yahoo-eng-team team mailing list archive

Thread
Date
[Bug 1627098] [NEW] federated users cannot user heat

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Robert Duncan <rduncan@xxxxxxxx>
Date: Fri, 23 Sep 2016 16:11:02 -0000
Reply-to: Bug 1627098 <1627098@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
Public bug reported:

keystone mitaka

I'm not entirely sure what is happening here, keystone is set up for federation with a SAML2 idp, 
all federated users can use all services with the exception of heat.

this gets a little bit complicated because first I ran into this bug (heat cannot find federated users role)
https://bugs.launchpad.net/murano/+bug/1589993

for which the workaround is to grant the federated user the
heat_stack_owner role

Once the role is granted directly to the federated user (e.g. not to the users group)
the previous error goes away - keystone now throws this error when using heat
object of type 'NoneType' has no len()

I think heat might be looking for a userid in the default sql domain
perhaps

>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.420 10012 INFO keystone.token.providers.fernet.utils [req-dd5cc8a6-7c57-4166-931d-6a5ebf8a91f0 283c6248ff874714a4a5d69471ef2fad f653c7eb3d244f09b37f69cdd1ef4e82 - default default] Loaded 2 encryption keys (max_active_keys=3) from: /etc/keystone/fernet-keys
<14>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.480 10013 INFO keystone.common.wsgi [req-6998992e-83b7-4743-9ac5-036c2aed28ff - - - - -] GET http://172.25.60.5:35357/
<15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.492 10011 DEBUG keystone.middleware.auth [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. _build_auth_context /usr/lib/python2.7/dist-packages/keystone/middleware/auth.py:71
<14>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.494 10011 INFO keystone.common.wsgi [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] POST http://172.25.60.5:35357/v3/auth/tokens
<15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.559 10011 DEBUG oslo_messaging._drivers.amqpdriver [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] CAST unique_id: bed1de3722504cb9b5e84b7ed3e7e4af size: 906 NOTIFY exchange: keystone topic: notifications.info _send /usr/lib/python2.7/dist-packages/oslo_messaging/_drivers/amqpdriver.py:480
<15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.569 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] NeedRegenerationException _enter /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:94
<15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.570 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] no value, waiting for create lock _enter_create /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:127
<15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.570 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] value creation lock <dogpile.cache.region._LockWrapper object at 0x7f116ead6cd0> acquired _enter_create /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:131
<15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.571 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] Calling creation function _enter_create /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:148
<15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.579 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] Released creation lock _enter_create /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:154
<11>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] object of type 'NoneType' has no len()
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi Traceback (most recent call last):
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/wsgi.py", line 249, in __call__
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     result = method(context, **params)
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/auth/controllers.py", line 416, in authenticate_for_token
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     parent_audit_id=token_audit_id)
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/manager.py", line 124, in wrapped
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     __ret_val = __f(*args, **kwargs)
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/token/provider.py", line 384, in issue_v3_token
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     parent_audit_id)
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/token/providers/fernet/core.py", line 44, in issue_v3_token
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     *args, **kwargs)
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/token/providers/common.py", line 621, in issue_v3_token
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     audit_info=parent_audit_id)
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/token/providers/common.py", line 519, in get_token_data
2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     self._populate_user(token_data, user_id, trust)
2016-09-23 10:48:06.580 100
<15>Sep 23 10:48:07 node-30 keystone-admin: 2016-09-23 10:48:07.258 10014 DEBUG keystone.middleware.auth [req-b765bdb6-2843-4ade-92d6-11db786b38f6 - - - - -] There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. _build_auth_context /usr/lib/python2.7/dist-packages/keystone/middleware/auth.py:71

** Affects: keystone
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1627098

Title:
  federated users cannot user heat

Status in OpenStack Identity (keystone):
  New

Bug description:
  keystone mitaka

  I'm not entirely sure what is happening here, keystone is set up for federation with a SAML2 idp, 
  all federated users can use all services with the exception of heat.

  this gets a little bit complicated because first I ran into this bug (heat cannot find federated users role)
  https://bugs.launchpad.net/murano/+bug/1589993

  for which the workaround is to grant the federated user the
  heat_stack_owner role

  Once the role is granted directly to the federated user (e.g. not to the users group)
  the previous error goes away - keystone now throws this error when using heat
  object of type 'NoneType' has no len()

  I think heat might be looking for a userid in the default sql domain
  perhaps

  >Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.420 10012 INFO keystone.token.providers.fernet.utils [req-dd5cc8a6-7c57-4166-931d-6a5ebf8a91f0 283c6248ff874714a4a5d69471ef2fad f653c7eb3d244f09b37f69cdd1ef4e82 - default default] Loaded 2 encryption keys (max_active_keys=3) from: /etc/keystone/fernet-keys
  <14>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.480 10013 INFO keystone.common.wsgi [req-6998992e-83b7-4743-9ac5-036c2aed28ff - - - - -] GET http://172.25.60.5:35357/
  <15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.492 10011 DEBUG keystone.middleware.auth [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. _build_auth_context /usr/lib/python2.7/dist-packages/keystone/middleware/auth.py:71
  <14>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.494 10011 INFO keystone.common.wsgi [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] POST http://172.25.60.5:35357/v3/auth/tokens
  <15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.559 10011 DEBUG oslo_messaging._drivers.amqpdriver [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] CAST unique_id: bed1de3722504cb9b5e84b7ed3e7e4af size: 906 NOTIFY exchange: keystone topic: notifications.info _send /usr/lib/python2.7/dist-packages/oslo_messaging/_drivers/amqpdriver.py:480
  <15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.569 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] NeedRegenerationException _enter /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:94
  <15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.570 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] no value, waiting for create lock _enter_create /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:127
  <15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.570 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] value creation lock <dogpile.cache.region._LockWrapper object at 0x7f116ead6cd0> acquired _enter_create /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:131
  <15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.571 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] Calling creation function _enter_create /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:148
  <15>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.579 10011 DEBUG dogpile.core.dogpile [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] Released creation lock _enter_create /usr/lib/python2.7/dist-packages/dogpile/core/dogpile.py:154
  <11>Sep 23 10:48:06 node-30 keystone-admin: 2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi [req-298ebc90-2aec-4dc9-b0af-00ef2c14c5f0 - - - - -] object of type 'NoneType' has no len()
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi Traceback (most recent call last):
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/wsgi.py", line 249, in __call__
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     result = method(context, **params)
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/auth/controllers.py", line 416, in authenticate_for_token
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     parent_audit_id=token_audit_id)
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/manager.py", line 124, in wrapped
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     __ret_val = __f(*args, **kwargs)
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/token/provider.py", line 384, in issue_v3_token
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     parent_audit_id)
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/token/providers/fernet/core.py", line 44, in issue_v3_token
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     *args, **kwargs)
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/token/providers/common.py", line 621, in issue_v3_token
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     audit_info=parent_audit_id)
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/token/providers/common.py", line 519, in get_token_data
  2016-09-23 10:48:06.580 10011 ERROR keystone.common.wsgi     self._populate_user(token_data, user_id, trust)
  2016-09-23 10:48:06.580 100
  <15>Sep 23 10:48:07 node-30 keystone-admin: 2016-09-23 10:48:07.258 10014 DEBUG keystone.middleware.auth [req-b765bdb6-2843-4ade-92d6-11db786b38f6 - - - - -] There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. _build_auth_context /usr/lib/python2.7/dist-packages/keystone/middleware/auth.py:71

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1627098/+subscriptions