"glance index" returns "Invalid OpenStack Identity credentials."

Asked by Theodotos Andreou on 2012-11-07

Hi guys,

I am trying to follow the Ubuntu 12.04 Folsom installation guide from docs.openstack.org:

http://docs.openstack.org/trunk/openstack-compute/install/apt/content/osfolubuntu-imageservice.html

I went straight to Appendix B that describes the installation of a single node openstack system.

I reached the point where I should run "glance index". It gives:

# glance index
ID Name Disk Format Container Format Size
------------------------------------ ------------------------------ -------------------- -------------------- --------------
Request returned failure status.
None
Invalid OpenStack Identity credentials.

In the logs I get:

# tail /var/log/glance/api.log

2012-11-07 08:52:08 32427 DEBUG glance.api.middleware.version_negotiation [-] Determining version of request: GET /v1/images
/detail Accept: process_request /usr/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:45
2012-11-07 08:52:08 32427 DEBUG glance.api.middleware.version_negotiation [-] Using url versioning process_request /usr/lib/
python2.7/dist-packages/glance/api/middleware/version_negotiation.py:58
2012-11-07 08:52:08 32427 DEBUG glance.api.middleware.version_negotiation [-] Matched version: v1 process_request /usr/lib/p
ython2.7/dist-packages/glance/api/middleware/version_negotiation.py:70
2012-11-07 08:52:08 32427 DEBUG glance.api.middleware.version_negotiation [-] new uri /v1/images/detail process_request /usr
/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:71
2012-11-07 08:52:08 32427 WARNING keystone.middleware.auth_token [-] Unexpected response from keystone service: {u'error': {u'message': u'Invalid tenant', u'code': 401, u'title': u'Not Authorized'}}
2012-11-07 08:52:08 32427 WARNING keystone.middleware.auth_token [-] Authorization failed for token fffdeab396954d3cbc0785ae51ee5d9f
2012-11-07 08:52:08 32427 INFO keystone.middleware.auth_token [-] Invalid user token - rejecting request

Any idea what am I missing here?

My openstack status is 'newbie' :)

Question information

Language:
English Edit question
Status:
Solved
For:
Glance Edit question
Assignee:
No assignee Edit question
Solved by:
Theodotos Andreou
Solved:
2012-12-16
Last query:
2012-12-16
Last reply:
2012-11-24

Getting similar error after following Appendix B instructions. This also affects the webUI, once logged in and select 'Images'; I am redirected back to the log-in page.

Here's the apache logs:
[Wed Nov 07 19:02:32 2012] [error] \x1b[31;1mUnauthorized: HTTPUnauthorized (HTTP 401)\x1b[0m
[Wed Nov 07 19:02:32 2012] [error] Traceback (most recent call last):
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/horizon/dashboards/syspanel/images/views.py", line 50, in get_data
[Wed Nov 07 19:02:32 2012] [error] marker=marker)
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/horizon/api/glance.py", line 67, in image_list_detailed
[Wed Nov 07 19:02:32 2012] [error] **kwargs))
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/glanceclient/v1/images.py", line 130, in paginate
[Wed Nov 07 19:02:32 2012] [error] images = self._list(url, "images")
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/glanceclient/common/base.py", line 53, in _list
[Wed Nov 07 19:02:32 2012] [error] resp, body = self.api.json_request('GET', url)
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/glanceclient/common/http.py", line 174, in json_request
[Wed Nov 07 19:02:32 2012] [error] resp, body_iter = self._http_request(url, method, **kwargs)
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/glanceclient/common/http.py", line 158, in _http_request
[Wed Nov 07 19:02:32 2012] [error] raise exc.from_response(resp)
[Wed Nov 07 19:02:32 2012] [error] HTTPUnauthorized: HTTPUnauthorized (HTTP 401)
[Wed Nov 07 19:08:24 2012] [error] unable to retrieve service catalog with token
[Wed Nov 07 19:08:24 2012] [error] Traceback (most recent call last):
[Wed Nov 07 19:08:24 2012] [error] File "/usr/lib/python2.7/dist-packages/keystoneclient/v2_0/client.py", line 132, in _extract_service_catalog
[Wed Nov 07 19:08:24 2012] [error] endpoint_type='adminURL')
[Wed Nov 07 19:08:24 2012] [error] File "/usr/lib/python2.7/dist-packages/keystoneclient/service_catalog.py", line 62, in url_for
[Wed Nov 07 19:08:24 2012] [error] raise exceptions.EndpointNotFound('Endpoint not found.')
[Wed Nov 07 19:08:24 2012] [error] EndpointNotFound: Endpoint not found.

and logs from /var/log/glance/api.log are consistent with OP.

Thanks

NarsingRao (gurrapu-narsing) said : #2

Hi,

Even I am getting same error
Can anyone help :)

Thanks,
Narsing

Nicolae Paladi (n-paladi) said : #3

I have had a similar issue and tried to nail it down, but after some attempts gave up and made a fresh deployment, which solved the problem.

I am also very new to Openstack and getting a similar error when trying to do the following command from the installation documentation.

sudo glance --os-username=admin --os-password=secretword --os-tenant-name=openstackDemo --os-auth-url=http://192.168.xxx.xxx:5000/v2.0 image-create --name="tty-linux-kernel" --disk-format=aki --container-format=aki < ttylinux-uec-amd64-12.1_2.6.35-22_1-vmlinuz

Request returned failure status.

None

Invalid OpenStack Identity credentials.

sudo tail /var/log/glance/api.log

2012-11-14 06:28:31 19941 ERROR keystone.middleware.auth_token [-] HTTP connection exception: [Errno 111] ECONNREFUSED

2012-11-14 06:28:31 19941 WARNING keystone.middleware.auth_token [-] Authorization failed for token 51dbb4057e924f94a0e3e70d40111481

2012-11-14 06:28:31 19941 INFO keystone.middleware.auth_token [-] Invalid user token - deferring reject downstream

2012-11-14 06:29:44 19941 DEBUG glance.api.middleware.version_negotiation [-] Determining version of request: POST /v1/images Accept: process_request /usr/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:45

2012-11-14 06:29:44 19941 DEBUG glance.api.middleware.version_negotiation [-] Using url versioning process_request /usr/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:58

2012-11-14 06:29:44 19941 DEBUG glance.api.middleware.version_negotiation [-] Matched version: v1 process_request /usr/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:70

2012-11-14 06:29:44 19941 DEBUG glance.api.middleware.version_negotiation [-] new uri /v1/images process_request /usr/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:71

2012-11-14 06:29:44 19941 ERROR keystone.middleware.auth_token [-] HTTP connection exception: [Errno 111] ECONNREFUSED

2012-11-14 06:29:44 19941 WARNING keystone.middleware.auth_token [-] Authorization failed for token 6eae7a79fbcb499ea16bce61e2ae7604

2012-11-14 06:29:44 19941 INFO keystone.middleware.auth_token [-] Invalid user token - deferring reject downstream

I noticed in the instructions it says use tenant-name of demo but the other references in that section show openstackDemo for the tenant name. I've tried both. Any help would be appreciated.

Theodotos Andreou (theodotos) said : #5

@nico: Probably it will work if I try to use the default names and passwords used in the guide. But in the end I will need to deploy this in production and I will have to use a password stronger than "openstack". I need to understand what all these values are supposed to be and the docs are not very clear on that.

For example, what is the difference of the SERVICE_TOKEN env variable and the admin_token keynots.conf entry? Are they supposed to be the same? If not then where is SERVICE_TOKEN defined?

Zisu Andrei (matzipan) said : #6

Have done the tutorial step by step and when I reached the "glance index" step I got the same error. What are we missing?

Zisu Andrei (matzipan) said : #7

If I uncomment the "config_file" line in both glance-api.conf and glance-registry.conf it changes the behaviour. Now, instead of throwing that error it shows the table headers and hangs.

Zisu Andrei (matzipan) said : #8

It seems the glance registry is looking for the glance-registry-paste.ini configuration file and cannot find it. It seems it's looking in the wrong place?

2012-11-17 15:19:05 28420 DEBUG glance.common.config [-] Loading glance-registry-keystone from /glance-registry-paste.ini load_paste_app /usr/$
2012-11-17 15:19:05 28420 CRITICAL glance [-] [Errno 2] No such file or directory: '/glance-registry-paste.ini'
2012-11-17 15:19:05 28420 TRACE glance Traceback (most recent call last):
2012-11-17 15:19:05 28420 TRACE glance File "/usr/bin/glance-registry", line 51, in <module>
2012-11-17 15:19:05 28420 TRACE glance server.wait()
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 241, in wait
2012-11-17 15:19:05 28420 TRACE glance self.wait_on_children()
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 226, in wait_on_children
2012-11-17 15:19:05 28420 TRACE glance self.run_child()
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 256, in run_child
2012-11-17 15:19:05 28420 TRACE glance self.run_server()
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 275, in run_server
2012-11-17 15:19:05 28420 TRACE glance eventlet.wsgi.server(self.sock, self.app_func(),
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/config.py", line 187, in load_paste_app
2012-11-17 15:19:05 28420 TRACE glance app = deploy.loadapp("config:%s" % conf_file, name=app_name)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 247, in loadapp
2012-11-17 15:19:05 28420 TRACE glance return loadobj(APP, uri, name=name, **kw)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 271, in loadobj
2012-11-17 15:19:05 28420 TRACE glance global_conf=global_conf)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 296, in loadcontext
2012-11-17 15:19:05 28420 TRACE glance global_conf=global_conf)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 317, in _loadconfig
2012-11-17 15:19:05 28420 TRACE glance loader = ConfigLoader(path)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 393, in __init__
2012-11-17 15:19:05 28420 TRACE glance with open(filename) as f:
2012-11-17 15:19:05 28420 TRACE glance IOError: [Errno 2] No such file or directory: '/glance-registry-paste.ini'
2012-11-17 15:19:05 28420 TRACE glance

alxspb (alxspb) said : #9

The problem is in the path to glance-registry-paste.ini file.
In config /etc/glance/glance-registry.conf should be the full path to file, i.e /etc/glance/glance-registry-paste.ini instead of just glance-registry-paste.ini.

[paste_deploy]
# Name of the paste configuration file that defines the available pipelines
config_file = /etc/glance/glance-registry-paste.ini

Zisu Andrei (matzipan) said : #10

Nice workaround. But that is not definetely not the expected behaviour. Should create bug report?

hnkhs (hnkhs) said : #11

Could fix the problem in my test-environment by changing

admin_tenant_name = service

into

admin_tenant_name = admin

in the files
/etc/glance/glance-registry-paste.ini
/etc/glance/glance-api-paste.ini

Hope this helps.

Theodotos Andreou (theodotos) said : #12

@alxspb and @hnkhs:

Guys I tried both your suggestion but I still don't see any light in the tunnel:

# glance index
No handlers could be found for logger "keystoneclient.client"
Invalid user / password (HTTP 401)

I get nothing in the logs even though I did set the 'debug = True' in both glance-registry.conf and glance-api.conf files.

Any other suggestions?

Theodotos Andreou (theodotos) said : #13

I am getting closer but apparently not close enough:

I get this when i use the admin tenant id:

# glance --os-username admin --os-password novapass --os-tenant-id 54c2477b694048eba9921727f8f8e579 --os-auth-url http:/10.211.55.17/:5000/v2.0/ index
ID Name Disk Format Container Format Size
------------------------------------ ------------------------------ -------------------- -------------------- --------------
Request returned failure status.
None
Invalid OpenStack Identity credentials.

and this when I use the service tenant id:

# glance --os-username admin --os-password novapass --os-tenant-id b380a00d1a454084ad5b10bdcb06cb72 --os-auth-url http://10.211.55.17:5000/v2.0/ index
No handlers could be found for logger "keystoneclient.client"
Invalid tenant (HTTP 401)

Apparently the fisrt command is more"correct" than the latter but still not working. Any other ideas?

Theodotos Andreou (theodotos) said : #14

Guys I gave up on the official guide. I used the scripts of dimtdv instead:

https://github.com/dimtdv/folsom-single-node/blob/master/README.md

They do not work out of the box. There are some requirements first:

1) Setup folsom repo:

# cat /etc/apt/sources.list.d/folsom.list
# Openstack folsom repositor
deb http://ubuntu-cloud.archive.canonical.com/ubuntu precise-updates/folsom main

2) # apt-get install ntp

/etc/ntp.conf:
server ntp.ubuntu.com iburst
server 127.127.1.0
fudge 127.127.1.0 stratum 10

3) # apt-get install git

4) # git clone https://github.com/dimtdv/folsom-single-node.git

    # cd folsom-single-node.git

5) Setup lvm2

# apt-get install lvm2

Create a volume group named "nova-volumes" (This is optional but recommended in a production environment. If you skip this a normal file will be created to represent the Volume Group pgysical volume)

6) Setup networking as per README.md

7) Run these scripts after you setup stackrc:
# ./install-mysql.sh
# ./install-keystone.sh
# ./init-keystone.sh
# ./install-glance.sh
# ./init-glance.sh
# ./install-nova.sh
# ./install-dash.sh
# ./restart-nova.sh

8) mkdir -p /var/lib/dash/.blackhole

9) login ar http://youserver.dom/horizon

Enjoy!

ChangBo Guo(gcb) (glongwave) said : #15

According to hnkhs (hnkhs) 's comment #11 , It works in my test env :)

Julian Martin (julian-martin) said : #16

If you remove:
flavor = keystone

from the files:
/etc/glance/glance-api.conf
and
/etc/glance/glance-registry.conf

then restart (service glance-api restart && service glance-registry restart) and rebuild the DB (glance-manage db_sync) it will work well.

Brad Knowles (bknowles) said : #17

Julian -- you don't want to remove keystone. I think the real problem here is outlined at https://bugs.launchpad.net/nova/+bug/1065211

In short, you need to make sure that all the usernames, tenant names, and passwords match between *ALL* of your OpenStack configuration files. You need this in all the respective *.conf files, as well as all the respective *-paste.ini files. If your username/tenant name/password in one place is something like admin/admin/openstack and it is shown as %ADMIN_USER%/%ADMIN_TENANT%/%ADMIN_PASSWORD% in a different file, then that won't work.

Dmitry (belimor) said : #18

Had the same issue.
In my case It was a wrong password in the admin_password settings line for both files
/etc/glance/glance-api.conf
and
/etc/glance/glance-registry.conf