mailto:dhvanan@gmail.com" target="_blank">dhvanan@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>keystone --debug user-list gives this:</div><span><div><br></div><div>/usr/lib/python2.7/site-packages/keystoneclient/shell.py:65: DeprecationWarning: The keystone CLI is deprecated in favor of python-openstackclient. For a Python library, continue using python-keystoneclient.</div><div> 'python-keystoneclient.', DeprecationWarning)</div></span><div>DEBUG:keystoneclient.auth.identity.v2:Making authentication request to <a href="http://10.16.37.221:5000/v2.0/tokens" target="_blank">http://10.16.37.221:5000/v2.0/tokens</a></div><div>INFO:requests.packages.urllib3.connectionpool:Starting new HTTP connection (1): <a href="http://proxy.serc.iisc.ernet.in" target="_blank">proxy.serc.iisc.ernet.in</a></div><div>DEBUG:requests.packages.urllib3.connectionpool:"POST <a href="http://10.16.37.221:5000/v2.0/tokens" target="_blank">http://10.16.37.221:5000/v2.0/tokens</a> HTTP/1.1" 403 3370</div><div>DEBUG:keystoneclient.session:Request returned failure status: 403</div><span><div>Authorization Failed: Forbidden (HTTP 403)</div><div><br></div></span><div>nova --debug user list gives this:</div><div><br></div><div><div>DEBUG (session:195) REQ: curl -g -i -X GET <a href="http://10.16.37.221:5000/v2.0" target="_blank">http://10.16.37.221:5000/v2.0</a> -H "Accept: application/json" -H "User-Agent: python-keystoneclient"</div><div>INFO (connectionpool:203) Starting new HTTP connection (1): <a href="http://proxy.serc.iisc.ernet.in" target="_blank">proxy.serc.iisc.ernet.in</a></div><div>DEBUG (connectionpool:383) "GET <a href="http://10.16.37.221:5000/v2.0" target="_blank">http://10.16.37.221:5000/v2.0</a> HTTP/1.1" 403 3275</div><div>DEBUG (session:224) RESP:</div><div>DEBUG (session:396) Request returned failure status: 403</div><div>WARNING (base:133) Discovering versions from the identity service failed when creating the password plugin. Attempting to determine version from URL.</div><div>DEBUG (v2:76) Making authentication request to <a href="http://10.16.37.221:5000/v2.0/tokens" target="_blank">http://10.16.37.221:5000/v2.0/tokens</a></div><div>DEBUG (connectionpool:383) "POST <a href="http://10.16.37.221:5000/v2.0/tokens" target="_blank">http://10.16.37.221:5000/v2.0/tokens</a> HTTP/1.1" 403 3370</div><div>DEBUG (session:396) Request returned failure status: 403</div><div>DEBUG (shell:914) Forbidden (HTTP 403)</div></div><div><div>Forbidden: Forbidden (HTTP 403)</div><span><div>ERROR (Forbidden): Forbidden (HTTP 403)</div></span></div><div><br></div><div><br></div></div><div class="gmail_extra"><div><div><br><div class="gmail_quote">On Wed, Apr 27, 2016 at 3:12 PM, Dhvanan Shah <span dir="ltr"><<a href="mailto:dhvanan@gmail.com" target="_blank">dhvanan@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">On running openstack-status this is what I get (all the services are running, so not included that here)<div><br></div><div><div>== Keystone users ==</div><div>/usr/lib/python2.7/site-packages/keystoneclient/shell.py:65: DeprecationWarning: The keystone CLI is deprecated in favor of python-openstackclient. For a Python library, continue using python-keystoneclient.</div><div> 'python-keystoneclient.', DeprecationWarning)</div><span><div>Authorization Failed: Forbidden (HTTP 403)</div></span><div>== Glance images ==</div><div>Forbidden (HTTP 403)</div><div>== Nova managed services ==</div><span><div>No handlers could be found for logger "keystoneclient.auth.identity.generic.base"</div><div>ERROR (Forbidden): Forbidden (HTTP 403)</div></span><div>== Nova networks ==</div><span><div>No handlers could be found for logger "keystoneclient.auth.identity.generic.base"</div><div>ERROR (Forbidden): Forbidden (HTTP 403)</div></span><div>== Nova instance flavors ==</div><span><div>No handlers could be found for logger "keystoneclient.auth.identity.generic.base"</div><div>ERROR (Forbidden): Forbidden (HTTP 403)</div></span><div>== Nova instances ==</div><span><div>No handlers could be found for logger "keystoneclient.auth.identity.generic.base"</div><div>ERROR (Forbidden): Forbidden (HTTP 403)</div></span></div><div><br></div></div><div class="gmail_extra"><div><div><br><div class="gmail_quote">On Wed, Apr 27, 2016 at 3:09 PM, Dhvanan Shah <span dir="ltr"><<a href="mailto:dhvanan@gmail.com" target="_blank">dhvanan@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Jens,<div><br></div><div>The password is correct when I echo $OS_PASSWORD.</div><div>I downloaded the admin-openrc.sh file from the dashboard and sourced. I ran a nova list after that:</div><span><div><div>No handlers could be found for logger "keystoneclient.auth.identity.generic.base"</div><div>ERROR (Forbidden): Forbidden (HTTP 403)</div></div><div><br></div></span><div>It still gives the error of forbidden access.</div><div>I think the password is not the issue. Forbidden access might be something else. Do you want me to share anything else?</div></div><div class="gmail_extra"><div><div><br><div class="gmail_quote">On Wed, Apr 27, 2016 at 2:56 PM, Jens Rosenboom <span dir="ltr"><<a href="mailto:j.rosenboom@x-ion.de" target="_blank">j.rosenboom@x-ion.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><span>2016-04-27 10:30 GMT+02:00 Dhvanan Shah <<a href="mailto:dhvanan@gmail.com" target="_blank">dhvanan@gmail.com</a>>:<br>
> UPDATE:<br>
> I am able to log into Horizon and perform all actions without any issue but<br>
> on my terminal, I am not able to do the same. The password that I thought<br>
> was wrong is not the issue as I logged in with the same password.<br>
> My keystone_adminrc file looks like this:<br>
><br>
> unset OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT<br>
> export OS_USERNAME=admin<br>
> export OS_PASSWORD=****************<br>
> export OS_AUTH_URL=<a href="http://10.16.37.221:35357/v2.0" rel="noreferrer" target="_blank">http://10.16.37.221:35357/v2.0</a><br>
> export PS1='[\u@\h \W(keystone_admin)]\$ '<br>
><br>
> export OS_TENANT_NAME=admin<br>
> export OS_REGION_NAME=RegionOne<br>
><br>
><br>
> Please suggest what I could do!<br>
<br>
</span>Does your password contain special characters that might get mangled<br>
by the shell? You could compare the output of "echo $OS_PASSWORD" to<br>
verify.<br>
<br>
Otherwise, if the dashboard is working for you, you can go to<br>
Project/Compute/Access&Security/API Access and use the "Download<br>
OpenStack RC File" link there.<br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote></div><br><br clear="all"><div><br></div></div></div><span><font color="#888888">-- <br><div><div dir="ltr">Dhvanan Shah</div></div>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div></div></div><span><font color="#888888">-- <br><div><div dir="ltr">Dhvanan Shah</div></div>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div></div></div><span><font color="#888888">-- <br><div><div dir="ltr">Dhvanan Shah</div></div>
</font></span></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>
</div></div><br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr">Dhvanan Shah</div></div>
</div>
</div></div></blockquote></div></div></div><br></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr">Dhvanan Shah</div></div>
</div>