Ask Your Question
0

nova-client: ERROR: Unauthorized (HTTP 401) [closed]

asked 2013-07-30 10:46:15 -0500

krstncasa gravatar image

updated 2014-08-19 12:53:37 -0500

briancline gravatar image

Hi!

Calls to the nova-client (such as nova image-list) fail with 

ERROR: Unauthorized (HTTP 401).

Credentials are loaded to environment variables as described in this tutorial: http://docs.openstack.org/trunk/openstack-compute/install/apt/content/configure-creds.html - I followed these installation instructions so far.

I am confused, because calling glance image-list work just fine.

During the install I created several accounts/identities in keystone (e.g. admin, nova, glance, etc.) in different tenants. These credentials are used in various places (environment variables, config files and these ominous paste-ini files).

My question is: WHICH credentials do I have to use WHERE to fix this error?

edit retag flag offensive reopen merge delete

Closed for the following reason the question is answered, right answer was accepted by koolhead17
close date 2014-06-05 08:53:26.768883

add a comment

4 answers

Sort by ยป oldest newest most voted
0

answered 2014-01-06 03:53:01 -0500

arushi gravatar image

reboot your system. check using getenforce command. It should work.

edit flag offensive delete link more
add a comment
0

answered 2013-08-01 12:14:43 -0500

nishtha gravatar image

Not realy!! I did it from http://docs.openstack.org/grizzly/basic-install/apt/content/basic-install_controller.html#basic-install_controller-keystone. I dropped my database of keystone and ran this script after saving it in some file. It generated the ids of users, tenants and roles automatically. Try it out if possible and I had the sole credentials which I had written in my .bashrc file rather than sourcing them. Those were OS_TENANT_NAME OS_USERNAME OS_PASSWORD OS_AUTH_URL OS_SERVICE_ENDPOINT and OS_SERVICE_TOKEN

edit flag offensive delete link more
add a comment
4

answered 2013-08-01 04:58:05 -0500

krstncasa gravatar image

Solved it: The admin user credentials also need to be put into /etc/nova/api-paste.ini.

In the example installation linked above, this looks like this: 

admin_tenant_name=demo
admin_user=admin
admin_password=secrete

But could someone please explain this to me: a) I have to set these credentials in the environment variables, but they are then overridden by the settings in that ini file? b) What are these mysterious paste-ini files good for anyway. They seem to often cover the same settings as the config files and co-exist with these, override these sometimes.... very confusing.

edit flag offensive delete link more

Comments

1

I'm not 100% positive on this, so hopefully someone can come by to confirm/correct me if I'm wrong, but: I'm fairly sure that in this case, the *.ini files are utilized because when Nova creates a VM, it uses libvirt to authenticate, which requires a *.ini file/syntax. http://libvirt.org/auth.html

nosluoc gravatar imagenosluoc ( 2013-08-01 12:05:44 -0500 )edit

I don't think the setting given by krstncasa is correct, At least, according to the installation manuel, the setting in api-paste.ini should be the credential of nova service so that the nova could communicate with keystone using its own credential.

shedoh gravatar imageshedoh ( 2013-09-02 02:17:40 -0500 )edit

Thanks krstncasa, this actually solved my issue too. My setup was working and was able to boot instances etc. But after few days of idleness it started giving 401 errors for any nova commands, but all other services like glance, keystone etc were working through command line. I had to add this credentials line to api-paste.ini file once, restarted openstack-nova-api service alone and my nova commands started working !!. I removed this newly added lines from api-paste.ini and it still works :), so not sure why I had to add this lines only once to the api-paste.ini file, but it actually made the nova commands work again.

Bejoy C Alias gravatar imageBejoy C Alias ( 2013-09-18 01:51:28 -0500 )edit
add a comment
0

answered 2013-07-30 14:31:00 -0500

nishtha gravatar image

I also received the same error. It was fixed as I had an error in my bash script for keystone regarding nova service. I never created accounts/identities manually but by running a script. And the credentials are the same that you mite have added for setting environment earlier.

edit flag offensive delete link more

Comments

Sound like you are referring to the scripted creation of identities in keystone as described here: http://docs.openstack.org/trunk/openstack-compute/install/apt/content/scripted-keystone-setup.html I did that - but these credentials don't work for me. I am still confused which credentials I actually have to provide? The nova user? The admin user?

krstncasa gravatar imagekrstncasa ( 2013-07-31 04:20:22 -0500 )edit
add a comment

Get to know Ask OpenStack

Resources for moderators

Question Tools

4 followers

subscribe to rss feed

Stats

Asked: 2013-07-30 10:46:15 -0500

Seen: 6,513 times

Last updated: Jan 06 '14

Related questions

VMware & VNC console [closed]

Overcommit disk resource [closed]

Adding an iso to instance launch

What do the nova dns-* commands do?

RetryFilter: What to do with a failed host?

No files in /var/lib/nova/instances

failed to initialize KVM: Operation not permitted

unable to boot instance (Error: novalid host )

debian 9 cannot access metatadata server

Can't start nova-volume