"AuthorizationFailure" after I add/remove the current user in a project

Bug #1073811 reported by William
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
python-keystoneclient
Invalid
Undecided
Unassigned

Bug Description

My instructions are like below and I always use ipython to check the instructions are fine:
1. Create a new connection(unscope_token) from keystone client
unscope_conn = keystone_client.Client(username="admin", password="password", auth_url="http://127.0.0.1:5000/v2.0")
unscope_token = unscope_conn.auth_token

2. Create a scope_token from unscope_token
tokens = unscope_conn.tokens.authenticate(token=unscope_token, tenant_name="admin")
scope_token = tokens.id

3. Create a scope connection from scope_token
scope_conn = keystone_client.Client(token=scope_token, endpoint="http://127.0.0.1:35357/v2.0")

4. Add/Remove the current user in a project using the scope connection
user_id = "7345085bf11e47e98273affaf69b5ee6" #This is the user id for "admin"
role_id = "2ad4ede52c8940779f8bb4746d3f44c6" #This is one of the roles in the role list
tenant_id = "b2d0bf5931e949e988a2ce2dbb2ce0fa" #This is one of the projects I created before
scope_conn.add_user_role(user_id, role_id, tenant_id)

5. The user has been added to the project from the step 4. But if I need to use the same scope connection to do other things, I would get an error "AuthorizationFailure"
For example:
scope_conn.roles.list()
Then I would get "AuthorizationFailure: Authorization Failed: maximum recursion depth exceeded while calling a Python object"

My Question is
Is it a limitation if a user add/remove himself in a project, the token must be refresh?

Revision history for this message
Joseph Heck (heckj) wrote :

William-

For the keystone V2 API, the mechanisms to modify any elements within keystone are all "admin only". Once you have an administrative connection like you do in step "4", you should be able to do any other tasks with the same token *unless* you've just modified the roles for the user to which you authenticated.

This is because when you modify the roles, etc for a user, all relevant tokens for that user and project are then invalidated to prevent inadvertant access. Re-requesting an authorization token will solve this issue - or have a different "admin account" that isn't the one you're changing.

Changed in python-keystoneclient:
status: New → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.