openstack team mailing list archive
-
openstack team
-
Mailing list archive
-
Message #24175
[Swift] Intermittent error 403 "Access was denied to this resource"
Hello,
I would appreciate if you help me to troubleshoot the following issue:
I am having error 403 intermittenly when listing containers in swift.
Sometimes the error appears a few times per hour, sometimes once per day.
Basically, it's possible to reproduce the error with a simple curl command:
curl --get -v -H 'X-Auth-Token: ef644...'
http://swift-proxy.example.com:8080/v1/AUTH_323d0...
<body>
<h1>403 Forbidden</h1>
Access was denied to this resource.<br /><br />
</body>
The token and swift proxy endpoint are all correct as most of the time the
command works.
A few words about infrastructure: I use swift 1.7.4 and several swift
proxies. Users are authenticated via Keystone. Tokens are cached with
memcached on swift proxy servers.
I did a lot of tests to figure out what service generates such error:
- same issue happens with each swift proxy server, with or without
memcached enabled
- it happens with different users and in different tenants
- I downloaded sources of swift and Keystone and grepped on that error.
There are some HTTPForbidden values returned in code but no one with the
body 'Access denied to this resource'
- I tried monitoring traffic with tcpdump to catch the error and understand
who's sending it but with no success yet
- the issue might be related to swift ACL rules but I haven't set any
read/write permissions for containers
- set debug logs for swift proxy but nothing has been found yet
Please help me to understand how this error is returned. Thank you for your
time.
--
Kind regards,
Andrii Loshkovskyi
Follow ups