Ask Your Question
1

nova service-list fails with ERROR (Unauthorized): Unauthorized (HTTP 401)

asked 2015-04-29 23:18:52 -0500

adendukuri gravatar image

updated 2015-04-30 02:12:30 -0500

Followed the document and carried out steps as recommened and suggested in the document after nova configured when issues nova service-list the command errors out with

ERROR (Unauthorized): Unauthorized (HTTP 401) (Request-ID: req-8cf03742-a017-43ee-92e8-ba93b2261383)

Checked /var/log/nova/noav-api.log

and here is what I found,,,,

2015-04-29 22:55:38.426 29038 WARNING keystonemiddleware.auth_token [-] Unexpected response from keystone service: {u'error': {u'message': u'Expecting to find username or userId in passwordCredentials - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.', u'code': 400, u'title': u'Bad Request'}}
2015-04-29 22:55:38.428 29038 WARNING keystonemiddleware.auth_token [-] Authorization failed for token
2015-04-29 22:55:38.439 29038 INFO nova.osapi_compute.wsgi.server [-] 10.0.0.11 "GET /v2/31ee9aa236eb447c9f733cb78f97868d/os-services HTTP/1.1" status: 401 len: 271 time: 0.1061730
2015-04-29 22:55:38.714 29038 WARNING keystonemiddleware.auth_token [-] Unexpected response from keystone service: {u'error': {u'message': u'Expecting to find username or userId in passwordCredentials - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.', u'code': 400, u'title': u'Bad Request'}}
2015-04-29 22:55:38.716 29038 WARNING keystonemiddleware.auth_token [-] Authorization failed for token
2015-04-29 22:55:38.728 29038 INFO nova.osapi_compute.wsgi.server [-] 10.0.0.11 "GET /v2/31ee9aa236eb447c9f733cb78f97868d/os-services HTTP/1.1" status: 401 len: 271 time: 0.0298891

Question, did I hit bug?

If so what is my next step?

Arun

edit retag flag offensive close merge delete

Comments

did you source the credentials?

Syed Awais Ali gravatar imageSyed Awais Ali ( 2015-04-30 02:13:23 -0500 )edit

5 answers

Sort by ยป oldest newest most voted
3

answered 2015-05-07 10:42:30 -0500

ghebda gravatar image

updated 2015-05-11 10:09:27 -0500

[UPDATE] I have solved the problem I was having (see details below). For me, the new settings that I followed in [keystone_authtoken] in both nova.conf and glance-api.conf from the Kilo installation guide were the problem. I checked out the Kilo configuration guide, and I'm not even seeing project_domain_id, user_domain_id, project_name, username, and password as valid entries. I had to make a few changes:

  1. The auth_uri should be the full URL, including version number
  2. user admin_tenant_name, admin_user, and admin_password.

So my new [keystone_authtoken] section looks like this:

[keystone_authtoken]
auth_uri = http://kilocontroller:5000/v2.0
identity_uri = http://kilocontroller:35357
admin_tenant_name = service
admin_user = nova
admin_password = XXXXXXXXXXXX

I made the same changes in my glance-api.conf file and now I can do an image-list and image create, so I'm happy.

adendukuri, can you see if this is the source of your error messages as well?

[ORIGINAL POST BELOW:]

I'm working on a Kilo installation, and it looks like I'm having the same trouble with the nova and glance APIs.

I followed the Kilo installation guide for the config files and set up the keystone_authtoken section as follows:

[keystone_authtoken]
auth_uri = http://kilocontroller:5000
identity_uri = http://kilocontroller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = nova
password = XXXXXXXXXXX

And before I run these commands, I source the admin credentials. That also uses the suggested environment variables from the Kilo installation guide:

[root@kilocontroller ~]# cat admin-openrc.sh 
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=admin
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=XXXXXXXXXXXXXXX
export OS_AUTH_URL=http://kilocontroller:35357/v3
export OS_IMAGE_API_VERSION=2

I get the same error in my logs:

[root@kilocontroller ~]# tail -4 /var/log/nova/nova-api.log
2015-05-07 09:04:06.276 3302 ERROR keystonemiddleware.auth_token [-] Bad response code while validating token: 400
2015-05-07 09:04:06.277 3302 WARNING keystonemiddleware.auth_token [-] Identity response: {"error": {"message": "Expecting to find username or userId in passwordCredentials - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.", "code": 400, "title": "Bad Request"}}
2015-05-07 09:04:06.277 3302 WARNING keystonemiddleware.auth_token [-] Authorization failed for token
2015-05-07 09:04:06.278 3302 INFO nova.osapi_compute.wsgi.server [-] 192.168.10.110 "GET /v2/3a5e3f78fcbf43c9b36930a8943bc735/os-services HTTP/1.1" status: 401 len: 284 time: 0.0119960

I also ran the above curl command, and it looks like it is successful:

[root@kilocontroller ~]# curl -s -X POST http://kilocontroller:5000/v2.0/tokens \
-H "Content-Type: application/json" \
 -d '{"auth": {"tenantName": "'"$OS_TENANT_NAME"'", "passwordCredentials":
 {"username": "'"$OS_USERNAME"'", "password": "'"$OS_PASSWORD"'"}}}'
 {"access": {"token": {"issued_at": "2015-05-07T14:39:04.401974", "expires": "2015-05-07T15:39:04Z", "id": "e5807245d39c46ed84ac2bfe5b72ea8e", "tenant": {"description": "Admin Project", "enabled": true, "id": "3a5e3f78fcbf43c9b36930a8943bc735", "name": "admin"}, "audit_ids": ["MCDVi8YATQOrDDf2xFX7Pg"]}, "serviceCatalog": [{"endpoints": [{"adminURL": "http://kilocontroller:9292", "region": "RegionOne", "internalURL": "http://kilocontroller:9292", "id": "7c23f97f2bdc45268f898f98d1f5609e", "publicURL": "http://kilocontroller:9292"}], "endpoints_links": [], "type": "image", "name": "glance"}, {"endpoints": [{"adminURL": "http://kilocontroller:8774/v2/3a5e3f78fcbf43c9b36930a8943bc735", "region": "RegionOne", "internalURL": "http://kilocontroller:8774/v2/3a5e3f78fcbf43c9b36930a8943bc735", "id": "2258953915fb4a4ca352f0914ad29136", "publicURL": "http://kilocontroller:8774/v2/3a5e3f78fcbf43c9b36930a8943bc735 ...
(more)
edit flag offensive delete link more

Comments

this fix worked for me, I followed Kilo install guide but keystone_authtoken section settings didnt work for me. Thanks

bickyii gravatar imagebickyii ( 2015-09-29 12:09:17 -0500 )edit

Thanks, solution worked perfectly for me. If you are following from openstack documentation, it is where the keystone_authentication parameters are mentioned wrongly. Following the change above in glance and nova conf files in all nodes worked charm.

sidhant13 gravatar imagesidhant13 ( 2015-11-10 11:00:01 -0500 )edit
1

answered 2015-05-01 03:22:35 -0500

uts9 gravatar image

updated 2015-05-01 03:23:17 -0500

Just to verify, please run

 curl -s -X POST http://<keystone_server_ip>:5000/v2.0/tokens \
            -H "Content-Type: application/json" \
            -d '{"auth": {"tenantName": "'"$OS_TENANT_NAME"'", "passwordCredentials":
            {"username": "'"$OS_USERNAME"'", "password": "'"$OS_PASSWORD"'"}}}' \
edit flag offensive delete link more

Comments

Fails with {"error": {"message": "Expecting to find passwordCredentials in auth - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.", "code": 400, "title": "Bad Request"}}

adendukuri gravatar imageadendukuri ( 2015-05-01 07:33:38 -0500 )edit

comand which I executed curl -s -X POST http://10.0.0.11:5000/v2.0/tokens \

        -H "Content-Type: application/json" \
        -d '{"auth": {"service": "'"$OS_TENANT_NAME"'", "Password":
        {"admin": "'"$OS_USERNAME"'", "Password": "'"$OS_PASSWORD"'"}}}'
adendukuri gravatar imageadendukuri ( 2015-05-01 07:34:11 -0500 )edit
0

answered 2017-02-07 03:33:49 -0500

just pay attention to the password item, do not reserve other blanks behind the real password ,which works fine for me!

edit flag offensive delete link more
0

answered 2015-05-01 00:23:12 -0500

adendukuri gravatar image

Yes I sourced the credentials which are in admin-openrc.sh file and recommended and still I get that error.

edit flag offensive delete link more

Comments

Hi. I solved why my install was giving me that 401 error and updated my post above. It was a discrepancy between what's in the Kilo installation guide and actual valid lines in the INI files. If you haven't solved it yet, maybe try that.

ghebda gravatar imageghebda ( 2015-05-12 08:15:23 -0500 )edit

That worked for me too.

niels gravatar imageniels ( 2015-06-01 13:47:17 -0500 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower

Stats

Asked: 2015-04-29 23:18:52 -0500

Seen: 14,205 times

Last updated: Feb 07 '17