Ask Your Question
1

nova service-list fails with ERROR (Unauthorized): Unauthorized (HTTP 401)

asked 2015-04-29 23:18:52 -0500

adendukuri gravatar image

updated 2015-04-30 02:12:30 -0500

Followed the document and carried out steps as recommened and suggested in the document after nova configured when issues nova service-list the command errors out with

ERROR (Unauthorized): Unauthorized (HTTP 401) (Request-ID: req-8cf03742-a017-43ee-92e8-ba93b2261383)

Checked /var/log/nova/noav-api.log

and here is what I found,,,,

2015-04-29 22:55:38.426 29038 WARNING keystonemiddleware.auth_token [-] Unexpected response from keystone service: {u'error': {u'message': u'Expecting to find username or userId in passwordCredentials - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.', u'code': 400, u'title': u'Bad Request'}}
2015-04-29 22:55:38.428 29038 WARNING keystonemiddleware.auth_token [-] Authorization failed for token
2015-04-29 22:55:38.439 29038 INFO nova.osapi_compute.wsgi.server [-] 10.0.0.11 "GET /v2/31ee9aa236eb447c9f733cb78f97868d/os-services HTTP/1.1" status: 401 len: 271 time: 0.1061730
2015-04-29 22:55:38.714 29038 WARNING keystonemiddleware.auth_token [-] Unexpected response from keystone service: {u'error': {u'message': u'Expecting to find username or userId in passwordCredentials - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.', u'code': 400, u'title': u'Bad Request'}}
2015-04-29 22:55:38.716 29038 WARNING keystonemiddleware.auth_token [-] Authorization failed for token
2015-04-29 22:55:38.728 29038 INFO nova.osapi_compute.wsgi.server [-] 10.0.0.11 "GET /v2/31ee9aa236eb447c9f733cb78f97868d/os-services HTTP/1.1" status: 401 len: 271 time: 0.0298891

Question, did I hit bug?

If so what is my next step?

Arun

edit retag flag offensive close merge delete

Comments

did you source the credentials?

Syed Awais Ali gravatar imageSyed Awais Ali ( 2015-04-30 02:13:23 -0500 )edit

5 answers

Sort by ยป oldest newest most voted
0

answered 2015-05-01 00:23:12 -0500

adendukuri gravatar image

Yes I sourced the credentials which are in admin-openrc.sh file and recommended and still I get that error.

edit flag offensive delete link more

Comments

Hi. I solved why my install was giving me that 401 error and updated my post above. It was a discrepancy between what's in the Kilo installation guide and actual valid lines in the INI files. If you haven't solved it yet, maybe try that.

ghebda gravatar imageghebda ( 2015-05-12 08:15:23 -0500 )edit

That worked for me too.

niels gravatar imageniels ( 2015-06-01 13:47:17 -0500 )edit
1

answered 2015-05-01 03:22:35 -0500

uts9 gravatar image

updated 2015-05-01 03:23:17 -0500

Just to verify, please run

 curl -s -X POST http://<keystone_server_ip>:5000/v2.0/tokens \
            -H "Content-Type: application/json" \
            -d '{"auth": {"tenantName": "'"$OS_TENANT_NAME"'", "passwordCredentials":
            {"username": "'"$OS_USERNAME"'", "password": "'"$OS_PASSWORD"'"}}}' \
edit flag offensive delete link more

Comments

Fails with {"error": {"message": "Expecting to find passwordCredentials in auth - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.", "code": 400, "title": "Bad Request"}}

adendukuri gravatar imageadendukuri ( 2015-05-01 07:33:38 -0500 )edit

comand which I executed curl -s -X POST http://10.0.0.11:5000/v2.0/tokens \

        -H "Content-Type: application/json" \
        -d '{"auth": {"service": "'"$OS_TENANT_NAME"'", "Password":
        {"admin": "'"$OS_USERNAME"'", "Password": "'"$OS_PASSWORD"'"}}}'
adendukuri gravatar imageadendukuri ( 2015-05-01 07:34:11 -0500 )edit
3

answered 2015-05-07 10:42:30 -0500

ghebda gravatar image

updated 2015-05-11 10:09:27 -0500

[UPDATE] I have solved the problem I was having (see details below). For me, the new settings that I followed in [keystone_authtoken] in both nova.conf and glance-api.conf from the Kilo installation guide were the problem. I checked out the Kilo configuration guide, and I'm not even seeing project_domain_id, user_domain_id, project_name, username, and password as valid entries. I had to make a few changes:

  1. The auth_uri should be the full URL, including version number
  2. user admin_tenant_name, admin_user, and admin_password.

So my new [keystone_authtoken] section looks like this:

[keystone_authtoken]
auth_uri = http://kilocontroller:5000/v2.0
identity_uri = http://kilocontroller:35357
admin_tenant_name = service
admin_user = nova
admin_password = XXXXXXXXXXXX

I made the same changes in my glance-api.conf file and now I can do an image-list and image create, so I'm happy.

adendukuri, can you see if this is the source of your error messages as well?

[ORIGINAL POST BELOW:]

I'm working on a Kilo installation, and it looks like I'm having the same trouble with the nova and glance APIs.

I followed the Kilo installation guide for the config files and set up the keystone_authtoken section as follows:

[keystone_authtoken]
auth_uri = http://kilocontroller:5000
identity_uri = http://kilocontroller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = nova
password = XXXXXXXXXXX

And before I run these commands, I source the admin credentials. That also uses the suggested environment variables from the Kilo installation guide:

[root@kilocontroller ~]# cat admin-openrc.sh 
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=admin
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=XXXXXXXXXXXXXXX
export OS_AUTH_URL=http://kilocontroller:35357/v3
export OS_IMAGE_API_VERSION=2

I get the same error in my logs:

[root@kilocontroller ~]# tail -4 /var/log/nova/nova-api.log
2015-05-07 09:04:06.276 3302 ERROR keystonemiddleware.auth_token [-] Bad response code while validating token: 400
2015-05-07 09:04:06.277 3302 WARNING keystonemiddleware.auth_token [-] Identity response: {"error": {"message": "Expecting to find username or userId in passwordCredentials - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.", "code": 400, "title": "Bad Request"}}
2015-05-07 09:04:06.277 3302 WARNING keystonemiddleware.auth_token [-] Authorization failed for token
2015-05-07 09:04:06.278 3302 INFO nova.osapi_compute.wsgi.server [-] 192.168.10.110 "GET /v2/3a5e3f78fcbf43c9b36930a8943bc735/os-services HTTP/1.1" status: 401 len: 284 time: 0.0119960

I also ran the above curl command, and it looks like it is successful:

[root@kilocontroller ~]# curl -s -X POST http://kilocontroller:5000/v2.0/tokens \
-H "Content-Type: application/json" \
 -d '{"auth": {"tenantName": "'"$OS_TENANT_NAME"'", "passwordCredentials":
 {"username": "'"$OS_USERNAME"'", "password": "'"$OS_PASSWORD"'"}}}'
 {"access": {"token": {"issued_at": "2015-05-07T14:39:04.401974", "expires": "2015-05-07T15:39:04Z", "id": "e5807245d39c46ed84ac2bfe5b72ea8e", "tenant": {"description": "Admin Project", "enabled": true, "id": "3a5e3f78fcbf43c9b36930a8943bc735", "name": "admin"}, "audit_ids": ["MCDVi8YATQOrDDf2xFX7Pg"]}, "serviceCatalog": [{"endpoints": [{"adminURL": "http://kilocontroller:9292", "region": "RegionOne", "internalURL": "http://kilocontroller:9292", "id": "7c23f97f2bdc45268f898f98d1f5609e", "publicURL": "http://kilocontroller:9292"}], "endpoints_links": [], "type": "image", "name": "glance"}, {"endpoints": [{"adminURL": "http://kilocontroller:8774/v2/3a5e3f78fcbf43c9b36930a8943bc735", "region": "RegionOne", "internalURL": "http://kilocontroller:8774/v2/3a5e3f78fcbf43c9b36930a8943bc735", "id": "2258953915fb4a4ca352f0914ad29136", "publicURL": "http://kilocontroller:8774/v2/3a5e3f78fcbf43c9b36930a8943bc735 ...
(more)
edit flag offensive delete link more

Comments

this fix worked for me, I followed Kilo install guide but keystone_authtoken section settings didnt work for me. Thanks

bickyii gravatar imagebickyii ( 2015-09-29 12:09:17 -0500 )edit

Thanks, solution worked perfectly for me. If you are following from openstack documentation, it is where the keystone_authentication parameters are mentioned wrongly. Following the change above in glance and nova conf files in all nodes worked charm.

sidhant13 gravatar imagesidhant13 ( 2015-11-10 11:00:01 -0500 )edit
0

answered 2017-02-07 03:33:49 -0500

just pay attention to the password item, do not reserve other blanks behind the real password ,which works fine for me!

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower

Stats

Asked: 2015-04-29 23:18:52 -0500

Seen: 14,138 times

Last updated: Feb 07 '17