OpenStack Compute (nova)

"Malformed request url" error for project ID mismatch is confusing

Bug #915151 reported by Rohit Karajgi
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
Medium
Rick Harris
OpenStack Compute (nova) 2013.2 "havana"

Bug Description

Scenario: With Keystone authentication, request for a resource in Nova for a tenant that is not mapped to the given token:

Curl Request:
rohit@devhost:~/dev/tempest_ci_env/tempest/etc$ curl -H "X-Auth-Token: 1234567890" http://127.0.0.1:8774/v1.1/2/images

Response: {"badRequest": {"message": "Malformed request url", "code": 400}}

Expected error message, something like: {"badRequest": {"message": "Unauthorized tenant for token <token_id>", "code": 400}}
Actual Error Message: {"badRequest": {"message": "Malformed request url", "code": 400}}

The message "Malformed request URL" mis-guides the user to check his URL string, which is correct in this case. The only thing that is wrong is either the supplied token for the tenant, or the tenant ID passed in the URL for the given token.

Thierry Carrez (ttx)
Changed in nova:
importance: Undecided → Low
status: New → Confirmed
Revision history for this message
Mark McLoughlin (markmc) wrote :

The message was introduced by bug #904072

I agree it does not give enough information and is misleading

I've created this FAQ: https://answers.launchpad.net/nova/+faq/2004

Changed in nova:
importance: Low → Medium
Revision history for this message
Mark McLoughlin (markmc) wrote :

A blueprint was filed about this, but was later closed:

  https://blueprints.launchpad.net/nova/+spec/no-malformed-request-url

  Currently, "Malformed request url" error message is used if and only if tenant id specified in the
  request URL in not the same that tenant to which the token belongs (nova/api/openstack/wsgi.py).
  This message seems to be confusing since the URL itself is correct. Imagine a user that has roles in
  tenant A and tenant B and tries to execute a request for tenant B using a token for tenant A - he
  will get "Malformed request url" when problem actually can be with the token.

  It could be better if another message was returned, e.g. "Incorrect project id" or "Project ids from
  URL and credentials differ".

summary: - Incorrect error "message" string returned for negative API request
- scenario
+ "Malformed request url" error for project ID mismatch is confusing
Mauro S M Rodrigues (maurorodrigues)
Changed in nova:
assignee: nobody → Mauro Sergio Martins Rodrigues (maurosr)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.openstack.org/28654

Changed in nova:
status: Confirmed → In Progress
Revision history for this message
Jian Wen (wenjianhn) wrote :

Add Mark created FAQ here, since this page is more likely to get searched.
It solves my configuration problem.

faq/2004
""
If you get e.g.
  ERROR: Malformed request url (HTTP 400) (Request-ID: req-b83b862f-6aed-4420-8849-6dcf7c2fe9ae)
as a response to Nova API, consider the following:
 1) If you think you're using keystone, make sure that
         auth_strategy = keystone
      is set in nova.conf
 2) Check that the tenant ID in the request matches the tenant you are authenticated under
See also bug #915151
""

Revision history for this message
Rick Harris (rconradharris) wrote :

https://review.openstack.org/#/c/30304/ improves the error message.

It still says malformed request url, but goes into more detail, explaining that the project-id in the URL doesn't match the project-id in the context.

Changed in nova:
status: In Progress → Fix Committed
assignee: Mauro Sergio Martins Rodrigues (maurosr) → Rick Harris (rconradharris)
Thierry Carrez (ttx)
Changed in nova:
milestone: none → havana-1
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in nova:
milestone: havana-1 → 2013.2
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.