# nova-client: ERROR: Unauthorized (HTTP 401) [closed]

Hi!

Calls to the nova-client (such as nova image-list) fail with

ERROR: Unauthorized (HTTP 401).


Credentials are loaded to environment variables as described in this tutorial: http://docs.openstack.org/trunk/openstack-compute/install/apt/content/configure-creds.html - I followed these installation instructions so far.

I am confused, because calling glance image-list work just fine.

During the install I created several accounts/identities in keystone (e.g. admin, nova, glance, etc.) in different tenants. These credentials are used in various places (environment variables, config files and these ominous paste-ini files).

My question is: WHICH credentials do I have to use WHERE to fix this error?

edit retag reopen merge delete

### Closed for the following reason the question is answered, right answer was accepted by koolhead17 close date 2014-06-05 08:53:26.768883

Sort by » oldest newest most voted

Solved it: The admin user credentials also need to be put into /etc/nova/api-paste.ini.

In the example installation linked above, this looks like this:

admin_tenant_name=demo


But could someone please explain this to me: a) I have to set these credentials in the environment variables, but they are then overridden by the settings in that ini file? b) What are these mysterious paste-ini files good for anyway. They seem to often cover the same settings as the config files and co-exist with these, override these sometimes.... very confusing.

more

1

I'm not 100% positive on this, so hopefully someone can come by to confirm/correct me if I'm wrong, but: I'm fairly sure that in this case, the *.ini files are utilized because when Nova creates a VM, it uses libvirt to authenticate, which requires a *.ini file/syntax. http://libvirt.org/auth.html

( 2013-08-01 12:05:44 -0500 )edit

I don't think the setting given by krstncasa is correct, At least, according to the installation manuel, the setting in api-paste.ini should be the credential of nova service so that the nova could communicate with keystone using its own credential.

( 2013-09-02 02:17:40 -0500 )edit

Thanks krstncasa, this actually solved my issue too. My setup was working and was able to boot instances etc. But after few days of idleness it started giving 401 errors for any nova commands, but all other services like glance, keystone etc were working through command line. I had to add this credentials line to api-paste.ini file once, restarted openstack-nova-api service alone and my nova commands started working !!. I removed this newly added lines from api-paste.ini and it still works :), so not sure why I had to add this lines only once to the api-paste.ini file, but it actually made the nova commands work again.

( 2013-09-18 01:51:28 -0500 )edit

reboot your system. check using getenforce command. It should work.

more

I also received the same error. It was fixed as I had an error in my bash script for keystone regarding nova service. I never created accounts/identities manually but by running a script. And the credentials are the same that you mite have added for setting environment earlier.

more

Sound like you are referring to the scripted creation of identities in keystone as described here: http://docs.openstack.org/trunk/openstack-compute/install/apt/content/scripted-keystone-setup.html I did that - but these credentials don't work for me. I am still confused which credentials I actually have to provide? The nova user? The admin user?

( 2013-07-31 04:20:22 -0500 )edit

Not realy!! I did it from http://docs.openstack.org/grizzly/basic-install/apt/content/basic-install_controller.html#basic-install_controller-keystone. I dropped my database of keystone and ran this script after saving it in some file. It generated the ids of users, tenants and roles automatically. Try it out if possible and I had the sole credentials which I had written in my .bashrc file rather than sourcing them. Those were OS_TENANT_NAME OS_USERNAME OS_PASSWORD OS_AUTH_URL OS_SERVICE_ENDPOINT and OS_SERVICE_TOKEN

more

# Get to know Ask OpenStack

Resources for moderators

## Stats

Asked: 2013-07-30 10:46:15 -0500

Seen: 6,519 times

Last updated: Jan 06 '14