Keystone should provide more verbose messages in case of 401 and 403 errors

Bug #1625120 reported by Timur Nurlygayanov
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Fix Released
Medium
David Stanek

Bug Description

On many our environments we can see 401 and 403 errors during the execution of Tempest tests, but after the execution of the tests we can't debug the issue because we don't have any information about 401 errors in keystone logs. In the same time we can have many different reasons why we got 401 error, and in the case of Tempest we sure that we use correct credentials.

We need to have an ability to get the information about the reasons of 401/403 errors in Keystone, at least write short human-readable messages in debug mode, so we will be able to understand the line of code where the issue happened and try to guess how we can fix it.

Changed in keystone:
assignee: nobody → Alexander Makarov (amakarov)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.openstack.org/372433

Changed in keystone:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (stable/mitaka)

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/372497

Revision history for this message
Steve Martinelli (stevemar) wrote :

This is generally true, and we could and should do a better job of explaining what went wrong.

Changed in keystone:
importance: Undecided → Medium
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to keystone (master)

Related fix proposed to branch: master
Review: https://review.openstack.org/377792

Changed in keystone:
assignee: Alexander Makarov (amakarov) → Steve Martinelli (stevemar)
Changed in keystone:
assignee: Steve Martinelli (stevemar) → Dave Chen (wei-d-chen)
Dave Chen (wei-d-chen)
Changed in keystone:
assignee: Dave Chen (wei-d-chen) → Alexander Makarov (amakarov)
Changed in keystone:
milestone: none → ocata-2
Changed in keystone:
assignee: Alexander Makarov (amakarov) → David Stanek (dstanek)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (master)

Reviewed: https://review.openstack.org/372433
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=5ae4ca12a75f7463623293944d5136fe36020ab4
Submitter: Jenkins
Branch: master

commit 5ae4ca12a75f7463623293944d5136fe36020ab4
Author: Alexander Makarov <email address hidden>
Date: Mon Sep 19 15:01:31 2016 +0300

    Verbose 401/403 debug responses

    Add text to raised Unauthorized and Forbidden exception to show the client
    what happened.

    Change-Id: Id5de16d446cf4fdacfefdad0523e84821e4fd72c
    Closes-Bug: 1625120

Changed in keystone:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on keystone (stable/mitaka)

Change abandoned by Steve Martinelli (<email address hidden>) on branch: stable/mitaka
Review: https://review.openstack.org/372497
Reason: no reason to backport this to mitaka, maybe to newton?

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/keystone 11.0.0.0b2

This issue was fixed in the openstack/keystone 11.0.0.0b2 development milestone.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on keystone (master)

Change abandoned by Colleen Murphy (<email address hidden>) on branch: master
Review: https://review.openstack.org/377792
Reason: We don't translate logs any more, and since there was no response to Lance's and Samuel's requests for clarity I think this is no longer being worked on, so I'm administratively abandoning it. Feel free to restore if you think I've made a mistake.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.