OpenStack Identity (keystone)

add-user-role and remove-user-role only work when SERVICE_TOKEN is specified

Bug #932276 reported by Anthony Young
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Invalid
Undecided
Unassigned

Bug Description

Steps to reproduce:

$ keystone --username admin --password secrete --auth-url http://127.0.0.1:5000/v2.0/ --tenant_name=admin add-user-role 9b4d8115d7544c1faa488a61abeb5c1b ce6f476c5f1d4ea7ac51dada2cd3a127 bfaa0540ed5c4334991ef8241767454d

Expected:

No error.

Actual

Authorization Failed: Unable to communicate with identity service: 403 Forbidden

Access was denied to this resource.

 Invalid tenant . (HTTP 403)

However, the following works as expected:

keystone --token secrete --endpoint http://127.0.0.1:35357/v2.0/ add-user-role 9b4d8115d7544c1faa488a61abeb5c1b ce6f476c5f1d4ea7ac51dada2cd3a127 bfaa0540ed5c4334991ef8241767454d

Revision history for this message
Dolph Mathews (dolph) wrote :

Attempting to reproduce this, I'm getting a different error (500). This may be fixed and I'm just doing something wrong. Anthony, can you still reproduce this?

My attempt: http://pastie.org/3506819

Revision history for this message
Joseph Heck (heckj) wrote :

Tones - is this still valid post the auth_token changes?

Changed in keystone:
status: New → Triaged
status: Triaged → Incomplete
Revision history for this message
Anthony Young (sleepsonthefloor) wrote :

This still fails, but the error is now different:

keystone user-role-add --user 64cdfcb759084728b00483f2a2c010bf --role 4b2568cc7746454c9ea0a74a7527ec7a --tenant_id 444691ea87d44fc29424e71311a222f4
No handlers could be found for logger "keystoneclient.client"
Invalid tenant (HTTP 401)

Changed in keystone:
status: Incomplete → New
Revision history for this message
Anthony Young (sleepsonthefloor) wrote :

This appears to have been caused by named argument conflicts in python-keystoneclient that have been resolved.

Changed in keystone:
status: New → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.