Hi,

I tried to solve this bug one week ago. Disabling keystoneauth in pipeline helped me, but without authentication with keystone I was able to get any file from any tenant. So I tried deploy DevStack with Swift and then I compare proxy-server.conf files.

There was some differences in pipeline and in order of filters. I set the proxy-server.conf file same way as in DevStack and it works.

root@prx03:~# vim /etc/swift/proxy-server.conf

[DEFAULT]
bind_ip = 0.0.0.0
bind_port = 8080
swift_dir = /etc/swift
user = swift

log_level = DEBUG

[pipeline:main]
pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit crossdomain authtoken keystoneauth tempauth  formpost staticweb container-quotas account-quotas slo dlo proxy-logging  proxy-server

[app:proxy-server]
account_autocreate = true
conn_timeout = 20
node_timeout = 120
use = egg:swift#proxy

[filter:tempauth]
user_swifttenanttest1_swiftusertest3 = testing3 .admin
user_swifttenanttest2_swiftusertest2 = testing2 .admin
user_swifttenanttest1_swiftusertest1 = testing .admin
use = egg:swift#tempauth

user_admin_admin = admin .admin .reseller_admin
user_test_tester = testing .admin
user_test2_tester2 = testing2 .admin
user_test_tester3 = testing3
user_test5_tester5 = testing5 service

[filter:healthcheck]
use = egg:swift#healthcheck

[filter:cache]
use = egg:swift#memcache

[filter:ratelimit]
use = egg:swift#ratelimit

[filter:domain_remap]
use = egg:swift#domain_remap

[filter:catch_errors]
use = egg:swift#catch_errors

[filter:cname_lookup]
use = egg:swift#cname_lookup

[filter:staticweb]
use = egg:swift#staticweb

[filter:tempurl]
use = egg:swift#tempurl

[filter:formpost]
use = egg:swift#formpost

[filter:name_check]
use = egg:swift#name_check

[filter:list-endpoints]
use = egg:swift#list_endpoints

[filter:proxy-logging]
reveal_sensitive_prefix = 12
use = egg:swift#proxy_logging

[filter:bulk]
use = egg:swift#bulk

[filter:slo]
use = egg:swift#slo

[filter:dlo]
use = egg:swift#dlo

[filter:container-quotas]
use = egg:swift#container_quotas

[filter:account-quotas]
use = egg:swift#account_quotas

[filter:gatekeeper]
use = egg:swift#gatekeeper

[filter:container_sync]
use = egg:swift#container_sync

[filter:xprofile]
use = egg:swift#xprofile

[filter:versioned_writes]
use = egg:swift#versioned_writes

[filter:crossdomain]
use = egg:swift#crossdomain

[filter:authtoken]
include_service_catalog = False
cache = swift.cache
delay_auth_decision = 1
signing_dir = /var/cache/swift
auth_uri = http://IPADDRESS:5000
project_domain_id = default
project_name = service
user_domain_id = default
password = password
username = swift
auth_url = http://IPADDRESS:35357
auth_plugin = password
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
log_name = swift

[filter:keystoneauth]
operator_roles = Member, admin
use = egg:swift#keystoneauth

After that I restarted proxy server.

root@prx03:~# swift-init proxy-server restart

And check if swift works.

root@ctl01:~# source keystonercv3

root@ctl01:~# swift -V 3 stat
        Account: AUTH_cd3b21ac433c4ff6aff8e1ae144a196f
     Containers: 0
        Objects: 0
          Bytes: 0
   Content-Type: text/plain; charset=utf-8
    X-Timestamp: 1448580904.35436
     X-Trans-Id: txdd3e6db8455f447f871ff-0056579728
X-Put-Timestamp: 1448580904.35436

root@ctl01:~# swift -V 3 upload test /root/keystonerc
/root/keystonerc

root@ctl01:~# swift -V 3 list
demo
test

root@ctl01:~# swift -V 3 download test
root/keystonerc [auth 0.110s, headers 0.157s, total 0.172s, 0.002 MB/s]