hi all,
i am doing some work to change sahara to make greater use of
keystoneclient.session.Session objects and i am running into a strange
error when issuing the trusts.
the crux of this issue is that when i create Client objects by passing
all the parameters directly to the client, the trust is created as
normal. But, if i create a Password based auth plugin object, using the
same parameters, and the instantiate a Client by using the auth and a
Session object, then i fail to create the trust with an error about not
having sufficient permission.
i have put together a few python repl samples to show what is happening,
these are also available on github[1].
the following code shows how we've been doing this, using the generic
Client object we authenticate using the named parameters.
>>> from keystoneclient.v3 import client
>>> trustor = client.Client(
auth_url='http://192.168.122.2:5000/v3',
username='demo',
password='openstack',
project_name='demo',
user_domain_name='Default',
project_domain_name='Default')
>>> trustee = client.Client(
auth_url='http://192.168.122.2:5000/v3',
username='admin',
password='openstack',
project_name='admin',
user_domain_name='Default',
project_domain_name='Default')
>>> trustor.trusts.create(
trustor_user=trustor.user_id,
trustee_user=trustee.user_id,
project=trustor.project_id,
role_names=['Member'],
impersonation=True,
expires_at=None)
<Trust deleted_at=None, expires_at=None,
id=ac0d8f3b9e7443c2bdb0f855c2a3b9b5, impersonation=True, links={u'self':
u'http://192.168.122.2:35357/v3/OS-TRUST/trusts/ac0d8f3b9e7443c2bdb0f855c2a3b9b5'},
project_id=416290f342e04a34acccafe79bb399c7, redelegation_count=0,
remaining_uses=None, roles=[{u'id': u'433c86b705ef4656b90514ea5401469e',
u'links': {u'self':
u'http://192.168.122.2:35357/v3/roles/433c86b705ef4656b90514ea5401469e'}, u'name':
u'Member'}], roles_links={u'self':
u'http://192.168.122.2:35357/v3/OS-TRUST/trusts/ac0d8f3b9e7443c2bdb0f855c2a3b9b5/roles',
u'next': None, u'previous': None},
trustee_user_id=cf45da134c76460e89b5837e07cc4b82,
trustor_user_id=863b972dbbfd44b7bbde1b988e2b5098>
the trust is created with no issues.
next, i try to create a Client using a Session and a Password auth
plugin object.
>>> from keystoneclient.auth.identity import v3
>>> from keystoneclient import session
>>> sess = session.Session()
>>> trustor_auth = v3.Password(
auth_url='http://192.168.122.2:5000/v3',
username='demo',
password='openstack',
project_name='demo',
user_domain_name='Default',
project_domain_name='Default')
>>> trustee_auth = v3.Password(
auth_url='http://192.168.122.2:5000/v3',
username='admin',
password='openstack',
project_name='admin',
user_domain_name='Default',
project_domain_name='Default')
>>> trustor = client.Client(session=sess, auth=trustor_auth)
>>> trustee = client.Client(session=sess, auth=trustee_auth)
>>> trustor.trusts.create(
trustor_user=trustor.user_id,
trustee_user=trustee.user_id,
project=trustor.project_id,
role_names=['Member'],
impersonation=True,
expires_at=None)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/v3/contrib/trusts.py",
line 76, in create
**kwargs)
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/base.py",
line 73, in func
return f(*args, **new_kwargs)
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/base.py",
line 333, in create
self.key)
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/base.py",
line 151, in _create
return self._post(url, body, response_key, return_raw, **kwargs)
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/base.py",
line 165, in _post
resp, body = self.client.post(url, body=body, **kwargs)
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/adapter.py",
line 176, in post
return self.request(url, 'POST', **kwargs)
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/adapter.py",
line 206, in request
resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/adapter.py",
line 95, in request
return self.session.request(url, method, **kwargs)
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/utils.py",
line 336, in inner
return func(*args, **kwargs)
File
"/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/session.py",
line 397, in request
raise exceptions.from_response(resp, method, url)
keystoneclient.openstack.common.apiclient.exceptions.Forbidden: You
are not authorized to perform the requested action:
identity:create_trust (Disable debug mode to suppress these details.)
(HTTP 403) (Request-ID: req-c67aee46-2baf-4bc3-9bd5-b82ff31057a7)
this time, not so much...
the same authentication parameters are used as for the previous Client
method but this time i am denied the trust based on the authorization.
i am wondering if i have done something wrong when creating the Session
based Client, or is this an issue with keystone treating the user's
differently depending on the client type, or perhaps something is going
on with the policy stuff within keystone?
thanks for taking a look,
mike
[1]: https://gist.github.com/elmiko/d3df44f6910660f680b6
__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
