1

I'm trying to access Swift with curl using Keystone-based authentication (following the Keystone API docs here).

Chapter 1: Fetching the token:

curl -d '{"auth": {"passwordCredentials": {
                     "username": "USERNAME", "password": "PASSWORD"}}}' \
     -H "Content-Type: application/json" \
     http://identity:35357/v2.0/tokens

Response:

{
  "access": {
    "token": {
      "expires": "2014-02-27T11:35:11Z", 
      "id": "TOKENID"
    }, 
    "serviceCatalog": [], 
    "user": {
      "username": "USERNAME", 
      "roles_links": [], 
      "id": "USERID", 
      "roles": [], 
      "name": "NAME"
    }
   }
}

Note that, contrary to what's said in the API docs, the tenant info is missing from the response.


Chapter 2: Authentication

curl -H "X-Auth-Token: TOKENID" http://swift/v1/AUTH_TENANTID/bucket

Response: 401 Unauthorized


Chapter 3: Troubleshooting

After looking inside the Keystone auth_token middleware, I found that it fails when trying to fetch the tenant from the token data:

def get_tenant_info():
    """Returns a (tenant_id, tenant_name) tuple from context."""
    def essex():
        """Essex puts the tenant ID and name on the token."""
        return (token['tenant']['id'], token['tenant']['name'])

    def pre_diablo():
        """Pre-diablo, Keystone only provided tenantId."""
         return (token['tenantId'], token['tenantId'])

    def default_tenant():
        """Pre-grizzly, assume the user's default tenant."""
        return (user['tenantId'], user['tenantName'])

    for method in [essex, pre_diablo, default_tenant]:
        try:
            return method()
        except KeyError:
             pass

    raise InvalidUserToken('Unable to determine tenancy.')

Since there is no tenant info in the token data, it always fails. What might I be doing wrong?

1 Answer 1

1

This answer addresses your initial authentication question, but not the rest of the question...

Your initial request:

curl -d '{"auth": {"passwordCredentials": {
                     "username": "USERNAME", "password": "PASSWORD"}}}' \
     -H "Content-Type: application/json" \
     http://identity:35357/v2.0/tokens

Needs to provide either a tenantName or tenantId attribute. With either of these supplied, your reply should include both the tenant information and a service catalog, for looking up other service endpoints.

So:

curl -d '{"auth": {"tenantName": "mytenant", "passwordCredentials": {
                         "username": "USERNAME", "password": "PASSWORD"}}}' \
         -H "Content-Type: application/json" \
         http://identity:35357/v2.0/tokens

Which should get you something like this:

{
  "access": {
    "metadata": {
      "roles": [
        "9fe2ff9ee4384b1894a90878d3e92bab",
        "0ecb6fccfd8546148cbb00b6d51364ce"
      ],
      "is_admin": 0
    },
    "user": {
      "name": "lars",
      "roles": [
        {
          "name": "_member_"
        },
        {
          "name": "admin"
        }
      ],
      "id": "436d522125584cf3a21ddcf628d59e2e",
      "roles_links": [],
      "username": "lars"
    },
    "serviceCatalog": [
      {
        "name": "nova",
        "type": "compute",
        "endpoints_links": [],
        "endpoints": [
          {
            "publicURL": "http://192.168.200.1:8774/v2/28a490a259974817b88ce490a74df8d2",
            "id": "264f2b4179ca4d6ca3a62b7347db11ce",
            "internalURL": "http://192.168.200.1:8774/v2/28a490a259974817b88ce490a74df8d2",
            "region": "RegionOne",
            "adminURL": "http://192.168.200.1:8774/v2/28a490a259974817b88ce490a74df8d2"
          }
        ]
      },
      .
      .
      .
    ],
    "token": {
      "tenant": {
        "name": "users/lars",
        "id": "28a490a259974817b88ce490a74df8d2",
        "enabled": true,
        "description": null
      },
      "id": "TOKENID",
      "expires": "2014-02-21T20:07:36Z",
      "issued_at": "2014-02-20T20:07:36.189044"
    }
  }
}
2
  • Thanks, that works! Been struggling the whole day, finally found that myself 5 seconds ago after looking into the Keystone source code, but failed to find that in the documentation :(
    – bereal
    Feb 26, 2014 at 12:20
  • 1
    A helpful hint, if you weren't already aware: most of the OpenStack command line clients (like the nova or keystone commands) have a --debug flag that will show you exactly what requests they're making. I've found these examples to be helpful when looking at the API reference.
    – larsks
    Feb 26, 2014 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.