<div dir="ltr">Thanks you Tang and Joe for your inputs. I'll give it a try in my Havana setup. <div><br></div><div>Tang, I guess the solution you provided is not yet released in Havana. I mean to say if someone have latest released version setup of OpenStack Havana then by default he don't have Identity v3 compatibility for nova in his environment.</div>
<div><br></div><div>Regards,</div><div>Devendra<br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Apr 1, 2014 at 7:47 AM, Yaguang Tang <span dir="ltr"><<a href="mailto:heut2008@gmail.com" target="_blank">heut2008@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>so far, not all python-*client are ready for keystone v3, but if you want to try do some testing the correct procedure is <br>
</div><div> <br></div>1. add or modify keystone identity service endpoints to v3 eg. <a href="http://localhost:5000/v3" target="_blank">http://localhost:5000/v3</a><br>
</div>2. change all openstack services auth_token middleware to use v3 authentication, e.g. add auth_version=3.0 in nova.conf under [keystone_authtoken] section or in api-paste.ini file.<br></div><div>3. you need the two python-novaclient patch <a href="https://review.openstack.org/#/c/82149/" target="_blank">https://review.openstack.org/#/c/82149/</a> ,<a href="https://review.openstack.org/#/c/81749/" target="_blank">https://review.openstack.org/#/c/81749/</a>.<br>
</div>4. export OS_IDENTITY_API_VERSION=3<br> export OS_AUTH_URL=<a href="http://127.0.0.1:5000/v3" target="_blank">http://127.0.0.1:5000/v3</a><br><br></div>then you should be able to use v3 token to do authentication, run nova --debug list and check the result.<br>
<br><br><br> <br><div><br><div> <br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-04-01 0:47 GMT+08:00 Joe Gordon <span dir="ltr"><<a href="mailto:joe.gordon0@gmail.com" target="_blank">joe.gordon0@gmail.com</a>></span>:<div>
<div><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote"><div>On Mon, Mar 31, 2014 at 2:39 AM, Devendra Gupta <span dir="ltr"><<a href="mailto:dev29aug@gmail.com" target="_blank">dev29aug@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div style="font-family:arial,sans-serif;font-size:13px">
<div><div>Hi,<br></div>We have been doing analysis around keystone v3 api for authenticating with openstack components in Havana release but while doing so we are facing some issues with the authentication using keytone v3 API . <br>
<br></div><div>Below is the list of Components that we are using along with versions:-<br></div><div><b>Compute : v2</b><br></div><div><b>Identity : v2.0 & v3</b><br></div><div><b>Network : v2</b><br></div><div><b>Image : v2</b><br>
</div><div><span style="font-family:arial;font-size:small"> </span><br></div></div></div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div style="font-family:arial,sans-serif;font-size:13px"><div></div><div><br></div><div><br></div>Following are the concerns that we have :-<br><br></div><span style="font-family:arial,sans-serif;font-size:13px">1. After getting authentication token using API </span><b style="font-family:arial,sans-serif;font-size:13px">/v3/auth/tokens </b><span style="font-family:arial,sans-serif;font-size:13px">and supplying userid, password along with project scope , when we try to hit Compute's API </span><br style="font-family:arial,sans-serif;font-size:13px">
<div style="font-family:arial,sans-serif;font-size:13px"><b> v2/58d73fe0ec9c44e7a2127bf8abd60dc2/os-networks</b> we are getting <b>Internal server error occured : code 500.<br></b></div></div></blockquote><div><br></div>
<div><br></div></div><div><div>Nova doesn't support keystone v3 yet.</div></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div>
<div dir="ltr"><div style="font-family:arial,sans-serif;font-size:13px"><b><br><br></b></div><div style="font-family:arial,sans-serif;font-size:13px">
Moreover , even if we try to hit other components like Neutron we have similar issues . However, when we hit the same API call with keystone v2.0 generated auth token we are able to get results as desired.<br><br></div><div style="font-family:arial,sans-serif;font-size:13px">
Since keystone is by default enabled to use v3 and v2.0 , the tokens generated by v3 should be able to authenticate for othe components like nova, neutron , glance which it is not happening as of now.<br><br></div><div style="font-family:arial,sans-serif;font-size:13px">
So is it a configuration issue or keystone v3 version is not yet supported by other components.<br><br></div><div style="font-family:arial,sans-serif;font-size:13px">2. Can there be a scenario where keystone will be setup with v3 only instead of both v2.0 and v3.<br>
<br></div><span style="font-family:arial,sans-serif;font-size:13px">Please provide inputs on the above.</span><br><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">Regards,</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">Devendra Gupta</span></div></div>
<br></div>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div><br></div></div>
<br>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div></div></div><span><font color="#888888"><br><br clear="all"><br>-- <br><div dir="ltr"><div>Tang Yaguang</div><div><br></div><div>Canonical Ltd. | <a href="http://www.ubuntu.com" target="_blank">www.ubuntu.com</a> | <a href="http://www.canonical.com" target="_blank">www.canonical.com</a></div>
<div>Mobile: <a href="tel:%2B86%20152%201094%206968" value="+8615210946968" target="_blank">+86 152 1094 6968</a></div><div>gpg key: 0x187F664F</div><div> </div></div>
</font></span></div>
</blockquote></div><br></div></div></div>