<div>The "scripted configuration" openstack-manuals currently refers to (written by Lorin, CC'd here): <a href="https://github.com/nimbis/keystone-init">https://github.com/nimbis/keystone-init</a></div><div><br>
</div><div>Bugs in openstack-manuals don't really apply there :-/</div><div><br></div><div>I can't argue with having a scripted solution -- that's great, no doubt. However, I assume that making the scripted solution first and foremost in the manual leads most users to blindly run the script, bypassing the educational portion of the manual. Beyond that, the docs use the CLI, and the linked script uses the Python API directly, which means it will be difficult for most users to follow them both, side by side.</div>
<div><br></div><div>At the very least, I'd like to move this approach to the end of the page; and ideally, the script would be managed by openstack.<br clear="all"><div><br></div>-Dolph<br>
<br><div class="gmail_quote">On Tue, Oct 2, 2012 at 7:19 PM, Anne Gentle <span dir="ltr"><<a href="mailto:anne@openstack.org" target="_blank">anne@openstack.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Comments below. With an "I object." :)<br><br><div class="gmail_quote"><div class="im">On Tue, Oct 2, 2012 at 6:50 PM, Dolph Mathews <span dir="ltr"><<a href="mailto:dolph.mathews@gmail.com" target="_blank">dolph.mathews@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I find it odd that the document describes two approaches for configuring keystone -- one being a relatively undocumented, scripted approach not managed or distributed by OpenStack. Surely these two approaches will continue to evolve seperately and we'll experience more issues such as this one.<div>
<br></div><div>Anyone have any objections to removing this "scripted configuration" section in favor of focusing on the existing "manual" approach?</div></blockquote></div><div><br>Sorry, I have to object after watching this page and the scripts evolve over the last 9-12 months. There just has to be a scripted option and I agree it needs to be tested and maintained. I'm fine with having the keystone script be the documented one. For a while though the scripts were populating templated catalogs (files) not populating the database.<br>
<br>I think the best fix is to:<br> - ensure scripts have exactly the documented names of tenants, users, etc.<br> - patch the doc to use only the names in the script and manual in the verification step.<br><br>Doc bug logged here describing the work needing done:<br>
<a href="https://bugs.launchpad.net/openstack-manuals/+bug/1060536" target="_blank">https://bugs.launchpad.net/openstack-manuals/+bug/1060536</a><br><br><br></div><div><div class="h5"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><br></div><div><a href="http://docs.openstack.org/trunk/openstack-compute/install/apt/content/setting-up-tenants-users-and-roles.html" target="_blank">http://docs.openstack.org/trunk/openstack-compute/install/apt/content/setting-up-tenants-users-and-roles.html</a><br clear="all">
<div><br></div>-Dolph<br>
<br><br><div class="gmail_quote">On Tue, Oct 2, 2012 at 6:42 PM, Ahmed Al-Mehdi <span dir="ltr"><<a href="mailto:ahmed@coraid.com" target="_blank">ahmed@coraid.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div style="direction:ltr;font-size:x-small;font-family:Tahoma">
<div>
<div><font face="tahoma">Hi Dolph<a></a>,</font></div>
<div> </div>
<div><font face="tahoma"></font></div>
<div><font face="tahoma">I am now getting the same output as the "curl" command, basically "Invalid Tenant". At this point</font></div>
<div><font face="tahoma"></font></div>
<div><font face="tahoma"><a></a></font> </div>
<div><font face="tahoma"><font face="tahoma"><a href="mailto:root@ubuntu1" target="_blank">root@ubuntu1</a></font>:~# keystone --os<a></a>-username=adminUser<a></a> --os<a></a>-password=secretword<a></a> --os<a></a>-tenant-name=service --os<a></a>-auth-url<a></a>=<a href="http://10.0" target="_blank">http://10.0</a>.<br>
2.15:35357/v2.0<a></a> token-get<div><div><br>
No handlers could be found for logger "keystoneclient.client<a></a>"<br></div></div>
Invalid tenant (HTTP 401)</font></div>
<div><font face="tahoma"></font></div>
<div><font face="tahoma"></font></div>
<div><font face="tahoma"></font> </div>
<div><font face="tahoma">Without the "os<a></a>-tenant-name" parameter, I seem to get "good' response.</font></div>
<div><font face="tahoma"></font></div>
<div><a></a> </div>
<div><a href="mailto:root@ubuntu1" target="_blank">root@ubuntu1</a>:~# keystone --os<a></a>-username=adminUser<a></a> --os<a></a>-password=secretword<a></a> --os<a></a>-auth-url<a></a>=<a href="http://10.0.2.15:35357/v2.0" target="_blank">http://10.0.2.15:35357/v2.0</a> token-get<br>
No handlers could be found for logger "keystoneclient.v2_0.client<a></a>"<br>
+----------+----------------------------------+<br>
| Property | Value |<br>
+----------+----------------------------------+<br>
| expires | 2012-10-03T23:31:17Z<a></a> |<br>
| id | 31078072aae94f5aab5c8e46ff5f6373<a></a> |<br>
| user_id<a></a> | 3e674f7f64ba452cb20781b8d5e26b7f<a></a> |<br>
+----------+----------------------------------+<br>
<font face="tahoma"></font></div>
<div><font face="tahoma">At this point, I feel like I am running into issues with/in the python / PyYAML<a></a> script (<a href="https://github.com/nimbis/keystone-init.git" target="_blank">https://github.com/nimbis/keystone-init.git</a>) which must not be populating info
into keystone "accurately" and most probably not equivalent to manual steps mentioned in "Deploy<a></a> and Install OpenStack<a></a> - Red Hat Ubuntu<a></a>". I will look into the script.</font></div>
<div> </div>
<div><font face="tahoma"></font></div>
<div><font face="tahoma">Regards,</font></div>
<div><font face="tahoma">Ahmed.</font></div>
</div>
<div dir="ltr"><font color="#000000" face="Tahoma"></font> </div>
<div style="DIRECTION:ltr">
<hr>
<font color="#000000" face="Tahoma"><b>From:</b> Dolph Mathews [<a href="mailto:dolph.mathews@gmail.com" target="_blank">dolph.mathews@gmail.com</a>]<br>
<b>Sent:</b> Tuesday, October 02, 2012 2:19 PM<div><div><div><div><br>
<b>To:</b> Ahmed Al-Mehdi<br>
<b>Cc:</b> heckj; <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
<b>Subject:</b> Re: [Openstack] Enabling logging in keystone.<br>
</div></div></div></div></font><br>
</div><div><div><div><div>
<div></div>
<div>No worries, that's what a second set of eyes is for!
<div><br>
</div>
<div>By specifying a token and endpoint, you're bypassing the authentication process that your curl command is performing.</div>
<div><br>
</div>
<div>You can test authentication with the keystone client using:</div>
<div><br>
</div>
<div dir="ltr">$ keystone --os-username=adminUser --os-password=secretword --os-tenant-name=adminTenant --os-authurl=<font style="LINE-HEIGHT:normal" color="#000000"><a style="LINE-HEIGHT:normal" href="http://10.0.2.15:35357/v2.0/tokens" target="_blank">http://10.0.2.15:35357/v2.0</a> token-get</font></div>
<div dir="ltr"><font size="+0"><span style="LINE-HEIGHT:normal"><br>
</span></font></div>
<div dir="ltr"><font color="#000000"></font><font size="+0"><span style="LINE-HEIGHT:normal">But as Anne pointed out, you don't have a tenant named "adminTenant". You'll also need to make sure you've granted a role to your user on the specified tenant for
authorization to succeed. You can remove the tenant name argument from the token-get call to test authentication without authorization (therefore without requiring anything but a valid user in your keystone install).</span></font></div>
<div dir="ltr"><font size="+0"><span style="LINE-HEIGHT:normal"><br>
</span></font></div>
<div dir="ltr"><font size="+0"><span style="LINE-HEIGHT:normal">-Dolph<span></span><br>
</span></font><br>
On Tuesday, October 2, 2012, Ahmed Al-Mehdi wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">
<div>
<div style="FONT-FAMILY:Tahoma;DIRECTION:ltr;FONT-SIZE:x-small">
<div>Hi Dolph<a></a>,</div>
<div> </div>
<div>Very sorry about that. With the correct token, calling keystone from the cli<a></a> is working. However, the curl command is failing. Will this cause an issue down the line as I start to install glance and nova?</div>
<div> </div>
<div> </div>
<div>#> keystone --token 012345SECRET99TOKEN012345<a></a> --endpoint <a href="http://10.0.2.15:35357/v2.0" target="_blank">
http://10.0.2.15:35357/v2.0</a> tenant-list<br>
+----------------------------------+---------------+---------+<br>
| id | name | enabled |<br>
+----------------------------------+---------------+---------+<br>
| 07a44f9d55694d638f41bc160c14b42e<a></a> | openstackDemo<a></a> | True |<br>
| 0e4cc20586ae42329db51e0c6f807731<a></a> | service | True |<br>
+----------------------------------+---------------+---------+<br>
</div>
<div>#> curl -d '{"auth": {"tenantName<a></a>": "adminTenant<a></a>", "passwordCredentials<a></a>": {"username": "adminUser<a></a>", "password": "secretword<a></a>"}}}' -H "Content-type: application/json<a></a>"
<a href="http://10.0.2.15:35357/v2.0/tokens" target="_blank">http://10.0.2.15:35357/v2.0/tokens</a> | python -mjson.tool<a></a><br>
% Total % Received % Xferd<a></a> Average Speed Time Time<a></a> Time<a></a> Current<br>
Dload<a></a> Upload Total Spent Left Speed<br>
100 231 0 116 100 115 2771 2747 --:--:-- --:--:-- --:--:-- 3052<br>
{<br>
"error": {<br>
"code": 401,<br>
"message": "The request you have made requires authentication.",<br>
"title": "Not Authorized"<br>
}<br>
}</div>
<div> </div>
<div>Regards,</div>
<div>Ahmed.</div>
<div> </div>
<div> </div>
<div>
<hr>
</div>
<div><font color="#000000" face="Tahoma"><b>From:</b> Dolph Mathews [<a href="https://exg5.exghost.com/owa/UrlBlockedError.aspx" target="_blank">dolph.mathews@gmail.com</a><a></a>]<br>
<b>Sent:</b> Tuesday, October 02, 2012 12:12 PM<br>
<b>To:</b> Ahmed Al-Mehdi<a></a><br>
<b>Cc:</b> heckj<a></a>; <a href="https://exg5.exghost.com/owa/UrlBlockedError.aspx" target="_blank">
openstack@lists.launchpad.net</a><a></a><br>
<b>Subject:</b> Re: [Openstack<a></a>] Enabling logging in keystone.<br>
</font><br>
</div>
<div></div>
<div>You're missing a "5" on the admin_token<a></a> you've specified on the command line.
<div><br>
</div>
<div><span style="FONT-FAMILY:arial,sans-serif;COLOR:rgb(34,34,34);FONT-SIZE:13px"><a></a><span style="FONT-FAMILY:arial,sans-serif;COLOR:rgb(34,34,34);FONT-SIZE:13px">012345SECRET99TOKEN01234</span> (your CLI<a></a> arg<a></a>)</span></div>
<div><span style="FONT-FAMILY:arial,sans-serif;COLOR:rgb(34,34,34);FONT-SIZE:13px"><a></a><span style="FONT-FAMILY:arial,sans-serif;COLOR:rgb(34,34,34);FONT-SIZE:13px">012345SECRET99TOKEN012345</span> (</span><span style="FONT-FAMILY:arial,sans-serif;COLOR:rgb(34,34,34);FONT-SIZE:13px"><span style="FONT-FAMILY:arial,sans-serif;COLOR:rgb(34,34,34);FONT-SIZE:13px">keystone.conf</span><a></a>)</span><font color="#222222" face="arial, sans-serif"><br clear="all">
</font>
<div><br>
</div>
-Dolph<a></a><br>
<br>
<br>
<div>On Tue, Oct 2, 2012 at 1:08 PM, Ahmed Al-Mehdi<a></a> <span dir="ltr"><<a>ahmed@coraid.com</a><a></a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex">
Hi Joe,<br>
<br>
I have put the conf file (renamed to ahmed_keystone.conf<a></a>) into gist.<br>
<br>
git://<a href="http://gist.github.com/3821846.git" target="_blank">gist.github.com/3821846.git</a><br>
<br>
Please let me know if you have any issues accessing the file.<br>
<br>
Thank you very much for helping me out. I have a feeling the issue might be in the python script to populate keystone. When I previously input the data manually, I got keystone configured properly.<br>
<br>
Regards,<br>
<div>Ahmed.<br>
<br>
<br>
________________________________________<br>
From: heckj<a></a> [<a>heckj@mac.com</a><a></a>]<br>
</div>
Sent: Tuesday, October 02, 2012 10:56 AM<br>
<div>
<div>To: Ahmed Al-Mehdi<a></a><br>
Cc: <a>openstack@lists.launchpad.net</a><a></a><br>
Subject: Re: [Openstack<a></a>] Enabling logging in keystone.<br>
<br>
Ahmed - can you put your keystone.conf<a></a> into a paste or gist and share it with me? I'd be happy to help you debug this.<br>
<br>
I'm assuming you're running keystone on the system with the IP address 10.0.2.15, correct?<br>
<br>
-joe<a></a><br>
<br>
On Oct 2, 2012, at 10:45 AM, Ahmed Al-Mehdi<a></a> <<a>ahmed@coraid.com</a><a></a>> wrote:<br>
<br>
> Hi Joe,<br>
><br>
> I noticed I did not put the port number in the URL, now I am getting a more meaningful error:<br>
><br>
> #> keystone --token 012345SECRET99TOKEN01234<a></a> --endpoint <a href="http://10.0.2.15:35357/v2.0" target="_blank">
http://10.0.2.15:35357/v2.0</a> tenant-list<br>
> No handlers could be found for logger "keystoneclient.client<a></a>"<br>
> Unable to authorize user<br>
><br>
> Regards,<br>
> Ahmed.<br>
><br>
> ________________________________________<br>
> From: openstack-bounces+ahmed<a></a>=<a>coraid.com@lists.launchpad.net</a><a></a> [openstack-bounces+ahmed<a></a>=<a>coraid.com@lists.launchpad.net</a><a></a>] On Behalf Of Ahmed Al-Mehdi<a></a> [<a>ahmed@coraid.com</a><a></a>]<br>
> Sent: Tuesday, October 02, 2012 10:30 AM<br>
> To: heckj<a></a><br>
> Cc: <a>openstack@lists.launchpad.net</a><a></a><br>
> Subject: Re: [Openstack<a></a>] Enabling logging in keystone.<br>
><br>
> Hi Joe,<br>
><br>
> Unfortunately before I read your response I re-installed my Ubuntu<a></a> server. I repeated the same steps mentioned in the OpenStack<a></a> document "Deploy and Install OpenStack<a></a> - RedHat<a></a> Ubuntu<a></a>" and also used the script mentioned
in it (<a href="https://github.com/nimbis/keystone-init/blob/master/keystone-init.py" target="_blank">https://github.com/nimbis/keystone-init/blob/master/keystone-init.py</a>) to populate keystone. I reboot the server prior to running your suggested command
and now running into a different issue, which I feel maybe due to not starting some service. Btw, my host OS is Ubuntu<a></a> 12.04 (32 bit) running inVirtualBox<a></a>.<br>
><br>
> Currently I am getting the following error:<br>
><br>
> #> keystone --token 012345SECRET99TOKEN01234<a></a> --endpoint <a href="http://10.0.2.15/v2.0" target="_blank">
http://10.0.2.15/v2.0</a> tenant-lis</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
<br>
-- <br>
<div><br>
</div>
-Dolph<br>
</div>
</div></div></div></div></div>
</div>
</blockquote></div><br></div>
</blockquote></div></div></div><br>
</blockquote></div><br></div>