Open Stack

> > I'm curious exactly what "Forbidden" message you're getting on the
> > OpenStack API page. A screenshot would be helpful.
> >
> http://www.matthias-runge.de/fedora/openstack-api-forbidden.png
> 
> So, my question was: when it's forbidden (by config, e.g through keystone),
> why do we show that link.

Aaaaand that's why seeing the *actual* error is helpful. That's a bug in the code. I've already got a review up to fix that:

https://review.openstack.org/#/c/15439/

Then you won't see the nasty debug error page anymore. It still won't "work", but it'll behave correctly.

> Interesting trying both, when logged in as admin, everything as shown as
> expected. When logged in as demo user, I get redirected to:
> http://localhost:8000/auth/login/?next=/settings/ec2/
> 
> When logging in as demo user again, I'm getting two error messages (those
> overlays) "Error: Unable to retrieve tenant list"
> At the same time, in keystone log:
> 2012-11-02 10:18:53  WARNING [keystone.common.wsgi] You are not
> authorized to perform the requested action: admin_required
> I installed it through openstack-demo-install
> 
> https://github.com/fedora-openstack/openstack-
> utils/blob/master/utils/openstack-demo-install

I'm not particularly familiar with how Fedora's install scripts take care of everything. Glancing through them I don't see anything particularly unusual in terms of customization, so I think the culprit may actually be a *lack* of configuration; read on...

> apparently, demo user has no special roles.

In DevStack (which is the reference configuration for development purposes, by and large) the demo user is given the role "Member" on the default project. It may be that the fact that your user has no particular roles is hitting some kind of limitation defined in one of the policy.json files or something of the sort. I couldn't say for certain.

All the best,

    - Gabriel