glance 401 unauththorized
I followed http://
glance --os_username=
Uploading image 'tty-linux-kernel'
Failed to add image. Got error:
The request returned 500 Internal Server Error
The response body:
Traceback (most recent call last):
File "/usr/lib/
result = self.applicatio
File "/usr/lib/
resp = self.call_func(req, *args, **self.kwargs)
File "/usr/lib/
return self.func(req, *args, **kwargs)
File "/usr/lib/
response = req.get_
File "/usr/lib/
application, catch_exc_
File "/usr/lib/
app_iter = application(
File "/usr/lib/
return self.app(env, start_response)
File "/usr/lib/
resp = self.call_func(req, *args, **self.kwargs)
File "/usr/lib/
return self.func(req, *args, **kwargs)
File "/usr/lib/
response = req.get_
File "/usr/lib/
application, catch_exc_
File "/usr/lib/
app_iter = application(
File "/usr/lib/
return resp(environ, start_response)
File "/usr/lib/
response = self.app(environ, start_response)
File "/usr/lib/
return resp(environ, start_response)
File "/usr/lib/
resp = self.call_func(req, *args, **self.kwargs)
File "/usr/lib/
return self.func(req, *args, **kwargs)
File "/usr/lib/
request, **action_args)
File "/usr/lib/
return method(*args, **kwargs)
File "/usr/lib/
image_meta = self._reserve(req, image_meta)
File "/usr/lib/
image_meta = registry.
File "/usr/lib/
return c.add_image(
File "/usr/lib/
res = self.do_
File "/usr/lib/
return func(self, *args, **kwargs)
File "/usr/lib/
headers=
File "/usr/lib/
return func(self, method, url, body, headers)
File "/usr/lib/
raise exception.
ClientConnectio
Details: [Errno 111] ECONNREFUSED
the /var/log/api.log are as follow:
2012-07-18 02:20:24 15643 INFO [keystone.
2012-07-18 02:20:24 15643 INFO [eventlet.
2012-07-18 02:58:51 16310 INFO [keystone.
2012-07-18 02:58:51 16310 INFO [eventlet.
2012-07-18 03:14:16 16310 WARNING [keystone.
2012-07-18 03:14:16 16310 INFO [keystone.
2012-07-18 03:14:16 16310 WARNING [keystone.
2012-07-18 03:14:16 16310 INFO [keystone.
2012-07-18 03:19:15 16310 WARNING [keystone.
2012-07-18 03:19:15 16310 INFO [keystone.
2012-07-18 03:19:15 16310 WARNING [keystone.
2012-07-18 03:19:15 16310 INFO [keystone.
2012-07-18 03:20:27 16310 WARNING [keystone.
2012-07-18 03:20:27 16310 INFO [keystone.
2012-07-18 03:20:27 16310 WARNING [keystone.
2012-07-18 03:20:27 16310 INFO [keystone.
2012-07-18 03:22:24 16310 WARNING [keystone.
2012-07-18 03:22:24 16310 INFO [keystone.
2012-07-18 03:22:24 16310 WARNING [keystone.
2012-07-18 03:22:24 16310 INFO [keystone.
2012-07-18 03:27:02 16310 WARNING [keystone.
2012-07-18 03:27:02 16310 INFO [keystone.
2012-07-18 03:27:03 16310 WARNING [keystone.
2012-07-18 03:27:03 16310 INFO [keystone.
2012-07-18 04:16:09 16310 WARNING [keystone.
2012-07-18 04:16:09 16310 INFO [keystone.
2012-07-18 04:16:09 16310 WARNING [keystone.
2012-07-18 04:16:09 16310 INFO [keystone.
2012-07-18 04:17:13 16310 WARNING [keystone.
2012-07-18 04:17:13 16310 INFO [keystone.
2012-07-18 04:17:13 16310 WARNING [keystone.
2012-07-18 04:17:13 16310 INFO [keystone.
The /var/log/
2012-07-16 16:34:14 1231 INFO [glance.
2012-07-16 19:14:17 2812 INFO [glance.
2012-07-18 02:59:49 16332 INFO [glance.
Note: Your image metadata may still be in the registry, but the image's status will likely be 'killed'.
=======
I try to get the -A option,but the error as follow:
glance --os_username=
Uploading image 'tty-linux-kernel'
=======
Uploading image 'tty-linux-kernel'
Failed to add image. Got error:
You are not authenticated.
Details: 401 Unauthorized
This server could not verify that you are authorized to access the document you requested. Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.
Authentication required
Note: Your image metadata may still be in the registry, but the image's status will likely be 'killed'.
=======
The /etc/glance/
# Default minimal pipeline
[pipeline:
pipeline = versionnegotiation authtoken context apiv1app
# Use the following pipeline for keystone auth
# i.e. in glance-api.conf:
# [paste_deploy]
# flavor = keystone
#
[pipeline:
pipeline = versionnegotiation authtoken context apiv1app
# Use the following pipeline to enable transparent caching of image files
# i.e. in glance-api.conf:
# [paste_deploy]
# flavor = caching
#
[pipeline:
pipeline = versionnegotiation context cache apiv1app
# Use the following pipeline for keystone auth with caching
# i.e. in glance-api.conf:
# [paste_deploy]
# flavor = keystone+caching
#
[pipeline:
pipeline = versionnegotiation authtoken context cache apiv1app
# Use the following pipeline to enable the Image Cache Management API
# i.e. in glance-api.conf:
# [paste_deploy]
# flavor = cachemanagement
#
[pipeline:
pipeline = versionnegotiation context cache cachemanage apiv1app
# Use the following pipeline for keystone auth with cache management
# i.e. in glance-api.conf:
# [paste_deploy]
# flavor = keystone+
#
[pipeline:
pipeline = versionnegotiation authtoken context cache cachemanage apiv1app
[app:apiv1app]
paste.app_factory = glance.
glance.app_factory = glance.
[filter:
paste.filter_
glance.
[filter:cache]
paste.filter_
glance.
[filter:
paste.filter_
glance.
[filter:context]
paste.filter_
glance.
[filter:authtoken]
paste.filter_
service_protocol = http
service_host = 127.0.0.1
service_port = 5000
auth_host = 127.0.0.1
auth_port = 35357
auth_protocol = http
auth_uri = http://
admin_tenant_name = service
admin_user = glance
admin_password = glance
[paste_deploy]
flavor = keystone
The /etc/glance/
# Default minimal pipeline
[pipeline:
pipeline = authtoken context registryapp
# Use the following pipeline for keystone auth
# i.e. in glance-
# [paste_deploy]
# flavor = keystone
#
[pipeline:
pipeline = authtoken context registryapp
[app:registryapp]
paste.app_factory = glance.
glance.app_factory = glance.
[filter:context]
context_class = glance.
paste.filter_
glance.
[filter:authtoken]
paste.filter_
service_protocol = http
service_host = 127.0.0.1
service_port = 5000
auth_host = 127.0.0.1
auth_port = 35357
auth_protocol = http
auth_uri = http://
admin_tenant_name = service
admin_user = glance
admin_password = glance
could anyone can help me solve this probelm?
Question information
- Language:
- English Edit question
- Status:
- Answered
- For:
- Glance Edit question
- Assignee:
- No assignee Edit question
- Last query:
- 2012-07-17
- Last reply:
- 2012-07-23
| smallma (s-rain) said : | #1 |
Hello,
Please paste your endpoint, rule, user and service list.
Rain
| AndyYang (sncel-2008) said : | #2 |
keystone user-list
+------
| id | enabled | email | name |
+------
| 1a3104efdd144f4
| 4e061f653447467
| 84c27a8f3eb14ab
| d2e080c303a449c
| dba07b40bef4466
+------
keystone role-list
+------
| id | name |
+------
| 596e152752d54d3
| 82f1e7413a3543a
+------
keystone service-list
+------
| id | name | type | description |
+------
| 176d61580bad461
| 1c9123e1ae5c479
| a9fdb86b060d42e
| aaa3cf8be28c4b8
| bcaab6a1f0bf4ef
| fff27d2209e2462
+------
keystone endpoint-list
+------
| id | region | publicurl | internalurl | adminurl |
+------
| 0101166407924d4
| 050ff86ec3c24ae
| 2e03d606e9c9499
| 42e06931d169422
| 4e5456d5adb5404
| e8fa7cc1b4a54af
+------
| Joeu (joeu-zheng) said : | #3 |
Hello, is there any result? I have the same issue as yours, looking forward to how to solve it. :)
| Jay Pipes (jaypipes) said : | #4 |
Joeu, did you also use the CentOS/yum install method?
| Jay Pipes (jaypipes) said : | #5 |
It looks from the log output that 012345SECRET99T
curl -d '{"auth"
The token will be returned in that request. Try using that token with the -A option to the glance client.
| AndyYang (sncel-2008) said : | #6 |
Hi,Jay pipes.I follow you sugesstion,but still get the same error.
[andy@andy ~]$ curl -d '{"auth"
{"access": {"token": {"expires": "2012-07-
glance --os_username=
Failed to show index. Got error:
The request returned 500 Internal Server Error
The response body:
Traceback (most recent call last):
File "/usr/lib/
result = self.applicatio
File "/usr/lib/
resp = self.call_func(req, *args, **self.kwargs)
File "/usr/lib/
return self.func(req, *args, **kwargs)
File "/usr/lib/
response = req.get_
File "/usr/lib/
application, catch_exc_
File "/usr/lib/
app_iter = application(
File "/usr/lib/
return self.app(env, start_response)
File "/usr/lib/
resp = self.call_func(req, *args, **self.kwargs)
File "/usr/lib/
return self.func(req, *args, **kwargs)
File "/usr/lib/
response = req.get_
File "/usr/lib/
application, catch_exc_
File "/usr/lib/
app_iter = application(
File "/usr/lib/
return resp(environ, start_response)
File "/usr/lib/
response = self.app(environ, start_response)
File "/usr/lib/
return resp(environ, start_response)
File "/usr/lib/
resp = self.call_func(req, *args, **self.kwargs)
File "/usr/lib/
return self.func(req, *args, **kwargs)
File "/usr/lib/
request, **action_args)
File "/usr/lib/
return method(*args, **kwargs)
File "/usr/lib/
images = registry.
File "/usr/lib/
return c.get_images(
File "/usr/lib/
res = self.do_
File "/usr/lib/
return func(self, *args, **kwargs)
File "/usr/lib/
headers=
File "/usr/lib/
return func(self, method, url, body, headers)
File "/usr/lib/
raise exception.
ClientConnectio
Details: [Errno 111] ECONNREFUSED
| Joeu (joeu-zheng) said : | #7 |
Thanks to both!!! We still have error to follow your suggestions.
We try your command as below:
======Command1 Request=========
root@gplab24:~# curl -d '{"auth"
======Command1 Result =========
{"access": {"token": {"expires": "2012-07-
======Command2 Request =========
root@gplab24:~# glance --os_username=
//18c441aec8094
======Command2 Result =========
Failed to show index. Got error:
You are not authenticated.
Details: 401 Unauthorized
This server could not verify that you are authorized to access the document you requested. Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.
Authentication required
=======user list===========
root@gplab24:~# keystone user-list
Expecting authentication method via either a service token, --token or env[SERVICE_TOKEN], or credentials, --os_username or env[OS_USERNAME].
root@gplab24:~# keystone --token 012345SECRET99T
+------
| id | enabled | email | name |
+------
| 29c2d976987745f
| 518cacf232e040d
| 7fe5bcbcb98d41f
| c567d5959b044db
| f4506084f78d4c8
+------
=======role list===========
root@gplab24:~# keystone --token 012345SECRET99T
+------
| id | name |
+------
| 334828fc0a884c0
| 6a98b8ee20834ba
+------
=======service list===========
root@gplab24:~# keystone --token 012345SECRET99T
+------
| id | name | type | description |
+------
| 05b4ff389a94490
| 0e7bb281ff72441
| 10db4791e77c421
| 31f32e4253264e8
| 605961e742f44e1
| 942afb37d92a407
+------
=======endpoint list===========
root@gplab24:~# keystone --token 012345SECRET99T
+------
| id | region | publicurl | internalurl | adminurl |
+------
| 5a6e4d90889d428
| 6f74a335de774df
| b713eea1f0fb4d6
| b842289d645e42f
| c289df94b93b4d6
| d1b9ce7938d649e
+------
| smallma (s-rain) said : | #8 |
Hello,
Please add "admin_token = ADMIN" in glance-
Rain
| Joeu (joeu-zheng) said : | #9 |
Thank so much Rain!!! :)
Still error result as below :( Also including glance-
=======
root@gplab24:
[100%] 13.9M/s, ETA 0h 0m 0s
Uploading image 'tty-linuxkernel'
Failed to add image. Got error:
You are not authenticated.
Details: 401 Unauthorized
This server could not verify that you are authorized to access the document you requested. Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.
Authentication required
Note: Your image metadata may still be in the registry, but the image's st[ 0%]
=======
=======
# Show more verbose log output (sets INFO log level output)
# Show debugging output in logs (sets DEBUG log level output)
# Which backend store should Glance use by default is not specified
# in a request to add a new image to Glance? Default: 'file'
# Available choices are 'file', 'swift', and 's3'
# Address to bind the API server
# Port the bind the API server to
# Log to this file. Make sure you do not set the same log
# file for both the API and registry servers!
# Backlog requests when creating socket
# Number of Glance API worker processes to start.
# On machines with more than one CPU increasing this value
# may improve performance (especially if using SSL with
# compression turned on). It is typically recommended to set
# this value to the number of CPUs present on your machine.
# Role used to identify an authenticated user as administrator
# ================= Syslog Options =======
# Send logs to syslog (/dev/log) instead of to file specified
# by `log_file`
# Facility to use. If unset defaults to LOG_USER.
# syslog_log_facility = LOG_LOCAL0
# ================= SSL Options =======
# Certificate file to use when starting API server securely
# cert_file = /path/to/certfile
# Private key file to use when starting API server securely
# key_file = /path/to/keyfile
# ================= Security Options =======
# AES key for encrypting store 'location' metadata, including
# -- if used -- Swift or S3 credentials
# Should be set to a random string of length 16, 24 or 32 bytes
# metadata_
# ============ Registry Options =======
# Address to find the registry server
# Port the registry server is listening on
# What protocol to use when connecting to the registry server?
# Set to https for secure HTTP communication
# The path to the key file to use in SSL connections to the
# registry server, if any. Alternately, you may set the
# GLANCE_
# registry_
# The path to the cert file to use in SSL connections to the
# registry server, if any. Alternately, you may set the
# GLANCE_
# registry_
# The path to the certifying authority cert file to use in SSL connections
# to the registry server, if any. Alternately, you may set the
# GLANCE_
# registry_
# ============ Notification System Options =======
# Notifications can be sent when images are create, updated or deleted.
# There are three methods of sending notifications, logging (via the
# log_file directive), rabbit (via a rabbitmq queue), qpid (via a Qpid
# message queue), or noop (no notifications sent, the default)
# Configuration options if sending notifications via rabbitmq (these are
# the defaults)
# Configuration options if sending notifications via Qpid (these are
# the defaults)
# Set to 'ssl' to enable SSL
# ============ Filesystem Store Options =======
# Directory that the Filesystem backend store
# writes image data to
# ============ Swift Store Options =======
# Version of the authentication service to use
# Valid versions are '2' for keystone and '1' for swauth and rackspace
# Address where the Swift authentication service lives
# Valid schemes are 'http://
# If no scheme specified, default to 'https:/
# For swauth, use something like '127.0.
# User to authenticate against the Swift authentication service
# If you use Swift authentication service, set it to 'account':'user'
# where 'account' is a Swift storage account and 'user'
# is a user in that account
# Auth key for the user authenticating against the
# Swift authentication service
# Container within the account that the account should use
# for storing images in Swift
# Do we create the container if it does not exist?
# What size, in MB, should Glance start chunking image files
# and do a large object manifest in Swift? By default, this is
# the maximum object size in Swift, which is 5GB
# When doing a large object manifest, what size, in MB, should
# Glance write chunks to Swift? This amount of data is written
# to a temporary disk buffer during the process of chunking
# the image file, and the default is 200MB
# Whether to use ServiceNET to communicate with the Swift storage servers.
# (If you aren't RACKSPACE, leave this False!)
#
# To use ServiceNET for authentication, prefix hostname of
# `swift_
# Ex. https:/
# ============ S3 Store Options =======
# Address where the S3 authentication service lives
# Valid schemes are 'http://
# If no scheme specified, default to 'http://
# User to authenticate against the S3 authentication service
# Auth key for the user authenticating against the
# S3 authentication service
# Container within the account that the account should use
# for storing images in S3. Note that S3 has a flat namespace,
# so you need a unique bucket name for your glance images. An
# easy way to do this is append your AWS access key to "glance".
# S3 buckets in AWS *must* be lowercased, so remember to lowercase
# your AWS access key if you use it in your bucket name below!
# Do we create the bucket if it does not exist?
# When sending images to S3, the data will first be written to a
# temporary buffer on disk. By default the platform's temporary directory
# will be used. If required, an alternative directory can be specified here.
# s3_store_
# ============ RBD Store Options =======
# Ceph configuration file path
# If using cephx authentication, this file should
# include a reference to the right keyring
# in a client.<USER> section
# RADOS user to authenticate as (only applicable if using cephx)
# RADOS pool in which images are stored
# Images will be chunked into objects of this size (in megabytes).
# For best performance, this should be a power of two
# ============ Delayed Delete Options =======
# Turn on/off delayed delete
# Delayed delete time in seconds
# Directory that the scrubber will use to remind itself of what to delete
# Make sure this is also set in glance-
# =============== Image Cache Options =======
# Base directory that the Image Cache uses
=======
=======
# Default minimal pipeline
# Use the following pipeline for keystone auth
# i.e. in glance-api.conf:
# [paste_deploy]
#
# Use the following pipeline to enable transparent caching of image files
# i.e. in glance-api.conf:
# [paste_deploy]
# flavor = caching
#
# Use the following pipeline for keystone auth with caching
# i.e. in glance-api.conf:
# [paste_deploy]
# flavor = keystone+caching
#
# Use the following pipeline to enable the Image Cache Management API
# i.e. in glance-api.conf:
# [paste_deploy]
# flavor = cachemanagement
#
# Use the following pipeline for keystone auth with cache management
# i.e. in glance-api.conf:
# [paste_deploy]
# flavor = keystone+
#
=======
=======
# Show more verbose log output (sets INFO log level output)
# Show debugging output in logs (sets DEBUG log level output)
# Address to bind the registry server
# Port the bind the registry server to
# Log to this file. Make sure you do not set the same log
# file for both the API and registry servers!
# Backlog requests when creating socket
# SQLAlchemy connection string for the reference implementation
# registry server. Any valid SQLAlchemy connection string is fine.
# See: http://
# Period in seconds after which SQLAlchemy should reestablish its connection
# to the database.
#
# MySQL uses a default `wait_timeout` of 8 hours, after which it will drop
# idle connections. This can result in 'MySQL Gone Away' exceptions. If you
# notice this, you can lower this value to ensure that SQLAlchemy reconnects
# before MySQL can drop the connection.
# Limit the api to return `param_limit_max` items in a call to a container. If
# a larger `limit` query param is provided, it will be reduced to this value.
# If a `limit` query param is not provided in an api request, it will
# default to `limit_
# Role used to identify an authenticated user as administrator
# ================= Syslog Options =======
# Send logs to syslog (/dev/log) instead of to file specified
# by `log_file`
# Facility to use. If unset defaults to LOG_USER.
# syslog_log_facility = LOG_LOCAL1
# ================= SSL Options =======
# Certificate file to use when starting registry server securely
# cert_file = /path/to/certfile
# Private key file to use when starting registry server securely
# key_file = /path/to/keyfile
=======
=======
# Default minimal pipeline
# Use the following pipeline for keystone auth
# i.e. in glance-
# [paste_deploy]
# flavor = keystone
#
=======
| Joeu (joeu-zheng) said : | #10 |
Hello,
From my side, solve the issue to add in glance-
admin_token = 012345SECRET99T
root@gplab24:
=======
Added new image with ID: c590e3c3-
Thank so much all of you, thanks again. :)
| Jay Pipes (jaypipes) said : | #11 |
Joeu, try adding -S keystone to your glance CLI tool calls. That's the only thing I can think of.. everything else seems to be correct!
| smallma (s-rain) said : | #12 |
Hello,
Please check admin_token in keystone.conf. You should set the same value in glance-
Rain
Can you help with this problem?
Provide an answer of your own, or ask AndyYang for more information if necessary.
