Need Rally deployment create support on domain_id or domain_name in order to support keystone v3 test (which needs domain scoped token). The current project scoped token only works in service API but not keystone v3 API (DTUG domain, user, group...).

NOTE:
Before move on keystone v3 test, we need to get domain scoped token work in rally.
Project scoped token is only for service operation but not for keystone domain/user/group/project/role/... DTUG.

For example, if source the project scoped token that rally config support at the current phase, role list failed with the same 401 error:
$ . ~/.rally/openrc
OS_REGION_NAME=regionOne
OS_USER_DOMAIN_NAME=Default
OS_PROJECT_NAME=default
OS_IDENTITY_API_VERSION=3
OS_PASSWORD=admin
OS_AUTH_URL=https://localhost:5000/v3/
OS_USERNAME=admin
OS_CACERT=/usr/local/share/ca-certificates/ephemeralca-cacert.crt
OS_PROJECT_DOMAIN_NAME=Default
cetest@cer305n0016:~/ysong/rally/environments$ openstack role list
ERROR: openstack The request you have made requires authentication. (HTTP 401)

Seems like all the work are in Rally. Can you add more info what change is needed from Keystone to support domain scoped testing in Rally?

LinHua,
I think keystone works fine with domain scoped token for keystone v3 APIs, like createDomain, createUser, createRole.
But Rally only supports project scoped token.
The better choice may be have Rally support domain scoped token; but not have keystone support project scoped token in keystoneAPIs (createDomain, createUser, createRole). At this point, keystone don't need to do anything if Rally can fix this issue. Your thoughts?

Thanks!
Apal

Seems we need to modify osclients [0] and/or keystone wrappers [1] in rally.

But first of all we need to modify Endpoint class [2]

[0] https://github.com/openstack/rally/blob/master/rally/osclients.py#L58-L70
[1] https://github.com/openstack/rally/blob/master/rally/benchmark/wrappers/keystone.py#L147
[2] https://github.com/openstack/rally/blob/master/rally/objects/endpoint.py

sounds like this is a rally issue, marking keystone as invalid

Please, specify both project_name and domain_name. It should work for you on latest Rally

Hi Andrey,

Could you please confirm that specifying both 'project_name' and 'domain_name' works with Keystone V3 API and current Rally/master branch?

I can do 'rally deployment create' with both options specified, but 'rally deployment check' results in a traceback from Keystone-Client in such case:

[root@hannibal openstack_rally]# rally deployment check
Command failed, please check log for more info
2016-03-07 15:06:30.859 29419 CRITICAL rally [-] AuthorizationFailure: Authentication cannot be scoped to multiple targets. Pick one of: project, domain, trust or unscoped
2016-03-07 15:06:30.859 29419 ERROR rally Traceback (most recent call last):
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/bin/rally", line 10, in <module>
2016-03-07 15:06:30.859 29419 ERROR rally sys.exit(main())
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/cli/main.py", line 40, in main
2016-03-07 15:06:30.859 29419 ERROR rally return cliutils.run(sys.argv, categories)
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/cli/cliutils.py", line 560, in run
2016-03-07 15:06:30.859 29419 ERROR rally ret = fn(*fn_args, **fn_kwargs)
2016-03-07 15:06:30.859 29419 ERROR rally File "<string>", line 2, in check
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/cli/envutils.py", line 67, in default_from_global
2016-03-07 15:06:30.859 29419 ERROR rally return f(*args, **kwargs)
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/cli/commands/deployment.py", line 226, in check
2016-03-07 15:06:30.859 29419 ERROR rally services = api.Deployment.check(deployment)
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/api.py", line 139, in check
2016-03-07 15:06:30.859 29419 ERROR rally services = cls.service_list(deployment)
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/api.py", line 123, in service_list
2016-03-07 15:06:30.859 29419 ERROR rally return clients.services()
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/osclients.py", line 721, in services
2016-03-07 15:06:30.859 29419 ERROR rally ks = self.keystone()
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/osclients.py", line 203, in __call__
2016-03-07 15:06:30.859 29419 ERROR rally self.cache[key] = self.create_client(*args, **kwargs)
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/osclients.py", line 256, in create_client
2016-03-07 15:06:30.859 29419 ERROR rally return self._create_keystone_client(kw)
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/rally/osclients.py", line 242, in _create_keystone_client
2016-03-07 15:06:30.859 29419 ERROR rally auth_ref = auth.get_access(session)
2016-03-07 15:06:30.859 29419 ERROR rally File "/usr/lib/python2.7/site-packages/keystoneclient/auth/identity/base.py", line 240, in get_access
2016-03-07 15:06:30.859 29419 ERROR rally self.auth_ref = ...

Hi Dmitry,
It looks like we should have stricter config validation.
Next config works for me in case of Keystone v3:

{
    "admin": {
        "admin_domain_name": "Default",
        "password": "password",
        "project_name": "admin",
        "user_domain_name": "Default",
        "username": "admin"
    },
    "auth_url": "http://host_name:5000/v3/",
    "endpoint_type": "public",
    "https_cacert": "",
    "https_insecure": false,
    "type": "ExistingCloud"
}

Hi Andrey,
The above config is with 'project scope' and not with 'domain scope', hence it works.

Agree with Dmitry that we can not simultaneously scope a token to a project and domain.

Is anybody working on this issue or is there a fix available that we can pull?

Thanks.

Hello,

    Is anyone working on this issue? If not I might be able to help.

Let me know, thanks.

Michael

@Michael: I do not know anyone how work on this issue now. I'll be really appreciate for any help

Fix proposed to branch: master
Review: https://review.openstack.org/337115

Is this going to get an update soon?

Not being able to run tests because of this limitation is kind of a big deal if the cloud environment has multiple domains.

Admin needs to be able create the tenants and the users

Users need to be able to create the networks, instances, volumes, etc.

Without this, can't really do anything, unless someone has documentation they'd like to share!!!

I am not currently working on this issue..

Hi,

I met below errors when trying to use keystone v3 endpoint using rally 0.7.0. Could someone help me how to fix or workaround these errors? I plan to use rally benchmark test. Thanks!

Error 1:Here is my rally deploy file:
cat rally_deploy.json
{
  "type": "ExistingCloud",
  "auth_url": "http://**.**.**.**:35357/v3/",
  "region_name": "nova",
  "admin": {
    "username": "admin",
    "password": "admin",
    "project_name": "admin",
    "project_domain_name": "Default",
    "user_domain_name": "Default"
  },
  "users": [
    {
      "username": "tenant4_user1",
      "password": "***",
      "project_name": "tenant4"
    },
    {
      "username": "tenant3_user1",
      "password": "***",
      "project_name": "tenant3"
    },
    {
      "username": "tenant2_user1",
      "password": "***",
      "project_name": "tenant2"
    },
    {
      "username": "tenant1_user1",
      "password": "**",
      "project_name": "tenant1"
    }
  ],
  "https_insecure": True,
  "https_cacert": ""
}
rally deployment create succeeded, but rally deployment check failed as below.
rally@e2bfc2794a2a:~$ rally deployment check
2016-11-22 06:13:19.501 475 CRITICAL rally [-] BadRequest: Expecting to find domain in project - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error. (HTTP 400) (Request-ID: req-6b4902bc-5e8e-4b5c-8dee-17bf75990b3f)
2016-11-22 06:13:19.501 475 ERROR rally Traceback (most recent call last):
2016-11-22 06:13:19.501 475 ERROR rally File "/usr/local/bin/rally", line 10, in <module>
2016-11-22 06:13:19.501 475 ERROR rally sys.exit(main())
2016-11-22 06:13:19.501 475 ERROR rally File "/usr/local/lib/python2.7/dist-packages/rally/cli/main.py", line 40, in main
2016-11-22 06:13:19.501 475 ERROR rally return cliutils.run(sys.argv, categories)
2016-11-22 06:13:19.501 475 ERROR rally File "/usr/local/lib/python2.7/dist-packages/rally/cli/cliutils.py", line 581, in run
2016-11-22 06:13:19.501 475 ERROR rally ret = fn(*fn_args, **fn_kwargs)
2016-11-22 06:13:19.501 475 ERROR rally File "<decorator-gen-17>", line 2, in check
2016-11-22 06:13:19.501 475 ERROR rally File "/usr/local/lib/python2.7/dist-packages/rally/cli/envutils.py", line 67, in default_from_global
2016-11-22 06:13:19.501 475 ERROR rally return f(*args, **kwargs)
2016-11-22 06:13:19.501 475 ERROR rally File "/usr/local/lib/python2.7/dist-packages/rally/cli/commands/deployment.py", line 227, in check
2016-11-22 06:13:19.501 475 ERROR rally services = api.Deployment.check(deployment)
2016-11-22 06:13:19.501 475 ERROR rally File "/usr/local/lib/python2.7/dist-packages/rally/api.py", line 144, in check
2016-11-22 06:13:19.501 475 ERROR rally osclients.Clients(objects.Credential(**endpoint_dict)).keystone()
2016-11-22 06:13:19.501 475 ERROR rally File "/usr/local/lib/python2.7/dist-packages/rally/osclients.py", line 208, in __call__
2016-11-22 06:13:19.501 475 ERROR rally self.cache[key] = self.create_client(*args, **kwargs)
2016-11-22 06:13:19.501 475 ERROR rally File "/usr/local/lib/python2.7/dist-packages/rally/osclients.py", line 323, in create_client
2016-11...

So I was able to get it to work, but there needs to be and endpoint_type in the config and each user needs user_domain_name, project_domain_name, and project_name, just like admin.

Also, I used port 5000 instead of 35357.

But, this doesn't solve the problem for creating the projects/users tests, and existing users *have* to be created for this purpose.

Would be nice if rally did the following:

For rally deployment check:
* Have to run with project-scoped

For user and project creation
* Check for a domain_name in the admin config
* If not there, fail if the auth_url uses "V3"
* If it is there, then switch to domain-scoped

Problem would be solved at that point. Projects/Users would run under the domain-scoped token automatically, while instances, networks, volumes, etc. would use project_scoped tokens.

My deployment is created and checked using this json file.

{
    "type": "ExistingCloud",
    "auth_url": "http://192.168.90.200:5000/v3/",
    "region_name": "RegionOne",
    "endpoint_type": "public",
    "admin": {
        "username": "cloud_admin",
        "password": "XXXXXX",
        "user_domain_name": "admin_domain",
        "project_name": "admin",
        "project_domain_name": "admin_domain"
    },
    "https_insecure": false,
    "https_cacert": ""
}

bu i cant run the user /projects creation task, isnt there still a way to do this ?
best.

Any chance we can get an update on this?

Without the ability to create projects (i.e. domain-scope), raising the concurrency level on a scenario and being able to test things is ugly, if not impossible.

I don't want to have to create 100 different users to just use for rally, and there is no guarantee it works correctly.

Please advise. This has been a long standing problem that while I'll concede, could be improved from the auth side, Rally should account for!