keystone should return 503 service unavailable when service can't get a token via admin user/pass

Bug #942984 reported by Joseph Heck
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Fix Released
Critical
Jesse Andrews

Bug Description

the service should send 503 "service unavailable" when the service can't get a token via admin user/pass to validate with --- and LOG why it is failing!

from : http://etherpad.openstack.org/keystone-admin-config

   the service should send 503 "service unavailable" when the service can't get a token via admin user/pass to validate with --- and LOG why it is failing!

(related to bug #942983)

(depends on bug #942979)

Joseph Heck (heckj)
Changed in keystone:
milestone: essex-rc1 → essex-4
Changed in keystone:
assignee: nobody → anotherjesse (anotherjesse)
Changed in keystone:
milestone: essex-4 → essex-rc1
Revision history for this message
Adam Young (ayoung) wrote :

503 is not the right return Code. 503 is a in internal server error for a valid request. 403 would be appropriate, and in keeping with the design decisions made elsewhere in Keystone.

Revision history for this message
Jesse Andrews (anotherjesse) wrote : Re: [Bug 942984] Re: keystone should return 503 service unavailable when service can't get a token via admin user/pass

The response code is from nova/glance.

Glance/Nova is unavailable if it cannot communicate with keystone...

Using the same error code for invalid token and service unable to check the
token seems bad

Changed in keystone:
status: Confirmed → In Progress
Revision history for this message
Jesse Andrews (anotherjesse) wrote :
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (master)

Reviewed: https://review.openstack.org/4675
Committed: http://github.com/openstack/keystone/commit/33e6c29d0d9a29eea2f50bdc24dcf87329337e66
Submitter: Jenkins
Branch: master

commit 33e6c29d0d9a29eea2f50bdc24dcf87329337e66
Author: Jesse Andrews <email address hidden>
Date: Tue Feb 28 21:05:17 2012 -0800

    improve auth_token middleware

     * remove ability to run auth_token as stand-alone proxy service
     * only validate a token once
     * improved error handling & comments where further improvement needed
     * improved admin_token logic
     * resolved bug 942984 and bug 942985

    Change-Id: I12ae25c9d8047862072b7ebea1a98722eae1f40d

Changed in keystone:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in keystone:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in keystone:
milestone: essex-rc1 → 2012.1
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.