Keystone redux Ubuntu 12.04 B1 'Client' object has no attribute 'service_catalog'

WRT last question: is glance configured to use keystone auth i.e.have in /etc/glance/glance*.conf
[paste_deploy]
flavor = keystone

and in /etc/glance/glance*paste.ini
[filter:authtoken]
...
admin_token = 999888777666

glance*.conf has paste_deploy in and the paste file has the correct token and service references.

I've just done the api as a paste, but registry is similarly setup: http://paste.openstack.org/show/7802/

Other snippets:
I've stopped keystone (stop keystone) then ran keystone-all to get a non-daemon debug view.

The details are here http://paste.openstack.org/show/7804/

As a comparison I've done a call that works (keystone user-list) to see what that looks like. This is in http://paste.openstack.org/show/7823/

What I've seen is a subtle difference:

In 7804 note arg_dict: with the token (and this fails)

(root): 2012-03-09 14:20:44,806 DEBUG wsgi __call__ arg_dict: {'token_id': u'999888777666'}
(root): 2012-03-09 14:20:44,808 WARNING wsgi __call__ Could not find token: 999888777666
(root): 2012-03-09 14:20:44,808 DEBUG wsgi __call__ ******************** RESPONSE HEADERS ********************
(root): 2012-03-09 14:20:44,808 DEBUG wsgi __call__ Content-Type = application/json
(root): 2012-03-09 14:20:44,808 DEBUG wsgi __call__ Vary = X-Auth-Token
(root): 2012-03-09 14:20:44,808 DEBUG wsgi __call__ Content-Length = 95
(root): 2012-03-09 14:20:44,808 DEBUG wsgi __call__
(root): 2012-03-09 14:20:44,809 DEBUG wsgi print_generator ******************** RESPONSE BODY ********************
(root): 2012-03-09 14:20:44,809 DEBUG wsgi print_generator {"error": {"message": "Could not find token: 999888777666", "code": 404, "title": "Not Found"}}

(eventlet.wsgi.server): 2012-03-09 14:20:44,809 DEBUG wsgi write 172.15.0.2 - - [09/Mar/2012 14:20:44] "GET /v2.0/tokens/999888777666 HTTP/1.1" 404 249 0.006314

where as 7823 which works doesn't pass the token to arg_dict

(root): 2012-03-09 15:01:00,606 DEBUG wsgi __call__ arg_dict: {}
(root): 2012-03-09 15:01:00,624 DEBUG wsgi __call__ ******************** RESPONSE HEADERS ********************
(root): 2012-03-09 15:01:00,624 DEBUG wsgi __call__ Content-Type = application/json
(root): 2012-03-09 15:01:00,624 DEBUG wsgi __call__ Vary = X-Auth-Token
(root): 2012-03-09 15:01:00,624 DEBUG wsgi __call__ Content-Length = 478
(root): 2012-03-09 15:01:00,624 DEBUG wsgi __call__
(root): 2012-03-09 15:01:00,625 DEBUG wsgi print_generator ******************** RESPONSE BODY ********************
... snip ...

(eventlet.wsgi.server): 2012-03-09 15:01:00,625 DEBUG wsgi write 172.15.0.2 - - [09/Mar/2012 15:01:00] "GET /v2.0//users?fresh=1331305260.58 HTTP/1.1" 200 626 0.035609

Kevin-

As I mentioned on the mailing list, it still looks like you're mixing your keystone admin environment with the client environment. Any OS_* user credentials or credentials passed as arguments to keystone client are disregarded with SERVICE_ENDPOINT and SERVICE_TOKEN set in the environment. See: http://paste.ubuntu.com/876375/

Regarding glance, you now need to configure a service tenant and credentials for glance in keystone and in glance's paste configs (same is true for nova and swift). Please see the devstack keystone_data.sh script

Hi Adam,
I had 2 issues - but mainly that I didn't realise that I had SERVICE_ENDPOINT and SERVICE_TOKEN set when trying the auth method - user error. Bit misleading though that - its not mentioned anywhere that this is overriding, but in hindsight it has to make sense.

The other was that I had my endpoints in my database for swift and nova with URLS like AUTH_%tenant_id%... it broke on the %t parsing.

I have a "more working" set up now (just need to clarify a few things). It probably explains Glance couldn't be found too.

I reckon this might be user misunderstanding (and that's me being kind to myself!).
Let me check this again on Monday and I'll update any scripts, docs I've done and then look at closing this off.

Cheers! I will be keeping a tally of people I owe a beer to.

Kev

Marking this bug as invalid since it seems that Kevin has found a configuration solution

I'd argue that this is a bug still - admittedly not one that requires a fix in time for Essex.

"Any OS_* user credentials or credentials passed as arguments to keystone client are disregarded with SERVICE_ENDPOINT and SERVICE_TOKEN set in the environment. See: http://paste.ubuntu.com/876375/"

Environment variables shouldn't override the command line when the command line options are in context with what the user wants to achieve. This is a user interface issue.

https://github.com/openstack/python-keystoneclient/commit/b94c6c063ef802abd42678b7a1725102762a5acb

Thanks Alan (I'm not sure why this bug wasn't automatically updated?)

Ah, wrong project -- disregard! Thanks again.