Swift CLI can't access to keystone with self signed certification

Bug #1077869 reported by You Yamagata
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
python-swiftclient
Fix Released
Undecided
You Yamagata

Bug Description

OS ver. Ubuntu 12.04.1 LTS
python-swiftclient 1:1.2.0-0ubuntu2~cloud0
python-keystoneclient 1:0.1.3-0ubuntu1~cloud0

I am building a swift cluster with keystone using CloudArchive and
having a trouble on keystone auth with self signed certification.

I built a keystone server with ssl reverse proxy by apache.
The SSL certification is self-signed one.
When I tried to access swift server via swift CLI, an error happened as follows.

>swift -V 2 -A https://b1auth/v2.0 -U demo:demo -K XXXXX stat

Traceback (most recent call last):
  File "/usr/bin/swift", line 1190, in <module>
    error_queue)
  File "/usr/bin/swift", line 567, in st_stat
    headers = conn.head_account()
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 1000, in head_account
    return self._retry(None, head_account)
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 969, in _retry
    self.url, self.token = self.get_auth()
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 957, in get_auth
    os_options=self.os_options)
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 302, in get_auth
    key, kwargs['os_options'])
  File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 244, in get_keystone
client_2_0
    auth_url=auth_url)
  File "/usr/lib/python2.7/dist-packages/keystoneclient/v2_0/client.py", line 80, in __init__
    self.authenticate()
  File "/usr/lib/python2.7/dist-packages/keystoneclient/v2_0/client.py", line 110, in auth
enticate
    "%s" % e)
keystoneclient.exceptions.AuthorizationFailure: Authorization Failed: Unable to communicat
e with identity service: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER
_CERTIFICATE:certificate verify failed. (HTTP 400)

When I accessed to keystone directly without SSL as follows, swift CLI worked well.

>swift -V 2 -A http://b1auth:5000/v2.0 -U demo:demo -K XXXXX stat

   Account: AUTH_xxxxxxxxxxxxxxxxxxxxxxxx
Containers: 2
   Objects: 1
     Bytes: 859
X-Timestamp: 1352458813.40642
X-Trans-Id: txe5b3ac1dc0594b6c8e5c2095663db10c
Accept-Ranges: bytes

I guess that the cause is swift CLI doesn't support --insecure option.
As a trial, I modified swiftclient/client.py as follows.
In this case CLI worked well.

> diff -C 5 client.py client.py.fix
*** client.py 2012-09-13 05:31:06.000000000 +0900
--- client.py.fix 2012-11-12 18:11:37.948722753 +0900
***************
*** 239,248 ****
--- 239,249 ----
      from keystoneclient import exceptions
      _ksclient = ksclient.Client(username=user,
                                  password=key,
                                  tenant_name=os_options.get('tenant_name'),
                                  tenant_id=os_options.get('tenant_id'),
+ insecure=True,
                                  auth_url=auth_url)
      service_type = os_options.get('service_type') or 'object-store'
      endpoint_type = os_options.get('endpoint_type') or 'publicURL'
      try:
          endpoint = _ksclient.service_catalog.url_for(

Changed in python-swiftclient:
assignee: nobody → You Yamagata (y-yamagata)
Changed in python-swiftclient:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to python-swiftclient (master)

Fix proposed to branch: master
Review: https://review.openstack.org/17524

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-swiftclient (master)

Reviewed: https://review.openstack.org/17524
Committed: http://github.com/openstack/python-swiftclient/commit/6a4dc039ffece61ee8148f5263b22f65d1a6e729
Submitter: Jenkins
Branch: master

commit 6a4dc039ffece61ee8148f5263b22f65d1a6e729
Author: You Yamagata <email address hidden>
Date: Wed Dec 5 13:18:27 2012 +0900

    Add --insecure option to fix bug #1077869

    If enable this option , swift CLI is allowed to access a keystone
    server with self signed certificate.

    Change-Id: I5e219fe875b246b68ac51a077e7ff15e95463adf

Changed in python-swiftclient:
status: In Progress → Fix Committed
Changed in python-swiftclient:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.