<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">Hi All,</div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">While intending to direct requests from the openstack client to the public endpoint of my keystone instance, it seems as though after initial authentication the client gives subsequent requests to the admin endpoint. Is there a setting somewhere that I’ve missed either client or server side where the entire request could be done through the public endpoint? My install/config is the all-in-one devstack using master. Absolutely no local changes.</div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">Marked-up copy paste :</div><blockquote style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; margin: 0px 0px 0px 40px; border: none; padding: 0px;"><div><br></div></blockquote><div><blockquote style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; margin: 0px 0px 0px 40px; border: none; padding: 0px;"><p style="margin: 0px; font-size: 11px; font-family: Menlo;">timothy_symanczyk@community:~$ source ./becomeDemo.sh </p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="color: #c33720"><b>OS_</b></span>USER_DOMAIN_NAME=Default</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="color: #c33720"><b>OS_</b></span>PROJECT_NAME=demo</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="color: #c33720"><b>OS_</b></span>PASSWORD=stack</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="color: #c33720"><b>OS_</b></span>API_VERSION=3</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="color: #c33720"><b>OS_</b></span>AUTH_URL=http://192.168.207.21:5000/</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="color: #c33720"><b>OS_</b></span>USERNAME=demo</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="color: #c33720"><b>OS_</b></span>PROJECT_DOMAIN_NAME=Default</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="font-family: Calibri, sans-serif; font-size: 14px;"><br></span></p></blockquote><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="font-family: Calibri, sans-serif; font-size: 14px;"><b>Auth URL explicitly specified as the public :5000 endpoint.</b></span></p></div><blockquote style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; margin: 0px 0px 0px 40px; border: none; padding: 0px;"><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">timothy_symanczyk@community:~$ openstack --debug project show demo</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell options: Namespace(auth_type='', auth_url='http://192.168.207.21:5000/', cacert='', cloud='', debug=True, default_domain='default', deferred_help=False, domain_id='', domain_name='', endpoint='', identity_provider='', identity_provider_url='', insecure=None, log_file=None, os_compute_api_version='2', os_identity_api_version='2', os_image_api_version='1', os_network_api_version='2', os_object_api_version='1', os_project_id=None, os_project_name=None, os_volume_api_version='1', password='stack', project_domain_id='', project_domain_name='Default', project_id='', project_name='demo', region_name='', service_provider_endpoint='', timing=False, token='', trust_id='', url='', user_domain_id='', user_domain_name='Default', user_id='', username='demo', verbose_level=3, verify=None)</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell defaults: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'api_timeout': None, 'baremetal_api_version': '1', 'image_api_use_tasks': False, 'endpoint_type': 'public', 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'disable_vendor_agent': {}}</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell cloud cfg: {'auth_type': 'osc_password', 'compute_api_version': '2', 'database_api_version': '1.0', 'timing': False, 'network_api_version': '2', 'object_api_version': '1', 'image_api_version': '1', 'verify': True, 'verbose_level': 3, 'region_name': '', 'api_timeout': None, 'baremetal_api_version': '1', 'auth': {'username': 'demo', 'project_name': 'demo', 'tenant_name': 'demo', 'user_domain_name': 'Default', 'auth_url': 'http://192.168.207.21:5000/', 'password': 'stack', 'project_domain_name': 'Default'}, 'default_domain': 'default', 'image_api_use_tasks': False, 'endpoint_type': 'public', 'floating_ip_source': 'neutron', 'key': None, 'cacert': None, 'deferred_help': False, 'identity_api_version': '2', 'volume_api_version': '1', 'cert': None, 'secgroup_source': 'neutron', 'debug': True, 'disable_vendor_agent': {}}</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell compute API version 2, cmd group openstack.compute.v2</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell network API version 2, cmd group openstack.network.v2</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell image API version 1, cmd group openstack.image.v1</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell volume API version 1, cmd group openstack.volume.v1</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell identity API version 2, cmd group openstack.identity.v2</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell object_store API version 1, cmd group openstack.object_store.v1</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">INFO: openstackclient.shell command: project show -> openstackclient.identity.v2_0.project.ShowProject</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.api.auth Auth plugin osc_password selected</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.api.auth auth_type: osc_password</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">INFO: openstackclient.common.clientmanager Using auth plugin: osc_password</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.common.clientmanager Using parameters {'username': 'demo', 'project_name': 'demo', 'auth_url': 'http://192.168.207.21:5000/', 'tenant_name': 'demo', 'user_domain_name': 'Default', 'password': 'stack', 'project_domain_name': 'Default'}</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.common.clientmanager Get auth_ref</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://192.168.207.21:5000/ -H "Accept: application/json" -H "User-Agent: python-openstackclient"</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">INFO: requests.packages.urllib3.connectionpool Starting new HTTP connection (1): 192.168.207.21</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: requests.packages.urllib3.connectionpool "GET / HTTP/1.1" 300 597</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session RESP: [300] content-length: 597 vary: X-Auth-Token keep-alive: timeout=5, max=100 server: Apache/2.4.7 (Ubuntu) connection: Keep-Alive date: Tue, 08 Sep 2015 08:10:05 GMT content-type: application/json </p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">RESP BODY: {"versions": {"values": [{"status": "stable", "updated": "2015-03-30T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}], "id": "v3.4", "links": [{"href": "http://192.168.207.21:5000/v3/", "rel": "self"}]}, {"status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}], "id": "v2.0", "links": [{"href": "http://192.168.207.21:5000/v2.0/", "rel": "self"}, {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}]}]}}</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"><br></p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.auth.identity.v3.base Making authentication request to http://192.168.207.21:5000/v3/auth/tokens</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: requests.packages.urllib3.connectionpool "POST /v3/auth/tokens HTTP/1.1" 201 4915</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.identity.v2_0.project.ShowProject take_action(Namespace(columns=[], formatter='table', max_width=0, prefix='', project='demo', variables=[]))</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.identity.client Instantiating identity client: <class 'openstackclient.identity.client.IdentityClientv2'></p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.auth.identity.v3.base Making authentication request to http://192.168.207.21:5000/v3/auth/tokens</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: requests.packages.urllib3.connectionpool "POST /v3/auth/tokens HTTP/1.1" 201 4915</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></p></blockquote><div><p style="margin: 0px;"><span style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><b>Everything above here appears to use the public :5000 endpoint, and then everything after here appears to use the admin :35357 endpoint.</b></span></p></div><blockquote style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; margin: 0px 0px 0px 40px; border: none; padding: 0px;"><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://192.168.207.21:35357/ -H "Accept: application/json" -H "User-Agent: python-openstackclient"</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">INFO: requests.packages.urllib3.connectionpool Starting new HTTP connection (1): 192.168.207.21</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: requests.packages.urllib3.connectionpool "GET / HTTP/1.1" 300 599</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session RESP: [300] content-length: 599 vary: X-Auth-Token keep-alive: timeout=5, max=100 server: Apache/2.4.7 (Ubuntu) connection: Keep-Alive date: Tue, 08 Sep 2015 08:10:05 GMT content-type: application/json </p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">RESP BODY: {"versions": {"values": [{"status": "stable", "updated": "2015-03-30T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}], "id": "v3.4", "links": [{"href": "http://192.168.207.21:35357/v3/", "rel": "self"}]}, {"status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}], "id": "v2.0", "links": [{"href": "http://192.168.207.21:35357/v2.0/", "rel": "self"}, {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}]}]}}</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://192.168.207.21:35357/v2.0/tenants/demo -H "User-Agent: python-keystoneclient" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}e68eb68e96e582cf8f9a7dbcb0438b1674cfc30a"</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: requests.packages.urllib3.connectionpool "GET /v2.0/tenants/demo HTTP/1.1" 403 179</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session RESP: [403] content-length: 179 vary: X-Auth-Token keep-alive: timeout=5, max=99 server: Apache/2.4.7 (Ubuntu) connection: Keep-Alive date: Tue, 08 Sep 2015 08:10:05 GMT content-type: application/json x-openstack-request-id: req-900925a9-bbe6-4deb-a50c-6d496681503b </p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">RESP BODY: {"error": {"message": "You are not authorized to perform the requested action: admin_required (Disable debug mode to suppress these details.)", "code": 403, "title": "Forbidden"}}</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session Request returned failure status: 403</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://192.168.207.21:35357/v2.0/tenants -H "User-Agent: python-keystoneclient" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}e68eb68e96e582cf8f9a7dbcb0438b1674cfc30a"</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: requests.packages.urllib3.connectionpool "GET /v2.0/tenants HTTP/1.1" 403 179</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session RESP: [403] content-length: 179 vary: X-Auth-Token keep-alive: timeout=5, max=98 server: Apache/2.4.7 (Ubuntu) connection: Keep-Alive date: Tue, 08 Sep 2015 08:10:05 GMT content-type: application/json x-openstack-request-id: req-336ef5dc-1f46-4cde-946a-ba91415b5d57 </p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">RESP BODY: {"error": {"message": "You are not authorized to perform the requested action: admin_required (Disable debug mode to suppress these details.)", "code": 403, "title": "Forbidden"}}</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: keystoneclient.session Request returned failure status: 403</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">+---------+----------------------------------+</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">| Field | Value |</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">+---------+----------------------------------+</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">| enabled | True |</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">| id | 20f42190a63c443e9209d2bc576b14e4 |</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">| name | demo |</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">+---------+----------------------------------+</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">DEBUG: openstackclient.shell clean_up ShowProject: </p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">timothy_symanczyk@community:~$</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></p></blockquote></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="font-family: Calibri, sans-serif; font-size: 14px;">Any help or insight greatly appreciated.</span></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="font-family: Calibri, sans-serif; font-size: 14px;"><br></span></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><span style="font-family: Calibri, sans-serif; font-size: 14px;">Tim</span></p></div></body></html>