<div dir="ltr"><div class="gmail_default" style="font-family:'times new roman',serif">Matt,</div><div class="gmail_default" style="font-family:'times new roman',serif"><br></div><div class="gmail_default" style="font-family:'times new roman',serif">
As far was why I am using 35357 instead of 5000, I found several references to using 35357 such as <a href="https://ask.openstack.org/en/question/30541/create-admin-fails-with-invalid-openstack-identity-credentials/">https://ask.openstack.org/en/question/30541/create-admin-fails-with-invalid-openstack-identity-credentials/</a> and <a href="http://docs.openstack.org/icehouse/install-guide/install/yum/content/keystone-users.html">http://docs.openstack.org/icehouse/install-guide/install/yum/content/keystone-users.html</a> .</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br></div><div class="gmail_default" style="font-family:'times new roman',serif"><br></div><div class="gmail_default" style="font-family:'times new roman',serif">
I didn't create the password for the admin account. It has special characters in it which are interpreted by the shell. I have to figure out the appropriate escape characters" I think I've done that, but now I have run into a problem in that I need keystone to change the password, but keystone doesn't work because of the module object not callable problem. The problem is well discussed in the literature, see for example <a href="http://en.wikipedia.org/wiki/There's_a_Hole_in_My_Bucket">http://en.wikipedia.org/wiki/There's_a_Hole_in_My_Bucket</a> .</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br></div><div class="gmail_default" style="font-family:'times new roman',serif">For any newbies following this discussion, the config file is /etc/keystone/keystone.conf and the log file is ./var/log/keystone/keystone.log.</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br></div><div class="gmail_default" style="font-family:'times new roman',serif">The keystone.log has no entries in it for today, which means that the keystone client never made a connection to the server. If it had made a connection, then there would be an entry. I am running ./usr/bin/keystone-all --debug.</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br></div><div class="gmail_default" style="font-family:'times new roman',serif">However, the error message has changed:</div><div class="gmail_default" style="font-family:'times new roman',serif">
<br></div><div class="gmail_default"><div class="gmail_default"><font face="courier new, monospace">root@controller1-prod.controller1-prod:~# keystone token-get</font></div><div class="gmail_default"><font face="courier new, monospace">WARNING: Bypassing authentication using a token & endpoint (authentication credentials are being ignored).</font></div>
<div class="gmail_default"><font face="courier new, monospace">'NoneType' object has no attribute 'has_service_catalog'</font></div><div class="gmail_default"><font face="courier new, monospace">root@controller1-prod.controller1-prod:~# </font></div>
<div style="font-family:'times new roman',serif"><br></div></div><div class="gmail_default" style="font-family:'times new roman',serif"><br></div><div class="gmail_default" style="font-family:'times new roman',serif">
Thank you for your kind assistance.</div><div class="gmail_default" style="font-family:'times new roman',serif"><br></div><div class="gmail_default" style="font-family:'times new roman',serif">Jeff</div><div class="gmail_default" style="font-family:'times new roman',serif">
<br></div><div class="gmail_default" style="font-family:'times new roman',serif"><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Aug 1, 2014 at 5:27 PM, Fischer, Matt <span dir="ltr"><<a href="mailto:matthew.fischer@twcable.com" target="_blank">matthew.fischer@twcable.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>The keystone client does indeed hide failures from you and wrap them, which makes it annoying to debug, see <a href="https://bugs.launchpad.net/python-keystoneclient/+bug/1210625" target="_blank">https://bugs.launchpad.net/python-keystoneclient/+bug/1210625</a>. If you
do a —debug however you can see the exact call you are attempting and how to repro it with curl. To get a token, you need to POST, I figure the default action for curl is a GET which may be why you are having issues with your curl command. </div>
<div><br>
</div>
<div>Here is a curl request to get a token.</div>
<div><br>
</div>
<div>
<div>keystone --debug token-get</div>
<div>DEBUG:keystoneclient.session:REQ: curl -i -X POST <a href="http://example.com:5000/v2.0/tokens" target="_blank">http://example.com:5000/v2.0/tokens</a> -H "Content-Type: application/json" -H "Accept: application/json" -H "User-Agent: python-keystoneclient" -d '{"auth": {"tenantName": "admin", "passwordCredentials": {"username":
"admin", "password": "myPassword"}}}'</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>More debugging hints:</div>
<div><br>
</div>
<div>If you still have problems the server-side logs are generally way more useful. You can enable debug in the config file and then run keystone by hand (after stopping it) by doing /usr/bin/keystone-all. That will generally provide better feedback.</div>
<div><br>
</div>
<div>Also :35357 is the service endpoint for which I usually use a service token, is there a reason you're using that and not the standard :5000?</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Jeff Silverman <<a href="mailto:jeff@sweetlabs.com" target="_blank">jeff@sweetlabs.com</a>><br>
<span style="font-weight:bold">Date: </span>Friday, August 1, 2014 3:35 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:openstack-operators@lists.openstack.org" target="_blank">openstack-operators@lists.openstack.org</a>" <<a href="mailto:openstack-operators@lists.openstack.org" target="_blank">openstack-operators@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>[Openstack-operators] keystone is throwing Authorization Failed: 'module' object is not callable errors<br>
</div><div><div class="h5">
<div><br>
</div>
<div dir="ltr">
<div class="gmail_default" style="font-family:'times new roman',serif">I did something to keystone, I'm not sure what.</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default">
<div class="gmail_default" style="font-family:'times new roman',serif"><a href="mailto:root@controller1-prod.controller1-prod" target="_blank">root@controller1-prod.controller1-prod</a>:~# keystone role-list</div>
<div class="gmail_default" style="font-family:'times new roman',serif">Authorization Failed: 'module' object is not callable<br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><a href="mailto:root@controller1-prod.controller1-prod" target="_blank">root@controller1-prod.controller1-prod</a>:~#</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><a href="mailto:root@controller1-prod.controller1-prod" target="_blank">root@controller1-prod.controller1-prod</a>:~# keystone role-get admin</div>
<div class="gmail_default" style="font-family:'times new roman',serif">Authorization Failed: 'module' object is not callable<br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><a href="mailto:root@controller1-prod.controller1-prod" target="_blank">root@controller1-prod.controller1-prod</a>:~# </div>
<div><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif">I have envars OS_USERNAME, OS_PASSWORD, OS_TENANT defined. OS_AUTH_URL has a URL:</div>
<div class="gmail_default">
<div class="gmail_default"><font face="times new roman,serif"><a href="mailto:root@controller1-prod.controller1-prod" target="_blank">root@controller1-prod.controller1-prod</a>:~# curl -i
<a href="http://controller1-prod.sea.opencandy.com:35357/v2.0" target="_blank">http://controller1-prod.sea.opencandy.com:35357/v2.0</a></font></div>
<div class="gmail_default"><font face="times new roman,serif">HTTP/1.1 200 OK</font></div>
<div class="gmail_default"><font face="times new roman,serif">Vary: X-Auth-Token</font></div>
<div class="gmail_default"><font face="times new roman,serif">Content-Type: application/json</font></div>
<div class="gmail_default"><font face="times new roman,serif">Date: Fri, 01 Aug 2014 21:10:47 GMT</font></div>
<div class="gmail_default"><font face="times new roman,serif">Transfer-Encoding: chunked</font></div>
<div class="gmail_default"><font face="times new roman,serif"><br>
</font></div>
<div class="gmail_default"><font face="times new roman,serif">{"version": {"status": "stable", "updated": "2012-10-13T17:42:56Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}, {"base": "application/xml",
"type": "application/vnd.openstack.identity-v2.0+xml"}], "id": "v2.0", "links": [{"href": "<a href="http://controller1-prod.sea.opencandy.com:35357/v2.0/" target="_blank">http://controller1-prod.sea.opencandy.com:35357/v2.0/</a>", "rel": "self"}, {"href": "<a href="http://docs.openstack.org/api/openstack-identity-service/2.0/content/" target="_blank">http://docs.openstack.org/api/openstack-identity-service/2.0/content/</a>",
"type": "text/html", "rel": "describedby"}, {"href": "<a href="http://docs.openstack.org/api/openstack-identity-service/2.0/identity-dev-guide-2.0.pdf" target="_blank">http://docs.openstack.org/api/openstack-identity-service/2.0/identity-dev-guide-2.0.pdf</a>", "type": "application/pdf",
"rel": "describedby"}]}}<a href="mailto:root@controller1-prod.controller1-prod" target="_blank">root@controller1-prod.controller1-prod</a>:~# </font></div>
<div style="font-family:'times new roman',serif"><br>
</div>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif">I have been poking at keystone with pdb to try find the point where the exception is raised, with little success. Maybe I am incompetent as a python programmer.</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif">I have discovered that keystoneclient does a call to the identity server to get a token - I think. I tried to simulate the call using curl.</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif">
<pre><a href="mailto:root@controller1-prod.controller1-prod" target="_blank">root@controller1-prod.controller1-prod</a>:~# curl -i <a href="http://controller1-prod.sea.opencandy.com:35357/v2.0/tokens" target="_blank">http://controller1-prod.sea.opencandy.com:35357/v2.0/tokens</a><br>
HTTP/1.1 404 Not Found<br>Vary: X-Auth-Token<br>Content-Type: application/json<br>Date: Fri, 01 Aug 2014 20:26:00 GMT<br>Transfer-Encoding: chunked<br><br>{"error": {"message": "The resource could not be found.", "code": 404, "title": "Not Found"}}</pre>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif">One of the things I find frustrating is the code assumes that any error is an authorization problem, which means that any bug is handled and doesn't percolate up the stack. There seems
to be no way to get the debugger to halt on a handled exception. In client.py, there is</div>
<div class="gmail_default" style="font-family:'times new roman',serif">
<div class="gmail_default"> except Exception as e:</div>
<div class="gmail_default"> raise exceptions.AuthorizationFailure("Authorization Failed: "</div>
<div>which makes debugging a challenge..</div>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif">I think that the exception is in the call to a.get_auth_ref(self.session). I think that the problem is that a, a Password object, is not callable.</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default">
<div class="gmail_default" style="font-family:'times new roman',serif">(Pdb) print callable(a)</div>
<div class="gmail_default" style="font-family:'times new roman',serif">False</div>
<div class="gmail_default" style="font-family:'times new roman',serif">(Pdb) </div>
<div class="gmail_default">
<div class="gmail_default"><font face="times new roman,serif">(Pdb) list</font></div>
<div class="gmail_default"><font face="times new roman,serif">168 <span style="white-space:pre-wrap">
</span> token=token,</font></div>
<div class="gmail_default"><font face="times new roman,serif">169 <span style="white-space:pre-wrap">
</span> trust_id=trust_id,</font></div>
<div class="gmail_default"><font face="times new roman,serif">170 <span style="white-space:pre-wrap">
</span> tenant_id=project_id or tenant_id,</font></div>
<div class="gmail_default"><font face="times new roman,serif">171 <span style="white-space:pre-wrap">
</span> tenant_name=project_name or tenant_name)</font></div>
<div class="gmail_default"><font face="times new roman,serif">172 <span style="white-space:pre-wrap">
</span></font></div>
<div class="gmail_default"><font face="times new roman,serif">173 -><span style="white-space:pre-wrap">
</span> return a.get_auth_ref(self.session)</font></div>
<div class="gmail_default"><font face="times new roman,serif">174 <span style="white-space:pre-wrap">
</span> except (exceptions.AuthorizationFailure, exceptions.Unauthorized):</font></div>
<div class="gmail_default"><font face="times new roman,serif">175 <span style="white-space:pre-wrap">
</span> _logger.debug("Authorization Failed.")</font></div>
<div class="gmail_default"><font face="times new roman,serif">176 <span style="white-space:pre-wrap">
</span> raise</font></div>
<div class="gmail_default"><font face="times new roman,serif">177 <span style="white-space:pre-wrap">
</span> except exceptions.EndpointNotFound:</font></div>
<div class="gmail_default"><font face="times new roman,serif">178 <span style="white-space:pre-wrap">
</span> msg = 'There was no suitable authentication url for this request'</font></div>
<div style="font-family:'times new roman',serif"><br>
</div>
</div>
<div style="font-family:'times new roman',serif"><br>
</div>
<div>
<div><font face="times new roman,serif">(Pdb) pp vars(a)</font></div>
<div><font face="times new roman,serif">{'auth_ref': None,</font></div>
<div><font face="times new roman,serif"> 'auth_url': '<a href="http://controller1-prod.sea.opencandy.com:35357/v2.0" target="_blank">http://controller1-prod.sea.opencandy.com:35357/v2.0</a>',</font></div>
<div><font face="times new roman,serif"> 'password': "XXXXXXXXXXX",</font></div>
<div><font face="times new roman,serif"> 'tenant_id': None,</font></div>
<div><font face="times new roman,serif"> 'tenant_name': 'admin',</font></div>
<div><font face="times new roman,serif"> 'token': None,</font></div>
<div><font face="times new roman,serif"> 'trust_id': None,</font></div>
<div><font face="times new roman,serif"> 'username': 'admin'}</font></div>
<div><font face="times new roman,serif">(Pdb) </font></div>
</div>
<div style="font-family:'times new roman',serif"><br>
</div>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif">I instrumented the code to see if I could get a better handle on the exception getting thrown:</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default">
<div class="gmail_default"><font face="times new roman,serif">(Pdb) list 165,184</font></div>
<div class="gmail_default"><font face="times new roman,serif">165 <span style="white-space:pre-wrap">
</span> a = v2_auth.Auth._factory(auth_url,</font></div>
<div class="gmail_default"><font face="times new roman,serif">166 <span style="white-space:pre-wrap">
</span> username=username,</font></div>
<div class="gmail_default"><font face="times new roman,serif">167 <span style="white-space:pre-wrap">
</span> password=password,</font></div>
<div class="gmail_default"><font face="times new roman,serif">168 <span style="white-space:pre-wrap">
</span> token=token,</font></div>
<div class="gmail_default"><font face="times new roman,serif">169 <span style="white-space:pre-wrap">
</span> trust_id=trust_id,</font></div>
<div class="gmail_default"><font face="times new roman,serif">170 <span style="white-space:pre-wrap">
</span> tenant_id=project_id or tenant_id,</font></div>
<div class="gmail_default"><font face="times new roman,serif">171 <span style="white-space:pre-wrap">
</span> tenant_name=project_name or tenant_name)</font></div>
<div class="gmail_default"><font face="times new roman,serif">172 <span style="white-space:pre-wrap">
</span></font></div>
<div class="gmail_default"><font face="times new roman,serif">173 <span style="white-space:pre-wrap">
</span> try:</font></div>
<div class="gmail_default"><font face="times new roman,serif">174 <span style="white-space:pre-wrap">
</span> return a.get_auth_ref(self.session)</font></div>
<div class="gmail_default"><font face="times new roman,serif">175 <span style="white-space:pre-wrap">
</span> except Exception as e:</font></div>
<div class="gmail_default"><font face="times new roman,serif">176 <span style="white-space:pre-wrap">
</span> print "Hit an exception %s" % e </font></div>
<div class="gmail_default"><font face="times new roman,serif">177 <span style="white-space:pre-wrap">
</span> pdb.set_trace()</font></div>
<div class="gmail_default"><font face="times new roman,serif">178 -><span style="white-space:pre-wrap">
</span> raise</font></div>
<div class="gmail_default"><font face="times new roman,serif">179 <span style="white-space:pre-wrap">
</span> except (exceptions.AuthorizationFailure, exceptions.Unauthorized):</font></div>
<div class="gmail_default"><font face="times new roman,serif">180 <span style="white-space:pre-wrap">
</span> _logger.debug("Authorization Failed.")</font></div>
<div class="gmail_default"><font face="times new roman,serif">181 <span style="white-space:pre-wrap">
</span> raise</font></div>
<div class="gmail_default"><font face="times new roman,serif">182 <span style="white-space:pre-wrap">
</span> except exceptions.EndpointNotFound:</font></div>
<div class="gmail_default"><font face="times new roman,serif">183 <span style="white-space:pre-wrap">
</span> msg = 'There was no suitable authentication url for this request'</font></div>
<div class="gmail_default"><font face="times new roman,serif">184 <span style="white-space:pre-wrap">
</span> raise exceptions.AuthorizationFailure(msg)</font></div>
<div style="font-family:'times new roman',serif"><br>
</div>
<div style="font-family:'times new roman',serif">
<div>(Pdb) c</div>
<div>Hit an exception 'module' object is not callable</div>
<div>> /usr/lib/python2.6/site-packages/keystoneclient/v2_0/client.py(178)get_raw_token_from_identity_service()</div>
<div>-> raise</div>
<div><br>
</div>
</div>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif">Not sure what to do next.</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif">Jeff</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
<div class="gmail_default" style="font-family:'times new roman',serif"><br>
</div>
</div>
<div><br>
</div>
-- <br>
<div dir="ltr"><b>Jeff Silverman</b>
<div>Systems Engineer</div>
<div><a href="tel:%28253%29%20459-2318" value="+12534592318" target="_blank">(253) 459-2318</a> (c)</div>
<div><img src="https://dl.dropboxusercontent.com/u/16943296/SweetLabs-Signatures/New_2014/signature-logo.png"><br>
</div>
</div>
</div>
</div></div></span><br>
<hr>
<font face="Arial" color="Gray" size="1">This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely
for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to
this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.<br>
</font>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><b>Jeff Silverman</b><div>Systems Engineer</div><div>(253) 459-2318 (c)</div><div><img src="https://dl.dropboxusercontent.com/u/16943296/SweetLabs-Signatures/New_2014/signature-logo.png"><br>
</div></div>
</div>