"glance index" returns "Invalid OpenStack Identity credentials."

Getting similar error after following Appendix B instructions. This also affects the webUI, once logged in and select 'Images'; I am redirected back to the log-in page.

Here's the apache logs:
[Wed Nov 07 19:02:32 2012] [error] \x1b[31;1mUnauthorized: HTTPUnauthorized (HTTP 401)\x1b[0m
[Wed Nov 07 19:02:32 2012] [error] Traceback (most recent call last):
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/horizon/dashboards/syspanel/images/views.py", line 50, in get_data
[Wed Nov 07 19:02:32 2012] [error] marker=marker)
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/horizon/api/glance.py", line 67, in image_list_detailed
[Wed Nov 07 19:02:32 2012] [error] **kwargs))
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/glanceclient/v1/images.py", line 130, in paginate
[Wed Nov 07 19:02:32 2012] [error] images = self._list(url, "images")
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/glanceclient/common/base.py", line 53, in _list
[Wed Nov 07 19:02:32 2012] [error] resp, body = self.api.json_request('GET', url)
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/glanceclient/common/http.py", line 174, in json_request
[Wed Nov 07 19:02:32 2012] [error] resp, body_iter = self._http_request(url, method, **kwargs)
[Wed Nov 07 19:02:32 2012] [error] File "/usr/lib/python2.7/dist-packages/glanceclient/common/http.py", line 158, in _http_request
[Wed Nov 07 19:02:32 2012] [error] raise exc.from_response(resp)
[Wed Nov 07 19:02:32 2012] [error] HTTPUnauthorized: HTTPUnauthorized (HTTP 401)
[Wed Nov 07 19:08:24 2012] [error] unable to retrieve service catalog with token
[Wed Nov 07 19:08:24 2012] [error] Traceback (most recent call last):
[Wed Nov 07 19:08:24 2012] [error] File "/usr/lib/python2.7/dist-packages/keystoneclient/v2_0/client.py", line 132, in _extract_service_catalog
[Wed Nov 07 19:08:24 2012] [error] endpoint_type='adminURL')
[Wed Nov 07 19:08:24 2012] [error] File "/usr/lib/python2.7/dist-packages/keystoneclient/service_catalog.py", line 62, in url_for
[Wed Nov 07 19:08:24 2012] [error] raise exceptions.EndpointNotFound('Endpoint not found.')
[Wed Nov 07 19:08:24 2012] [error] EndpointNotFound: Endpoint not found.

and logs from /var/log/glance/api.log are consistent with OP.

Thanks

Hi,

Even I am getting same error
Can anyone help :)

Thanks,
Narsing

I have had a similar issue and tried to nail it down, but after some attempts gave up and made a fresh deployment, which solved the problem.

I am also very new to Openstack and getting a similar error when trying to do the following command from the installation documentation.

sudo glance --os-username=admin --os-password=secretword --os-tenant-name=openstackDemo --os-auth-url=http://192.168.xxx.xxx:5000/v2.0 image-create --name="tty-linux-kernel" --disk-format=aki --container-format=aki < ttylinux-uec-amd64-12.1_2.6.35-22_1-vmlinuz

Request returned failure status.

None

Invalid OpenStack Identity credentials.

sudo tail /var/log/glance/api.log

2012-11-14 06:28:31 19941 ERROR keystone.middleware.auth_token [-] HTTP connection exception: [Errno 111] ECONNREFUSED

2012-11-14 06:28:31 19941 WARNING keystone.middleware.auth_token [-] Authorization failed for token 51dbb4057e924f94a0e3e70d40111481

2012-11-14 06:28:31 19941 INFO keystone.middleware.auth_token [-] Invalid user token - deferring reject downstream

2012-11-14 06:29:44 19941 DEBUG glance.api.middleware.version_negotiation [-] Determining version of request: POST /v1/images Accept: process_request /usr/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:45

2012-11-14 06:29:44 19941 DEBUG glance.api.middleware.version_negotiation [-] Using url versioning process_request /usr/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:58

2012-11-14 06:29:44 19941 DEBUG glance.api.middleware.version_negotiation [-] Matched version: v1 process_request /usr/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:70

2012-11-14 06:29:44 19941 DEBUG glance.api.middleware.version_negotiation [-] new uri /v1/images process_request /usr/lib/python2.7/dist-packages/glance/api/middleware/version_negotiation.py:71

2012-11-14 06:29:44 19941 ERROR keystone.middleware.auth_token [-] HTTP connection exception: [Errno 111] ECONNREFUSED

2012-11-14 06:29:44 19941 WARNING keystone.middleware.auth_token [-] Authorization failed for token 6eae7a79fbcb499ea16bce61e2ae7604

2012-11-14 06:29:44 19941 INFO keystone.middleware.auth_token [-] Invalid user token - deferring reject downstream

I noticed in the instructions it says use tenant-name of demo but the other references in that section show openstackDemo for the tenant name. I've tried both. Any help would be appreciated.

@nico: Probably it will work if I try to use the default names and passwords used in the guide. But in the end I will need to deploy this in production and I will have to use a password stronger than "openstack". I need to understand what all these values are supposed to be and the docs are not very clear on that.

For example, what is the difference of the SERVICE_TOKEN env variable and the admin_token keynots.conf entry? Are they supposed to be the same? If not then where is SERVICE_TOKEN defined?

Have done the tutorial step by step and when I reached the "glance index" step I got the same error. What are we missing?

If I uncomment the "config_file" line in both glance-api.conf and glance-registry.conf it changes the behaviour. Now, instead of throwing that error it shows the table headers and hangs.

It seems the glance registry is looking for the glance-registry-paste.ini configuration file and cannot find it. It seems it's looking in the wrong place?

2012-11-17 15:19:05 28420 DEBUG glance.common.config [-] Loading glance-registry-keystone from /glance-registry-paste.ini load_paste_app /usr/$
2012-11-17 15:19:05 28420 CRITICAL glance [-] [Errno 2] No such file or directory: '/glance-registry-paste.ini'
2012-11-17 15:19:05 28420 TRACE glance Traceback (most recent call last):
2012-11-17 15:19:05 28420 TRACE glance File "/usr/bin/glance-registry", line 51, in <module>
2012-11-17 15:19:05 28420 TRACE glance server.wait()
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 241, in wait
2012-11-17 15:19:05 28420 TRACE glance self.wait_on_children()
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 226, in wait_on_children
2012-11-17 15:19:05 28420 TRACE glance self.run_child()
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 256, in run_child
2012-11-17 15:19:05 28420 TRACE glance self.run_server()
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 275, in run_server
2012-11-17 15:19:05 28420 TRACE glance eventlet.wsgi.server(self.sock, self.app_func(),
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/glance/common/config.py", line 187, in load_paste_app
2012-11-17 15:19:05 28420 TRACE glance app = deploy.loadapp("config:%s" % conf_file, name=app_name)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 247, in loadapp
2012-11-17 15:19:05 28420 TRACE glance return loadobj(APP, uri, name=name, **kw)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 271, in loadobj
2012-11-17 15:19:05 28420 TRACE glance global_conf=global_conf)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 296, in loadcontext
2012-11-17 15:19:05 28420 TRACE glance global_conf=global_conf)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 317, in _loadconfig
2012-11-17 15:19:05 28420 TRACE glance loader = ConfigLoader(path)
2012-11-17 15:19:05 28420 TRACE glance File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 393, in __init__
2012-11-17 15:19:05 28420 TRACE glance with open(filename) as f:
2012-11-17 15:19:05 28420 TRACE glance IOError: [Errno 2] No such file or directory: '/glance-registry-paste.ini'
2012-11-17 15:19:05 28420 TRACE glance

The problem is in the path to glance-registry-paste.ini file.
In config /etc/glance/glance-registry.conf should be the full path to file, i.e /etc/glance/glance-registry-paste.ini instead of just glance-registry-paste.ini.

[paste_deploy]
# Name of the paste configuration file that defines the available pipelines
config_file = /etc/glance/glance-registry-paste.ini

Nice workaround. But that is not definetely not the expected behaviour. Should create bug report?

Could fix the problem in my test-environment by changing

admin_tenant_name = service

into

admin_tenant_name = admin

in the files
/etc/glance/glance-registry-paste.ini
/etc/glance/glance-api-paste.ini

Hope this helps.

@alxspb and @hnkhs:

Guys I tried both your suggestion but I still don't see any light in the tunnel:

# glance index
No handlers could be found for logger "keystoneclient.client"
Invalid user / password (HTTP 401)

I get nothing in the logs even though I did set the 'debug = True' in both glance-registry.conf and glance-api.conf files.

Any other suggestions?

I am getting closer but apparently not close enough:

I get this when i use the admin tenant id:

# glance --os-username admin --os-password novapass --os-tenant-id 54c2477b694048eba9921727f8f8e579 --os-auth-url http:/10.211.55.17/:5000/v2.0/ index
ID Name Disk Format Container Format Size
------------------------------------ ------------------------------ -------------------- -------------------- --------------
Request returned failure status.
None
Invalid OpenStack Identity credentials.

and this when I use the service tenant id:

# glance --os-username admin --os-password novapass --os-tenant-id b380a00d1a454084ad5b10bdcb06cb72 --os-auth-url http://10.211.55.17:5000/v2.0/ index
No handlers could be found for logger "keystoneclient.client"
Invalid tenant (HTTP 401)

Apparently the fisrt command is more"correct" than the latter but still not working. Any other ideas?

Guys I gave up on the official guide. I used the scripts of dimtdv instead:

https://github.com/dimtdv/folsom-single-node/blob/master/README.md

They do not work out of the box. There are some requirements first:

1) Setup folsom repo:

# cat /etc/apt/sources.list.d/folsom.list
# Openstack folsom repositor
deb http://ubuntu-cloud.archive.canonical.com/ubuntu precise-updates/folsom main

2) # apt-get install ntp

/etc/ntp.conf:
server ntp.ubuntu.com iburst
server 127.127.1.0
fudge 127.127.1.0 stratum 10

3) # apt-get install git

4) # git clone https://github.com/dimtdv/folsom-single-node.git

    # cd folsom-single-node.git

5) Setup lvm2

# apt-get install lvm2

Create a volume group named "nova-volumes" (This is optional but recommended in a production environment. If you skip this a normal file will be created to represent the Volume Group pgysical volume)

6) Setup networking as per README.md

7) Run these scripts after you setup stackrc:
# ./install-mysql.sh
# ./install-keystone.sh
# ./init-keystone.sh
# ./install-glance.sh
# ./init-glance.sh
# ./install-nova.sh
# ./install-dash.sh
# ./restart-nova.sh

8) mkdir -p /var/lib/dash/.blackhole

9) login ar http://youserver.dom/horizon

Enjoy!

According to hnkhs (hnkhs) 's comment #11 , It works in my test env :)

If you remove:
flavor = keystone

from the files:
/etc/glance/glance-api.conf
and
/etc/glance/glance-registry.conf

then restart (service glance-api restart && service glance-registry restart) and rebuild the DB (glance-manage db_sync) it will work well.

Julian -- you don't want to remove keystone. I think the real problem here is outlined at https://bugs.launchpad.net/nova/+bug/1065211

In short, you need to make sure that all the usernames, tenant names, and passwords match between *ALL* of your OpenStack configuration files. You need this in all the respective *.conf files, as well as all the respective *-paste.ini files. If your username/tenant name/password in one place is something like admin/admin/openstack and it is shown as %ADMIN_USER%/%ADMIN_TENANT%/%ADMIN_PASSWORD% in a different file, then that won't work.

Had the same issue.
In my case It was a wrong password in the admin_password settings line for both files
/etc/glance/glance-api.conf
and
/etc/glance/glance-registry.conf