<div dir="ltr"><div>Hello,</div><div><br></div><div>I would appreciate if you help me to troubleshoot the following issue:</div><div><br></div><div>I am having error 403 intermittenly when listing containers in swift. Sometimes the error appears a few times per hour, sometimes once per day. Basically, it's possible to reproduce the error with a simple curl command:</div>
<div><br></div><div>curl --get -v -H 'X-Auth-Token: ef644...' <a href="http://swift-proxy.example.com:8080/v1/AUTH_323d0.">http://swift-proxy.example.com:8080/v1/AUTH_323d0.</a>..</div><div><body></div><div>
<h1>403 Forbidden</h1></div><div>Access was denied to this resource.<br /><br /></div><div></body></div><div><br></div><div>The token and swift proxy endpoint are all correct as most of the time the command works.</div>
<div><br></div><div>A few words about infrastructure: I use swift 1.7.4 and several swift proxies. Users are authenticated via Keystone. Tokens are cached with memcached on swift proxy servers.</div><div><br></div><div>I did a lot of tests to figure out what service generates such error:</div>
<div><br></div><div>- same issue happens with each swift proxy server, with or without memcached enabled</div><div>- it happens with different users and in different tenants</div><div>- I downloaded sources of swift and Keystone and grepped on that error. There are some HTTPForbidden values returned in code but no one with the body 'Access denied to this resource'</div>
<div>- I tried monitoring traffic with tcpdump to catch the error and understand who's sending it but with no success yet</div><div>- the issue might be related to swift ACL rules but I haven't set any read/write permissions for containers</div>
<div>- set debug logs for swift proxy but nothing has been found yet</div><div><br></div><div>Please help me to understand how this error is returned. Thank you for your time.</div><div><br></div><div><br></div>-- <br>Kind regards,<div>
Andrii Loshkovskyi</div>
</div>