Keystone v3 auth error

0
votes

I am following keystone ocata installation guide https://docs.openstack.org/ocata/install-guide-ubuntu/keystone-install.html

Post installation, I am able to get the user list using openstack user list command.

openstack --os-auth-url="[keystone_url]" --os-identity-api-version="3" --os-password="mypwd123" --os-project-domain-name="Default" --os-project-name="admin" --os-username="admin" --os-user-domain-name="Default" user list

Outputs the User list properly.

But when I take auth token with below command :

curl -si -d '{"auth": {"identity": {"methods": ["password" ],"password": {"user": {"domain": {"id": "default" },"name": "admin","password": "mypwd123" }}}}}' -H "Content-type: application/json" [keystone_url]/v3/auth/tokens

and then use the token from the output of above command in below command to list the users:

curl -s -H "X-Auth-Token: gAAAAABZlAN0NPibgBLcUW3aAcgNYIGaRH98M7w6b4tRliXC4LQB4dr5cGxTJmF5-iKvY2U_AU3c71uJUqgaQJP-iyURCBzBqYHlHtTGqofzzVndVncBRU5z4iLbArBdbJCI2Wd-1No9C0cq4iWB6RBNa9wqXWm-Gw" "[keystone_url]/v3/users" | python -mjson.tool

Returns :

{ "error": { "code": 403, "message": "You are not authorized to perform the requested action: identity:list_users.", "title": "Forbidden" } }

Any help would be appreciated.

Thanks,

Viral

1
listauthenticationkeystone

1 Answers

0
votes

because list users need token with scopeļ¼Œ you should add scope for query, like this:

curl -i  http://ip:5000/v3/auth/tokens -H "Content-
Type: application/json" -d '
{
"auth": {
    "identity": {
        "methods": [
            "password"
        ],
        "password": {
            "user": {
                "name": "admin",
                "domain": {
                    "name": "Default"
                },
                "password": "secret"
            }
        }
    },
    "scope": {
        "domain": {
            "id": "default"
        }
    }
}
}'

then use X-Subject-Token to query users. See the official documentation for details.https://docs.openstack.org/keystone/pike/api_curl_examples.html#tokens