WWW-Authenticate header returning wrong Keystone host

Bug #920798 reported by Jay Pipes
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Invalid
High
Mike Pittaro

Bug Description

jpipes@uberbox:~/repos/tempest$ curl -v http://192.168.1.98:8774/v2/extensions
* About to connect() to 192.168.1.98 port 8774 (#0)
* Trying 192.168.1.98... connected
* Connected to 192.168.1.98 (192.168.1.98) port 8774 (#0)
> GET /v2/extensions HTTP/1.1
> User-Agent: curl/7.21.6 (x86_64-pc-linux-gnu) libcurl/7.21.6 OpenSSL/1.0.0e zlib/1.2.3.4 libidn/1.22 librtmp/2.3
> Host: 192.168.1.98:8774
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< Www-Authenticate: Keystone uri='http://127.0.0.1:5000/'
< Content-Length: 381
< Content-Type: text/html; charset=UTF-8
< Date: Tue, 24 Jan 2012 03:02:52 GMT
<
<html>
 <head>
  <title>401 Unauthorized</title>
 </head>
 <body>
  <h1>401 Unauthorized</h1>
  This server could not verify that you are authorized to access the document you requested. Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.<br /><br />
Authentication required

 </body>
* Connection #0 to host 192.168.1.98 left intact
* Closing connection #0

Note that the WWW-Authenticate header shows the wrong host IP address... it should be 192.168.1.98, but it is 127.0.01

Tags: keystone
Revision history for this message
Brian Waldon (bcwaldon) wrote :

I'm assuming it is just returning whatever you have configured as your keystone host in paste. And even if that is true, I agree that we should respond with an address the client could actually use

Changed in nova:
status: New → Confirmed
importance: Undecided → High
Mike Pittaro (mikeyp-3)
Changed in nova:
assignee: nobody → Mike Pittaro (mikeyp-3)
Mike Pittaro (mikeyp-3)
Changed in nova:
status: Confirmed → In Progress
Revision history for this message
Mike Pittaro (mikeyp-3) wrote :

The WWW-Authenticate header returned to the client is taken directly
from the auth_uri in the nova-api-paste configuration. If auth_uri
in not specified, then the uri is assembled from the auth_host,
auth_port, and auth_protocol.

The auth_uri must to be configured to a publicly accessible URI
to return the correct result to the client.

Closing this as a configuration problem

Changed in nova:
status: In Progress → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.