Disco verification: apt policy liblasso3 liblasso3: Installed: 2.6.0-2ubuntu0.1 Candidate: 2.6.0-2ubuntu0.1 Version table: *** 2.6.0-2ubuntu0.1 1000 399 http://archive.ubuntu.com/ubuntu disco-proposed/main amd64 Packages 100 /var/lib/dpkg/status 2.6.0-2build1 400 400 http://archive.ubuntu.com/ubuntu disco/main amd64 Packages env | grep OS_ OS_IDENTITY_PROVIDER_URL=https://samltest.id/idp/profile/SAML2/SOAP/ECP OS_AUTH_URL=https://keystone.maas:5000/v3 OS_PROTOCOL=saml2 OS_REGION_NAME=RegionOne OS_PROJECT_NAME=scooper@samltest.id_project OS_PROJECT_DOMAIN_NAME=samltestid OS_IDENTITY_API_VERSION=3 OS_AUTH_TYPE=v3samlpassword OS_IDENTITY_PROVIDER=samltestid OS_INTERFACE=internal OS_PASSWORD=bazinga OS_USERNAME= OS_CACERT=/home/ubuntu/bundles/vault-ca.crt openstack token issue -v --debug START with options: token issue -v --debug options: Namespace(access_key='', access_secret='***', access_token='***', access_token_endpoint='', access_token_type='', application_credential_id='', application_credential_name='', application_credential_secret='***', auth_type='v3samlpassword', auth_url='https://keystone.maas:5000/v3', cacert='/home/ubuntu/bundles/vault-ca.crt', cert='', client_id='', client_secret='***', cloud='', code='', consumer_key='', consumer_secret='***', debug=True, default_domain='default', default_domain_id='', default_domain_name='', deferred_help=False, discovery_endpoint='', domain_id='', domain_name='', endpoint='', identity_provider='samltestid', identity_provider_url='https://samltest.id/idp/profile/SAML2/SOAP/ECP', insecure=None, interface='internal', key='', log_file=None, openid_scope='', os_beta_command=False, os_compute_api_version='', os_identity_api_version='3', os_image_api_version='', os_key_manager_api_version='1', os_network_api_version='', os_object_api_version='', os_orchestration_api_version='1', os_project_id=None, os_project_name=None, os_volume_api_version='', passcode='', password='***', project_domain_id='', project_domain_name='samltestid', project_id='', project_name='scooper@samltest.id_project', protocol='saml2', redirect_uri='', region_name='RegionOne', remote_project_domain_id='', remote_project_domain_name='', remote_project_id='', remote_project_name='', service_provider='', service_provider_endpoint='', service_provider_entity_id='', system_scope='', timing=False, token='***', trust_id='', url='', user_domain_id='', user_domain_name='', user_id='', username='sheldon', verbose_level=3, verify=None) Auth plugin v3samlpassword selected auth_config_hook(): {'api_timeout': None, 'verify': True, 'cacert': '/home/ubuntu/bundles/vault-ca.crt', 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'internal', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'project_domain_name': 'samltestid', 'project_name': 'scooper@samltest.id_project'}, 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'region_name': 'RegionOne', 'default_domain': 'default', 'timing': False, 'auth_url': 'https://keystone.maas:5000/v3', 'username': 'sheldon', 'password': '***', 'identity_provider': 'samltestid', 'protocol': 'saml2', 'identity_provider_url': 'https://samltest.id/idp/profile/SAML2/SOAP/ECP', 'beta_command': False, 'identity_api_version': '3', 'orchestration_api_version': '1', 'key_manager_api_version': '1', 'auth_type': 'v3samlpassword', 'networks': []} defaults: {'api_timeout': None, 'verify': True, 'cacert': None, 'cert': None, 'key': None, 'auth_type': 'password', 'baremetal_status_code_retries': 5, 'image_status_code_retries': 5, 'disable_vendor_agent': {}, 'interface': 'public', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active'} cloud cfg: {'api_timeout': None, 'verify': True, 'cacert': '/home/ubuntu/bundles/vault-ca.crt', 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'internal', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'project_domain_name': 'samltestid', 'project_name': 'scooper@samltest.id_project'}, 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'region_name': 'RegionOne', 'default_domain': 'default', 'timing': False, 'auth_url': 'https://keystone.maas:5000/v3', 'username': 'sheldon', 'password': '***', 'identity_provider': 'samltestid', 'protocol': 'saml2', 'identity_provider_url': 'https://samltest.id/idp/profile/SAML2/SOAP/ECP', 'beta_command': False, 'identity_api_version': '3', 'orchestration_api_version': '1', 'key_manager_api_version': '1', 'auth_type': 'v3samlpassword', 'networks': []} compute API version 2.1, cmd group openstack.compute.v2 identity API version 3, cmd group openstack.identity.v3 image API version 2, cmd group openstack.image.v2 network API version 2, cmd group openstack.network.v2 object_store API version 1, cmd group openstack.object_store.v1 volume API version 2, cmd group openstack.volume.v2 neutronclient API version 2, cmd group openstack.neutronclient.v2 orchestration API version 1, cmd group openstack.orchestration.v1 key_manager API version 1, cmd group openstack.key_manager.v1 Auth plugin v3samlpassword selected auth_config_hook(): {'api_timeout': None, 'verify': True, 'cacert': '/home/ubuntu/bundles/vault-ca.crt', 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'internal', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'project_domain_name': 'samltestid', 'project_name': 'scooper@samltest.id_project'}, 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'region_name': 'RegionOne', 'default_domain': 'default', 'timing': False, 'auth_url': 'https://keystone.maas:5000/v3', 'username': 'sheldon', 'password': '***', 'identity_provider': 'samltestid', 'protocol': 'saml2', 'identity_provider_url': 'https://samltest.id/idp/profile/SAML2/SOAP/ECP', 'beta_command': False, 'identity_api_version': '3', 'orchestration_api_version': '1', 'key_manager_api_version': '1', 'auth_type': 'v3samlpassword', 'networks': []} Auth plugin v3samlpassword selected auth_config_hook(): {'api_timeout': None, 'verify': True, 'cacert': '/home/ubuntu/bundles/vault-ca.crt', 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'internal', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'project_domain_name': 'samltestid', 'project_name': 'scooper@samltest.id_project'}, 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'region_name': 'RegionOne', 'default_domain': 'default', 'timing': False, 'auth_url': 'https://keystone.maas:5000/v3', 'username': 'sheldon', 'password': '***', 'identity_provider': 'samltestid', 'protocol': 'saml2', 'identity_provider_url': 'https://samltest.id/idp/profile/SAML2/SOAP/ECP', 'beta_command': False, 'identity_api_version': '3', 'orchestration_api_version': '1', 'key_manager_api_version': '1', 'auth_type': 'v3samlpassword', 'networks': []} command: token issue -> openstackclient.identity.v3.token.IssueToken (auth=True) Auth plugin v3samlpassword selected auth_config_hook(): {'api_timeout': None, 'verify': True, 'cacert': '/home/ubuntu/bundles/vault-ca.crt', 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'internal', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'project_domain_name': 'samltestid', 'project_name': 'scooper@samltest.id_project'}, 'additional_user_agent': [('osc-lib', '1.12.1')], 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'region_name': 'RegionOne', 'default_domain': 'default', 'timing': False, 'auth_url': 'https://keystone.maas:5000/v3', 'username': 'sheldon', 'password': '***', 'identity_provider': 'samltestid', 'protocol': 'saml2', 'identity_provider_url': 'https://samltest.id/idp/profile/SAML2/SOAP/ECP', 'beta_command': False, 'identity_api_version': '3', 'orchestration_api_version': '1', 'key_manager_api_version': '1', 'auth_type': 'v3samlpassword', 'networks': []} Using auth plugin: v3samlpassword Using parameters {'auth_url': 'https://keystone.maas:5000/v3', 'project_name': 'scooper@samltest.id_project', 'project_domain_name': 'samltestid', 'identity_provider': 'samltestid', 'protocol': 'saml2', 'identity_provider_url': 'https://samltest.id/idp/profile/SAML2/SOAP/ECP', 'username': 'sheldon', 'password': '***'} Get auth_ref REQ: curl -g -i --cacert "/home/ubuntu/bundles/vault-ca.crt" -X GET https://keystone.maas:5000/v3/OS-FEDERATION/identity_providers/samltestid/protocols/saml2/auth -H "User-Agent: openstacksdk/0.26.0 keystoneauth1/3.13.1 python-requests/2.18.4 CPython/3.6.8" Starting new HTTPS connection (1): keystone.maas https://keystone.maas:5000 "GET /v3/OS-FEDERATION/identity_providers/samltestid/protocols/saml2/auth HTTP/1.1" 200 3144 Starting new HTTPS connection (1): samltest.id https://samltest.id:443 "POST /idp/profile/SAML2/SOAP/ECP HTTP/1.1" 200 None https://keystone.maas:5000 "POST /v3/OS-FEDERATION/identity_providers/samltestid/protocols/saml2/auth/mellon/paosResponse HTTP/1.1" 303 382 Starting new HTTPS connection (2): keystone.maas https://keystone.maas:5000 "GET /v3/OS-FEDERATION/identity_providers/samltestid/protocols/saml2/auth HTTP/1.1" 201 403 RESP: [201] Cache-Control: private, max-age=0, must-revalidate, private, max-age=0, must-revalidate Connection: Keep-Alive Content-Length: 403 Content-Type: application/json Date: Fri, 19 Jul 2019 06:07:00 GMT Keep-Alive: timeout=5, max=100 Server: Apache/2.4.29 (Ubuntu) Vary: X-Auth-Token X-Distribution: Ubuntu X-Subject-Token: {SHA256}53213975819219cea5f7ec8e6cd9a4633d9089cef363fefabcb69e12df7b5842 x-openstack-request-id: req-79f04296-5ab4-4253-8fcb-8e4f9824aafe RESP BODY: {"token": {"methods": ["saml2"], "user": {"domain": {"id": "Federated", "name": "Federated"}, "id": "59f289a633f347c8998108cbfda2d91f", "name": "