Search code examples
pythonopenstack-swiftkeystone

OpenStack Swift + Keystone: Unable to determine tenancy


I'm trying to access Swift with curl using Keystone-based authentication (following the Keystone API docs here).

Chapter 1: Fetching the token:

curl -d '{"auth": {"passwordCredentials": {
                     "username": "USERNAME", "password": "PASSWORD"}}}' \
     -H "Content-Type: application/json" \
     http://identity:35357/v2.0/tokens

Response:

{
  "access": {
    "token": {
      "expires": "2014-02-27T11:35:11Z", 
      "id": "TOKENID"
    }, 
    "serviceCatalog": [], 
    "user": {
      "username": "USERNAME", 
      "roles_links": [], 
      "id": "USERID", 
      "roles": [], 
      "name": "NAME"
    }
   }
}

Note that, contrary to what's said in the API docs, the tenant info is missing from the response.


Chapter 2: Authentication

curl -H "X-Auth-Token: TOKENID" http://swift/v1/AUTH_TENANTID/bucket

Response: 401 Unauthorized


Chapter 3: Troubleshooting

After looking inside the Keystone auth_token middleware, I found that it fails when trying to fetch the tenant from the token data:

def get_tenant_info():
    """Returns a (tenant_id, tenant_name) tuple from context."""
    def essex():
        """Essex puts the tenant ID and name on the token."""
        return (token['tenant']['id'], token['tenant']['name'])

    def pre_diablo():
        """Pre-diablo, Keystone only provided tenantId."""
         return (token['tenantId'], token['tenantId'])

    def default_tenant():
        """Pre-grizzly, assume the user's default tenant."""
        return (user['tenantId'], user['tenantName'])

    for method in [essex, pre_diablo, default_tenant]:
        try:
            return method()
        except KeyError:
             pass

    raise InvalidUserToken('Unable to determine tenancy.')

Since there is no tenant info in the token data, it always fails. What might I be doing wrong?


Solution

  • This answer addresses your initial authentication question, but not the rest of the question...

    Your initial request:

    curl -d '{"auth": {"passwordCredentials": {
                         "username": "USERNAME", "password": "PASSWORD"}}}' \
         -H "Content-Type: application/json" \
         http://identity:35357/v2.0/tokens
    

    Needs to provide either a tenantName or tenantId attribute. With either of these supplied, your reply should include both the tenant information and a service catalog, for looking up other service endpoints.

    So:

    curl -d '{"auth": {"tenantName": "mytenant", "passwordCredentials": {
                             "username": "USERNAME", "password": "PASSWORD"}}}' \
             -H "Content-Type: application/json" \
             http://identity:35357/v2.0/tokens
    

    Which should get you something like this:

    {
      "access": {
        "metadata": {
          "roles": [
            "9fe2ff9ee4384b1894a90878d3e92bab",
            "0ecb6fccfd8546148cbb00b6d51364ce"
          ],
          "is_admin": 0
        },
        "user": {
          "name": "lars",
          "roles": [
            {
              "name": "_member_"
            },
            {
              "name": "admin"
            }
          ],
          "id": "436d522125584cf3a21ddcf628d59e2e",
          "roles_links": [],
          "username": "lars"
        },
        "serviceCatalog": [
          {
            "name": "nova",
            "type": "compute",
            "endpoints_links": [],
            "endpoints": [
              {
                "publicURL": "http://192.168.200.1:8774/v2/28a490a259974817b88ce490a74df8d2",
                "id": "264f2b4179ca4d6ca3a62b7347db11ce",
                "internalURL": "http://192.168.200.1:8774/v2/28a490a259974817b88ce490a74df8d2",
                "region": "RegionOne",
                "adminURL": "http://192.168.200.1:8774/v2/28a490a259974817b88ce490a74df8d2"
              }
            ]
          },
          .
          .
          .
        ],
        "token": {
          "tenant": {
            "name": "users/lars",
            "id": "28a490a259974817b88ce490a74df8d2",
            "enabled": true,
            "description": null
          },
          "id": "TOKENID",
          "expires": "2014-02-21T20:07:36Z",
          "issued_at": "2014-02-20T20:07:36.189044"
        }
      }
    }