<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>I think I'm figuring this out, then again maybe not. For general users, via the command line, you need to specify your user id as "tenant:username" after reading through the source (my Python is really rusty). So, when I try this I now get a 403 Forbidden
error. I had high hopes.</div>
<div><br>
</div>
<div>Just another data point.</div>
<div><br>
</div>
<div>Ross</div>
<br>
<div>
<div>On Feb 22, 2012, at 2:52 PM, Lillie Ross-CDSR11 wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<font class="Apple-style-span" face="Courier">I've successfully installed all OpenStack components with Keystone authorization (well, mostly at least), but am now seeing an interesting problem for new accounts (created in Dashboard).</font>
<div><font class="Apple-style-span" face="Courier"><br>
</font></div>
<div><font class="Apple-style-span" face="Courier">Using my admin account, I issue a swift stat command </font><span class="Apple-style-span" style="font-family: Courier; ">and get the expected response back from swift-proxy:</span></div>
<div><font class="Apple-style-span" face="Courier"><br>
</font></div>
<div>
<div><font class="Apple-style-span" face="Courier">root@swift:/etc/swift# swift -v -V 2 -A
<a href="http://173.23.181.1:5000/v2.0/">http://173.23.181.1:5000/v2.0/</a> -U admin -K admin stat</font></div>
<div><font class="Apple-style-span" face="Courier">StorageURL: <a href="http://173.23.181.2:8080/v1/AUTH_1">
http://173.23.181.2:8080/v1/AUTH_1</a></font></div>
<div><font class="Apple-style-span" face="Courier">Auth Token: 10111213141516171819</font></div>
<div><font class="Apple-style-span" face="Courier"> Account: AUTH_1</font></div>
<div><font class="Apple-style-span" face="Courier">Containers: 5</font></div>
<div><font class="Apple-style-span" face="Courier"> Objects: 20</font></div>
<div><font class="Apple-style-span" face="Courier"> Bytes: 6335748</font></div>
<div><font class="Apple-style-span" face="Courier">Accept-Ranges: bytes</font></div>
<div><font class="Apple-style-span" face="Courier">X-Trans-Id: tx6ffec7207a5c41329e53dbab6a6e2c37</font></div>
</div>
<div><font class="Apple-style-span" face="Courier"><br>
</font></div>
<div><font class="Apple-style-span" face="Courier">Looking at the keystone admin.log file (with debugging enabled) I see the following:</font></div>
<div><font class="Apple-style-span" face="Courier"><br>
</font></div>
<div><font class="Apple-style-span" face="Courier">
<div>2012-02-22 14:26:38 DEBUG [routes.middleware] Matched POST /tokens</div>
<div>2012-02-22 14:26:38 DEBUG [routes.middleware] Route path: '/tokens', defaults: {'action': u'authenticate', 'controller': <keystone.controllers.auth.AuthController object at 0x170da10>}</div>
<div>2012-02-22 14:26:38 DEBUG [routes.middleware] Match dict: {'action': u'authenticate', 'controller': <keystone.controllers.auth.AuthController object at 0x170da10>}</div>
<div>2012-02-22 14:26:38 INFO [sqlalchemy.engine.base.Engine.0x...14d0] SELECT tenants.id AS tenants_id, tenants.name AS tenants_name, tenants.`desc` AS tenants_desc, tenants.enabled AS tenants_enabled </div>
<div>FROM tenants </div>
<div>WHERE tenants.name = %s </div>
<div> LIMIT 0, 1</div>
<div>2012-02-22 14:26:38 INFO [sqlalchemy.engine.base.Engine.0x...14d0] (u'admin',)</div>
<div>2012-02-22 14:26:38 DEBUG [sqlalchemy.engine.base.Engine.0x...14d0] Col ('tenants_id', 'tenants_name', 'tenants_desc', 'tenants_enabled')</div>
<div>2012-02-22 14:26:38 DEBUG [sqlalchemy.engine.base.Engine.0x...14d0] Row (1L, 'admin', 'All administrative tasks are to be grouped underneath this tenancy. Users are not to be associated with this tenant unless they have been granted admin roles.',
1L)</div>
<div>2012-02-22 14:26:38 INFO [sqlalchemy.engine.base.Engine.0x...14d0] SELECT users.id AS users_id, users.name AS users_name, users.password AS users_password, users.email AS users_email, users.enabled AS users_enabled, users.tenant_id AS users_tenant_id </div>
<div>FROM users </div>
<div>WHERE users.name = %s </div>
<div> LIMIT 0, 1</div>
<div>2012-02-22 14:26:38 INFO [sqlalchemy.engine.base.Engine.0x...14d0] (u'admin',)</div>
<div>
<div>2012-02-22 14:26:38 DEBUG [sqlalchemy.engine.base.Engine.0x...14d0] Col ('users_id', 'users_name', 'users_password', 'users_email', 'users_enabled', 'users_tenant_id')</div>
<div>2012-02-22 14:26:38 DEBUG [sqlalchemy.engine.base.Engine.0x...14d0] Row (1L, 'admin', '$6$rounds=40000$k5f0Zd1lOK3AVXbx$awVYhvdu1CI33hRhugjURheVePZYh60EjWSUa4Zwq0Ha48eNH3SQXSFVQeEYv4ffwUzlRVVkoUbr6C4Ai63WC.', None, 1L, 1L)</div>
<div>2012-02-22 14:26:38 INFO [sqlalchemy.engine.base.Engine.0x...14d0] SELECT users.id AS users_id, users.name AS users_name, users.password AS users_password, users.email AS users_email, users.enabled AS users_enabled, users.tenant_id AS users_tenant_id </div>
<div>FROM users </div>
<div>WHERE users.tenant_id = %s AND users.id = %s </div>
<div> LIMIT 0, 1</div>
<div>2012-02-22 14:26:38 INFO [sqlalchemy.engine.base.Engine.0x...14d0] (1L, 1L)</div>
<div>2012-02-22 14:26:38 DEBUG [sqlalchemy.engine.base.Engine.0x...14d0] Col ('users_id', 'users_name', 'users_password', 'users_email', 'users_enabled', 'users_tenant_id')</div>
<div>2012-02-22 14:26:38 DEBUG [sqlalchemy.engine.base.Engine.0x...14d0] Row (1L, 'admin', '$6$rounds=40000$k5f0Zd1lOK3AVXbx$awVYhvdu1CI33hRhugjURheVePZYh60EjWSUa4Zwq0Ha48eNH3SQXSFVQeEYv4ffwUzlRVVkoUbr6C4Ai63WC.', None, 1L, 1L)</div>
<div>2012-02-22 14:26:38 . . .</div>
</div>
<div><br>
</div>
<div>However, when I issue the same command with a newly created user account I get a 401 not authorized command back from swift-proxy. For example:</div>
<div><br>
</div>
<div>
<div>root@swift:/etc/swift# swift -v -V 2 -A <a href="http://173.23.181.1:5000/v2.0/">
http://173.23.181.1:5000/v2.0/</a> -U lillie -K changeme stat</div>
<div>Auth GET failed: <a href="http://173.23.181.1:5000/v2.0/tokens">http://173.23.181.1:5000/v2.0/tokens</a> 401 Unauthorized</div>
</div>
<div><br>
</div>
<div>and the keystone admin.log file shows the following:</div>
<div><br>
</div>
<div>
<div>2012-02-22 14:30:40 DEBUG [routes.middleware] Matched POST /tokens</div>
<div>2012-02-22 14:30:40 DEBUG [routes.middleware] Route path: '/tokens', defaults: {'action': u'authenticate', 'controller': <keystone.controllers.auth.AuthController object at 0x170da10>}</div>
<div>2012-02-22 14:30:40 DEBUG [routes.middleware] Match dict: {'action': u'authenticate', 'controller': <keystone.controllers.auth.AuthController object at 0x170da10>}</div>
<div>2012-02-22 14:30:40 INFO [sqlalchemy.engine.base.Engine.0x...14d0] SELECT tenants.id AS tenants_id, tenants.name AS tenants_name, tenants.`desc` AS tenants_desc, tenants.enabled AS tenants_enabled </div>
<div>FROM tenants </div>
<div>WHERE tenants.name = %s </div>
<div> LIMIT 0, 1</div>
<div>2012-02-22 14:30:40 INFO [sqlalchemy.engine.base.Engine.0x...14d0] (u'lillie',)</div>
<div>2012-02-22 14:30:40 DEBUG [sqlalchemy.engine.base.Engine.0x...14d0] Col ('tenants_id', 'tenants_name', 'tenants_desc', 'tenants_enabled')</div>
<div>2012-02-22 14:30:40 DEBUG [eventlet.wsgi.server] 173.23.181.2 - - [22/Feb/2012 14:30:40] "POST /v2.0/tokens HTTP/1.1" 401 197 0.004990</div>
<div>2012-02-22 14:30:41 DEBUG [routes.middleware] Matched POST /tokens</div>
<div>2012-02-22 14:30:41 DEBUG [routes.middleware] Route path: '/tokens', defaults: {'action': u'authenticate', 'controller': <keystone.controllers.auth.AuthController object at 0x170da10>}</div>
<div>2012-02-22 14:30:41 DEBUG [routes.middleware] Match dict: {'action': u'authenticate', 'controller': <keystone.controllers.auth.AuthController object at 0x170da10>}</div>
<div>2012-02-22 14:30:41 INFO [sqlalchemy.engine.base.Engine.0x...14d0] SELECT tenants.id AS tenants_id, tenants.name AS tenants_name, tenants.`desc` AS tenants_desc, tenants.enabled AS tenants_enabled </div>
<div>FROM tenants </div>
<div>WHERE tenants.name = %s </div>
<div> LIMIT 0, 1</div>
<div>2012-02-22 14:30:41 INFO [sqlalchemy.engine.base.Engine.0x...14d0] (u'lillie',)</div>
<div>2012-02-22 14:30:41 DEBUG [sqlalchemy.engine.base.Engine.0x...14d0] Col ('tenants_id', 'tenants_name', 'tenants_desc', 'tenants_enabled')</div>
<div>2012-02-22 14:30:41 DEBUG [eventlet.wsgi.server] 173.23.181.2 - - [22/Feb/2012 14:30:41] "POST /v2.0/tokens HTTP/1.1" 401 197 0.003403</div>
</div>
<div><br>
</div>
<div>As seen above, after trying to retrieve the list of tenants for the user, I immediately get a 401 error. </div>
<div><br>
</div>
<div>The user account is a member of multiple tenants, as is the admin account. The default tenancy for the user (lillie) account is a project within our group. The default tenancy for the admin account is the admin account.</div>
<div><br>
</div>
<div>Now the interesting part. I'd previously created an account for the Glance image service. This account authenticates against keystone without problems. The default tenancy for this account is the corresponding 'glance' tenant.</div>
<div><br>
</div>
<div>Any clues? Thanks and regards,</div>
<div>Ross</div>
<div><br>
</div>
</font></div>
</div>
</blockquote>
</div>
<br>
</body>
</html>