openstack and kerberos hits to 401 [closed]












0














I have integrated the openstack and kerberos using the link provided here : https://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/



It is successfully installed and I am able to perform kinit authentication successfully,



kinit {userId}


But when I try to perform 'openstack token issue' / any command using openstack



I get 401 unauthorized exception like below,



Auth plugin v3kerberos selected

auth_config_hook(): {'auth_type': 'v3kerberos', 'beta_command': False, u'compute_api_version': u'2', 'key': None, u'database_api_version': u'1.0', 'metrics_api_version': '1', u'metering_api_version': u'2', 'auth_url': 'http://openstack.companyipasub.com:5000/krb/v3/', 'additional_user_agent': [('osc-lib', '1.11.1')], u'network_api_version': u'2', u'message': u'', u'image_format': u'qcow2', 'networks': , u'image_api_version': u'2', u'clustering_api_version': u'1', 'verify': True, 'timing': False, u'dns_api_version': '2', u'object_store_api_version': u'1', u'status': u'active', u'container_infra_api_version': '1', 'verbose_level': 3, 'region_name': '', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {}, 'default_domain': 'default', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', u'orchestration_api_version': '1', u'interface': None, u'application_catalog_api_version': u'1', 'cacert': None, u'key_manager_api_version': '1', u'workflow_api_version': u'2', u'baremetal_status_code_retries': '5', u'identity_api_version': '3', u'volume_api_version': u'2', 'deferred_help': False, 'cert': None, u'secgroup_source': u'neutron', 'alarming_api_version': '2', u'container_api_version': u'1', u'block_storage_api_version': u'2', u'disable_vendor_agent': {}}

Using auth plugin: v3kerberos

Using parameters {'auth_url': 'http://openstack.companyipasub.com:5000/krb/v3/'}

Get auth_ref

Making authentication request to http://openstack.companyipasub.com:5000/krb/v3/auth/tokens

Starting new HTTP connection (1): openstack.companyipasub.com

http://openstack.companyipasub.com:5000 "POST /krb/v3/auth/tokens HTTP/1.1" 401 381

handle_401(): Handling: 401

!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################



%%%%%%%%%%%%%%%%%RESPONSE HEADER%%%%%%%%%

openstack.companyipasub.com

HTTP

10

#####################BEFORE NEGOTATION################

1

openstack.companyipasub.com

<PyCObject object at 0x7feeb1f2aeb8>

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<html><head>

<title>401 Unauthorized</title>

</head><body>

<h1>Unauthorized</h1>

<p>This server could not verify that you

are authorized to access the document

requested.  Either you supplied the wrong

credentials (e.g., bad password), or your

browser doesn't understand how to supply

the credentials required.</p>

</body></html>



!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################



authenticate_user(): Authorization header: Negotiate YIIEsQYJKoZIhvcSAQICAQBuggSgMIIEnKADAgEFoQMCAQ6iBwMFACAAAACjggOuYYIDqjCCA6agAwIBBaEQGw5NU1lTSVBBUUNTLkNPTaIrMCmgAwIBA6EiMCAbBEhUVFAbGG9wZW5zdGFjay5tc3lzaXBhcWNzLmNvbaOCA14wggNaoAMCARKhAwIBAaKCA0wEggNIEYkxuhR67BYR0AiQZNcdkcjw9n9Whu15PAx7sQeAlMl0RTKqHJlMhL/djZTPJoaIJ6AWUiLovambzqA9SUngU5wEuYlwlB+h8nvxVWuqziEsukaWBWErToIKnA6R2bds4aoUCtfEElJP+kAFgyf+biqCNIzWJpKrYlMgX9gZqqAkL+uzdWMyClEAABODajw5hg8BmTLOJ5xY/BsYh2eKFn3S9y150OV1RKf5Vct2WpVQNbz/1h7Uu4iNngfTx3rvYQWg1AarkL76HACXiqu07dlmZilgf29umyy9GtNYsrJYNO0Fl1cejzOsGotxFh1Wufg5RJ3NMgHaQ477elmixsDnLC1eUtGmP4tmdpMFFoFjMi9pusdWBnsRBWK5VpJgJsSZIMNcxMMLT4CAEM5/nTo7I8ZDtrO828IhFeity4gYZeFcMZpcO9pGKL70ruWaVh8QTV9E/7DakcTAJ6eMYmTzU7mSnT8rZbA9CVRpKwU2mF3osZfWIPdmRSjM9qR540Xkj39CUaZSf2xRIyFfLPQuyQ/tKIeQH6lrO2hKIUXqmnUw5OzJBaE+JfTuAuIcnGhfA9VESN3Ymmx71SSvRLpYwHZXEWRHo2G32iyGW6pL3pf32N72oL5odlz2a8FOzSwV4vhnOHjeB0wVymmLht5BIMy5xV+UjYNomolMXLS1vrd20aI5vXpoQZNTd5ANx+7PjkXuZSxkadxFcEJQzCTwKRs0DhF6qnsVBL5t9WjiCxkUqFNQ867ZWefDW9ZkrMbTdgJ09O94an1VTNETkUFs8feQcevYXJN87dM6tp6wMFQB51zoCaF5DlHzNtwUMtv0kD0NTILULQ9jy7N2797a16FR8eueaS0YW9troP263zGjsXGP6hu1pljDCS4SLXfA5M4fLNjheOMkqrFNyHty83jEuZaNKnjKip9KVfV02YoA/r8T7ybTXSQYEohLfwIrMqL4QgjRqlb1w9R5eaHjJZ+3N2bMqdM6i5XrD4FYOw71paIQ1KDaYWVhDYzDgporDKZdKeTjGnKZjXqOMu2NMbxQCqgRl2ffRUQqYHVlr0K+H+vLyTM1hMQYQNgTOKJzmc2X4blSH0NNmXkH4SD8WwyKrRR/pIHUMIHRoAMCARKigckEgcZ1btIWWLebFDMojIrDaSja+mlF5zhAAISr8Xs8ngjbHtv3cp/L8o2LzovHGsHLlyEOFYOk8yA7fIbJ0bdqeEZ0AGn5Y9vpUhTBAOIRt7n5Ksx4MKNCjOxeoa2m2UfUNtbMgcPgN8VNZ9Z/nYvUZW9Vyd4KbPKz7+3yrKArkjz7Q47XTRyZt49eWlThhryZT2c941m6RlP0NlMYE1iA8HZfU+hpE9ZrM4QB9rjaF3YCzNriWCW8mgpyHQC/OyPgBo6Krqe3HWc=

http://openstack.companyipasub.com:5000 "POST /krb/v3/auth/tokens HTTP/1.1" 401 114

authenticate_user(): returning <Response [401]>

handle_401(): returning <Response [401]>

handle_response(): returning <Response [401]>

handle_response() has seen 0 401 responses

handle_401(): Handling: 401

!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################

YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRv/cBxSains0m+hfCjXhwcg/eStoasDfYiwF56vheZT9t7EVelUjfaXEtcel9E7YShc7WtbIW73NnsSM/7h8yKsqWEGwDnnSe063SnuAMW7xK0i44q3j1UkvPF7E00wF3dPzooeDxZT2Ztqc4kQ5xU

%%%%%%%%%%%%%%%%%RESPONSE HEADER%%%%%%%%%

openstack.companyipasub.com

HTTP

10

#####################BEFORE NEGOTATION################

1

openstack.companyipasub.com

<PyCObject object at 0x7feeb1f2af58>

{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}

!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################

YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRv/cBxSains0m+hfCjXhwcg/eStoasDfYiwF56vheZT9t7EVelUjfaXEtcel9E7YShc7WtbIW73NnsSM/7h8yKsqWEGwDnnSe063SnuAMW7xK0i44q3j1UkvPF7E00wF3dPzooeDxZT2Ztqc4kQ5xU

generate_request_header(): authGSSClientStep() failed:

Traceback (most recent call last):

  File "/usr/lib/python2.7/site-packages/requests_kerberos/kerberos_.py", line 136, in generate_request_header

    _negotiate_value(response))

GSSError: (('Invalid token was supplied', 589824), ('Success', 100001))

(('Invalid token was supplied', 589824), ('Success', 100001))

Traceback (most recent call last):

  File "/usr/lib/python2.7/site-packages/requests_kerberos/kerberos_.py", line 136, in generate_request_header

    _negotiate_value(response))

GSSError: (('Invalid token was supplied', 589824), ('Success', 100001))

handle_401(): returning <Response [401]>

handle_response(): returning <Response [401]>

handle_response() has seen 1 401 responses

handle_response(): returning 401 <Response [401]>

Request returned failure status: 401

The request you have made requires authentication. (HTTP 401) (Request-ID: req-1f34993d-e869-491d-be4d-fc756f081beb)

clean_up IssueToken: The request you have made requires authentication. (HTTP 401) (Request-ID: req-1f34993d-e869-491d-be4d-fc756f081beb)

END return value: 1


Could someone help me with this please?



Thanks,

Harry






authentication centos kerberos openstack







share|improve this question













closed as off-topic by Martijn Pieters♦ Jan 2 at 8:44


This question appears to be off-topic. The users who voted to close gave this specific reason:


  • "Questions seeking debugging help ("why isn't this code working?") must include the desired behavior, a specific problem or error and the shortest code necessary to reproduce it in the question itself. Questions without a clear problem statement are not useful to other readers. See: How to create a Minimal, Complete, and Verifiable example." – Martijn Pieters

If this question can be reworded to fit the rules in the help center, please edit the question.


















    0














    I have integrated the openstack and kerberos using the link provided here : https://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/



    It is successfully installed and I am able to perform kinit authentication successfully,



    kinit {userId}


    But when I try to perform 'openstack token issue' / any command using openstack



    I get 401 unauthorized exception like below,



    Auth plugin v3kerberos selected
    
auth_config_hook(): {'auth_type': 'v3kerberos', 'beta_command': False, u'compute_api_version': u'2', 'key': None, u'database_api_version': u'1.0', 'metrics_api_version': '1', u'metering_api_version': u'2', 'auth_url': 'http://openstack.companyipasub.com:5000/krb/v3/', 'additional_user_agent': [('osc-lib', '1.11.1')], u'network_api_version': u'2', u'message': u'', u'image_format': u'qcow2', 'networks': , u'image_api_version': u'2', u'clustering_api_version': u'1', 'verify': True, 'timing': False, u'dns_api_version': '2', u'object_store_api_version': u'1', u'status': u'active', u'container_infra_api_version': '1', 'verbose_level': 3, 'region_name': '', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {}, 'default_domain': 'default', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', u'orchestration_api_version': '1', u'interface': None, u'application_catalog_api_version': u'1', 'cacert': None, u'key_manager_api_version': '1', u'workflow_api_version': u'2', u'baremetal_status_code_retries': '5', u'identity_api_version': '3', u'volume_api_version': u'2', 'deferred_help': False, 'cert': None, u'secgroup_source': u'neutron', 'alarming_api_version': '2', u'container_api_version': u'1', u'block_storage_api_version': u'2', u'disable_vendor_agent': {}}
    
Using auth plugin: v3kerberos
    
Using parameters {'auth_url': 'http://openstack.companyipasub.com:5000/krb/v3/'}
    
Get auth_ref
    
Making authentication request to http://openstack.companyipasub.com:5000/krb/v3/auth/tokens
    
Starting new HTTP connection (1): openstack.companyipasub.com
    
http://openstack.companyipasub.com:5000 "POST /krb/v3/auth/tokens HTTP/1.1" 401 381
    
handle_401(): Handling: 401
    
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
    

    
%%%%%%%%%%%%%%%%%RESPONSE HEADER%%%%%%%%%
    
openstack.companyipasub.com
    
HTTP
    
10
    
#####################BEFORE NEGOTATION################
    
1
    
openstack.companyipasub.com
    
<PyCObject object at 0x7feeb1f2aeb8>
    
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
    
<html><head>
    
<title>401 Unauthorized</title>
    
</head><body>
    
<h1>Unauthorized</h1>
    
<p>This server could not verify that you
    
are authorized to access the document
    
requested.  Either you supplied the wrong
    
credentials (e.g., bad password), or your
    
browser doesn't understand how to supply
    
the credentials required.</p>
    
</body></html>
    

    
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
    

    
authenticate_user(): Authorization header: Negotiate YIIEsQYJKoZIhvcSAQICAQBuggSgMIIEnKADAgEFoQMCAQ6iBwMFACAAAACjggOuYYIDqjCCA6agAwIBBaEQGw5NU1lTSVBBUUNTLkNPTaIrMCmgAwIBA6EiMCAbBEhUVFAbGG9wZW5zdGFjay5tc3lzaXBhcWNzLmNvbaOCA14wggNaoAMCARKhAwIBAaKCA0wEggNIEYkxuhR67BYR0AiQZNcdkcjw9n9Whu15PAx7sQeAlMl0RTKqHJlMhL/djZTPJoaIJ6AWUiLovambzqA9SUngU5wEuYlwlB+h8nvxVWuqziEsukaWBWErToIKnA6R2bds4aoUCtfEElJP+kAFgyf+biqCNIzWJpKrYlMgX9gZqqAkL+uzdWMyClEAABODajw5hg8BmTLOJ5xY/BsYh2eKFn3S9y150OV1RKf5Vct2WpVQNbz/1h7Uu4iNngfTx3rvYQWg1AarkL76HACXiqu07dlmZilgf29umyy9GtNYsrJYNO0Fl1cejzOsGotxFh1Wufg5RJ3NMgHaQ477elmixsDnLC1eUtGmP4tmdpMFFoFjMi9pusdWBnsRBWK5VpJgJsSZIMNcxMMLT4CAEM5/nTo7I8ZDtrO828IhFeity4gYZeFcMZpcO9pGKL70ruWaVh8QTV9E/7DakcTAJ6eMYmTzU7mSnT8rZbA9CVRpKwU2mF3osZfWIPdmRSjM9qR540Xkj39CUaZSf2xRIyFfLPQuyQ/tKIeQH6lrO2hKIUXqmnUw5OzJBaE+JfTuAuIcnGhfA9VESN3Ymmx71SSvRLpYwHZXEWRHo2G32iyGW6pL3pf32N72oL5odlz2a8FOzSwV4vhnOHjeB0wVymmLht5BIMy5xV+UjYNomolMXLS1vrd20aI5vXpoQZNTd5ANx+7PjkXuZSxkadxFcEJQzCTwKRs0DhF6qnsVBL5t9WjiCxkUqFNQ867ZWefDW9ZkrMbTdgJ09O94an1VTNETkUFs8feQcevYXJN87dM6tp6wMFQB51zoCaF5DlHzNtwUMtv0kD0NTILULQ9jy7N2797a16FR8eueaS0YW9troP263zGjsXGP6hu1pljDCS4SLXfA5M4fLNjheOMkqrFNyHty83jEuZaNKnjKip9KVfV02YoA/r8T7ybTXSQYEohLfwIrMqL4QgjRqlb1w9R5eaHjJZ+3N2bMqdM6i5XrD4FYOw71paIQ1KDaYWVhDYzDgporDKZdKeTjGnKZjXqOMu2NMbxQCqgRl2ffRUQqYHVlr0K+H+vLyTM1hMQYQNgTOKJzmc2X4blSH0NNmXkH4SD8WwyKrRR/pIHUMIHRoAMCARKigckEgcZ1btIWWLebFDMojIrDaSja+mlF5zhAAISr8Xs8ngjbHtv3cp/L8o2LzovHGsHLlyEOFYOk8yA7fIbJ0bdqeEZ0AGn5Y9vpUhTBAOIRt7n5Ksx4MKNCjOxeoa2m2UfUNtbMgcPgN8VNZ9Z/nYvUZW9Vyd4KbPKz7+3yrKArkjz7Q47XTRyZt49eWlThhryZT2c941m6RlP0NlMYE1iA8HZfU+hpE9ZrM4QB9rjaF3YCzNriWCW8mgpyHQC/OyPgBo6Krqe3HWc=
    
http://openstack.companyipasub.com:5000 "POST /krb/v3/auth/tokens HTTP/1.1" 401 114
    
authenticate_user(): returning <Response [401]>
    
handle_401(): returning <Response [401]>
    
handle_response(): returning <Response [401]>
    
handle_response() has seen 0 401 responses
    
handle_401(): Handling: 401
    
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
    
YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRv/cBxSains0m+hfCjXhwcg/eStoasDfYiwF56vheZT9t7EVelUjfaXEtcel9E7YShc7WtbIW73NnsSM/7h8yKsqWEGwDnnSe063SnuAMW7xK0i44q3j1UkvPF7E00wF3dPzooeDxZT2Ztqc4kQ5xU
    
%%%%%%%%%%%%%%%%%RESPONSE HEADER%%%%%%%%%
    
openstack.companyipasub.com
    
HTTP
    
10
    
#####################BEFORE NEGOTATION################
    
1
    
openstack.companyipasub.com
    
<PyCObject object at 0x7feeb1f2af58>
    
{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
    
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
    
YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRv/cBxSains0m+hfCjXhwcg/eStoasDfYiwF56vheZT9t7EVelUjfaXEtcel9E7YShc7WtbIW73NnsSM/7h8yKsqWEGwDnnSe063SnuAMW7xK0i44q3j1UkvPF7E00wF3dPzooeDxZT2Ztqc4kQ5xU
    
generate_request_header(): authGSSClientStep() failed:
    
Traceback (most recent call last):
    
  File "/usr/lib/python2.7/site-packages/requests_kerberos/kerberos_.py", line 136, in generate_request_header
    
    _negotiate_value(response))
    
GSSError: (('Invalid token was supplied', 589824), ('Success', 100001))
    
(('Invalid token was supplied', 589824), ('Success', 100001))
    
Traceback (most recent call last):
    
  File "/usr/lib/python2.7/site-packages/requests_kerberos/kerberos_.py", line 136, in generate_request_header
    
    _negotiate_value(response))
    
GSSError: (('Invalid token was supplied', 589824), ('Success', 100001))
    
handle_401(): returning <Response [401]>
    
handle_response(): returning <Response [401]>
    
handle_response() has seen 1 401 responses
    
handle_response(): returning 401 <Response [401]>
    
Request returned failure status: 401
    
The request you have made requires authentication. (HTTP 401) (Request-ID: req-1f34993d-e869-491d-be4d-fc756f081beb)
    
clean_up IssueToken: The request you have made requires authentication. (HTTP 401) (Request-ID: req-1f34993d-e869-491d-be4d-fc756f081beb)
    
END return value: 1


    Could someone help me with this please?



    Thanks,

    Harry






    authentication centos kerberos openstack







    share|improve this question













    closed as off-topic by Martijn Pieters♦ Jan 2 at 8:44


    This question appears to be off-topic. The users who voted to close gave this specific reason:


    • "Questions seeking debugging help ("why isn't this code working?") must include the desired behavior, a specific problem or error and the shortest code necessary to reproduce it in the question itself. Questions without a clear problem statement are not useful to other readers. See: How to create a Minimal, Complete, and Verifiable example." – Martijn Pieters

    If this question can be reworded to fit the rules in the help center, please edit the question.
















      0












      0








      0







      I have integrated the openstack and kerberos using the link provided here : https://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/



      It is successfully installed and I am able to perform kinit authentication successfully,



      kinit {userId}


      But when I try to perform 'openstack token issue' / any command using openstack



      I get 401 unauthorized exception like below,



      Auth plugin v3kerberos selected
      
auth_config_hook(): {'auth_type': 'v3kerberos', 'beta_command': False, u'compute_api_version': u'2', 'key': None, u'database_api_version': u'1.0', 'metrics_api_version': '1', u'metering_api_version': u'2', 'auth_url': 'http://openstack.companyipasub.com:5000/krb/v3/', 'additional_user_agent': [('osc-lib', '1.11.1')], u'network_api_version': u'2', u'message': u'', u'image_format': u'qcow2', 'networks': , u'image_api_version': u'2', u'clustering_api_version': u'1', 'verify': True, 'timing': False, u'dns_api_version': '2', u'object_store_api_version': u'1', u'status': u'active', u'container_infra_api_version': '1', 'verbose_level': 3, 'region_name': '', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {}, 'default_domain': 'default', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', u'orchestration_api_version': '1', u'interface': None, u'application_catalog_api_version': u'1', 'cacert': None, u'key_manager_api_version': '1', u'workflow_api_version': u'2', u'baremetal_status_code_retries': '5', u'identity_api_version': '3', u'volume_api_version': u'2', 'deferred_help': False, 'cert': None, u'secgroup_source': u'neutron', 'alarming_api_version': '2', u'container_api_version': u'1', u'block_storage_api_version': u'2', u'disable_vendor_agent': {}}
      
Using auth plugin: v3kerberos
      
Using parameters {'auth_url': 'http://openstack.companyipasub.com:5000/krb/v3/'}
      
Get auth_ref
      
Making authentication request to http://openstack.companyipasub.com:5000/krb/v3/auth/tokens
      
Starting new HTTP connection (1): openstack.companyipasub.com
      
http://openstack.companyipasub.com:5000 "POST /krb/v3/auth/tokens HTTP/1.1" 401 381
      
handle_401(): Handling: 401
      
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
      

      
%%%%%%%%%%%%%%%%%RESPONSE HEADER%%%%%%%%%
      
openstack.companyipasub.com
      
HTTP
      
10
      
#####################BEFORE NEGOTATION################
      
1
      
openstack.companyipasub.com
      
<PyCObject object at 0x7feeb1f2aeb8>
      
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
      
<html><head>
      
<title>401 Unauthorized</title>
      
</head><body>
      
<h1>Unauthorized</h1>
      
<p>This server could not verify that you
      
are authorized to access the document
      
requested.  Either you supplied the wrong
      
credentials (e.g., bad password), or your
      
browser doesn't understand how to supply
      
the credentials required.</p>
      
</body></html>
      

      
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
      

      
authenticate_user(): Authorization header: Negotiate YIIEsQYJKoZIhvcSAQICAQBuggSgMIIEnKADAgEFoQMCAQ6iBwMFACAAAACjggOuYYIDqjCCA6agAwIBBaEQGw5NU1lTSVBBUUNTLkNPTaIrMCmgAwIBA6EiMCAbBEhUVFAbGG9wZW5zdGFjay5tc3lzaXBhcWNzLmNvbaOCA14wggNaoAMCARKhAwIBAaKCA0wEggNIEYkxuhR67BYR0AiQZNcdkcjw9n9Whu15PAx7sQeAlMl0RTKqHJlMhL/djZTPJoaIJ6AWUiLovambzqA9SUngU5wEuYlwlB+h8nvxVWuqziEsukaWBWErToIKnA6R2bds4aoUCtfEElJP+kAFgyf+biqCNIzWJpKrYlMgX9gZqqAkL+uzdWMyClEAABODajw5hg8BmTLOJ5xY/BsYh2eKFn3S9y150OV1RKf5Vct2WpVQNbz/1h7Uu4iNngfTx3rvYQWg1AarkL76HACXiqu07dlmZilgf29umyy9GtNYsrJYNO0Fl1cejzOsGotxFh1Wufg5RJ3NMgHaQ477elmixsDnLC1eUtGmP4tmdpMFFoFjMi9pusdWBnsRBWK5VpJgJsSZIMNcxMMLT4CAEM5/nTo7I8ZDtrO828IhFeity4gYZeFcMZpcO9pGKL70ruWaVh8QTV9E/7DakcTAJ6eMYmTzU7mSnT8rZbA9CVRpKwU2mF3osZfWIPdmRSjM9qR540Xkj39CUaZSf2xRIyFfLPQuyQ/tKIeQH6lrO2hKIUXqmnUw5OzJBaE+JfTuAuIcnGhfA9VESN3Ymmx71SSvRLpYwHZXEWRHo2G32iyGW6pL3pf32N72oL5odlz2a8FOzSwV4vhnOHjeB0wVymmLht5BIMy5xV+UjYNomolMXLS1vrd20aI5vXpoQZNTd5ANx+7PjkXuZSxkadxFcEJQzCTwKRs0DhF6qnsVBL5t9WjiCxkUqFNQ867ZWefDW9ZkrMbTdgJ09O94an1VTNETkUFs8feQcevYXJN87dM6tp6wMFQB51zoCaF5DlHzNtwUMtv0kD0NTILULQ9jy7N2797a16FR8eueaS0YW9troP263zGjsXGP6hu1pljDCS4SLXfA5M4fLNjheOMkqrFNyHty83jEuZaNKnjKip9KVfV02YoA/r8T7ybTXSQYEohLfwIrMqL4QgjRqlb1w9R5eaHjJZ+3N2bMqdM6i5XrD4FYOw71paIQ1KDaYWVhDYzDgporDKZdKeTjGnKZjXqOMu2NMbxQCqgRl2ffRUQqYHVlr0K+H+vLyTM1hMQYQNgTOKJzmc2X4blSH0NNmXkH4SD8WwyKrRR/pIHUMIHRoAMCARKigckEgcZ1btIWWLebFDMojIrDaSja+mlF5zhAAISr8Xs8ngjbHtv3cp/L8o2LzovHGsHLlyEOFYOk8yA7fIbJ0bdqeEZ0AGn5Y9vpUhTBAOIRt7n5Ksx4MKNCjOxeoa2m2UfUNtbMgcPgN8VNZ9Z/nYvUZW9Vyd4KbPKz7+3yrKArkjz7Q47XTRyZt49eWlThhryZT2c941m6RlP0NlMYE1iA8HZfU+hpE9ZrM4QB9rjaF3YCzNriWCW8mgpyHQC/OyPgBo6Krqe3HWc=
      
http://openstack.companyipasub.com:5000 "POST /krb/v3/auth/tokens HTTP/1.1" 401 114
      
authenticate_user(): returning <Response [401]>
      
handle_401(): returning <Response [401]>
      
handle_response(): returning <Response [401]>
      
handle_response() has seen 0 401 responses
      
handle_401(): Handling: 401
      
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
      
YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRv/cBxSains0m+hfCjXhwcg/eStoasDfYiwF56vheZT9t7EVelUjfaXEtcel9E7YShc7WtbIW73NnsSM/7h8yKsqWEGwDnnSe063SnuAMW7xK0i44q3j1UkvPF7E00wF3dPzooeDxZT2Ztqc4kQ5xU
      
%%%%%%%%%%%%%%%%%RESPONSE HEADER%%%%%%%%%
      
openstack.companyipasub.com
      
HTTP
      
10
      
#####################BEFORE NEGOTATION################
      
1
      
openstack.companyipasub.com
      
<PyCObject object at 0x7feeb1f2af58>
      
{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
      
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
      
YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRv/cBxSains0m+hfCjXhwcg/eStoasDfYiwF56vheZT9t7EVelUjfaXEtcel9E7YShc7WtbIW73NnsSM/7h8yKsqWEGwDnnSe063SnuAMW7xK0i44q3j1UkvPF7E00wF3dPzooeDxZT2Ztqc4kQ5xU
      
generate_request_header(): authGSSClientStep() failed:
      
Traceback (most recent call last):
      
  File "/usr/lib/python2.7/site-packages/requests_kerberos/kerberos_.py", line 136, in generate_request_header
      
    _negotiate_value(response))
      
GSSError: (('Invalid token was supplied', 589824), ('Success', 100001))
      
(('Invalid token was supplied', 589824), ('Success', 100001))
      
Traceback (most recent call last):
      
  File "/usr/lib/python2.7/site-packages/requests_kerberos/kerberos_.py", line 136, in generate_request_header
      
    _negotiate_value(response))
      
GSSError: (('Invalid token was supplied', 589824), ('Success', 100001))
      
handle_401(): returning <Response [401]>
      
handle_response(): returning <Response [401]>
      
handle_response() has seen 1 401 responses
      
handle_response(): returning 401 <Response [401]>
      
Request returned failure status: 401
      
The request you have made requires authentication. (HTTP 401) (Request-ID: req-1f34993d-e869-491d-be4d-fc756f081beb)
      
clean_up IssueToken: The request you have made requires authentication. (HTTP 401) (Request-ID: req-1f34993d-e869-491d-be4d-fc756f081beb)
      
END return value: 1


      Could someone help me with this please?



      Thanks,

      Harry






      authentication centos kerberos openstack







      share|improve this question













      I have integrated the openstack and kerberos using the link provided here : https://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/



      It is successfully installed and I am able to perform kinit authentication successfully,



      kinit {userId}


      But when I try to perform 'openstack token issue' / any command using openstack



      I get 401 unauthorized exception like below,



      Auth plugin v3kerberos selected
      
auth_config_hook(): {'auth_type': 'v3kerberos', 'beta_command': False, u'compute_api_version': u'2', 'key': None, u'database_api_version': u'1.0', 'metrics_api_version': '1', u'metering_api_version': u'2', 'auth_url': 'http://openstack.companyipasub.com:5000/krb/v3/', 'additional_user_agent': [('osc-lib', '1.11.1')], u'network_api_version': u'2', u'message': u'', u'image_format': u'qcow2', 'networks': , u'image_api_version': u'2', u'clustering_api_version': u'1', 'verify': True, 'timing': False, u'dns_api_version': '2', u'object_store_api_version': u'1', u'status': u'active', u'container_infra_api_version': '1', 'verbose_level': 3, 'region_name': '', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {}, 'default_domain': 'default', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', u'orchestration_api_version': '1', u'interface': None, u'application_catalog_api_version': u'1', 'cacert': None, u'key_manager_api_version': '1', u'workflow_api_version': u'2', u'baremetal_status_code_retries': '5', u'identity_api_version': '3', u'volume_api_version': u'2', 'deferred_help': False, 'cert': None, u'secgroup_source': u'neutron', 'alarming_api_version': '2', u'container_api_version': u'1', u'block_storage_api_version': u'2', u'disable_vendor_agent': {}}
      
Using auth plugin: v3kerberos
      
Using parameters {'auth_url': 'http://openstack.companyipasub.com:5000/krb/v3/'}
      
Get auth_ref
      
Making authentication request to http://openstack.companyipasub.com:5000/krb/v3/auth/tokens
      
Starting new HTTP connection (1): openstack.companyipasub.com
      
http://openstack.companyipasub.com:5000 "POST /krb/v3/auth/tokens HTTP/1.1" 401 381
      
handle_401(): Handling: 401
      
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
      

      
%%%%%%%%%%%%%%%%%RESPONSE HEADER%%%%%%%%%
      
openstack.companyipasub.com
      
HTTP
      
10
      
#####################BEFORE NEGOTATION################
      
1
      
openstack.companyipasub.com
      
<PyCObject object at 0x7feeb1f2aeb8>
      
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
      
<html><head>
      
<title>401 Unauthorized</title>
      
</head><body>
      
<h1>Unauthorized</h1>
      
<p>This server could not verify that you
      
are authorized to access the document
      
requested.  Either you supplied the wrong
      
credentials (e.g., bad password), or your
      
browser doesn't understand how to supply
      
the credentials required.</p>
      
</body></html>
      

      
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
      

      
authenticate_user(): Authorization header: Negotiate YIIEsQYJKoZIhvcSAQICAQBuggSgMIIEnKADAgEFoQMCAQ6iBwMFACAAAACjggOuYYIDqjCCA6agAwIBBaEQGw5NU1lTSVBBUUNTLkNPTaIrMCmgAwIBA6EiMCAbBEhUVFAbGG9wZW5zdGFjay5tc3lzaXBhcWNzLmNvbaOCA14wggNaoAMCARKhAwIBAaKCA0wEggNIEYkxuhR67BYR0AiQZNcdkcjw9n9Whu15PAx7sQeAlMl0RTKqHJlMhL/djZTPJoaIJ6AWUiLovambzqA9SUngU5wEuYlwlB+h8nvxVWuqziEsukaWBWErToIKnA6R2bds4aoUCtfEElJP+kAFgyf+biqCNIzWJpKrYlMgX9gZqqAkL+uzdWMyClEAABODajw5hg8BmTLOJ5xY/BsYh2eKFn3S9y150OV1RKf5Vct2WpVQNbz/1h7Uu4iNngfTx3rvYQWg1AarkL76HACXiqu07dlmZilgf29umyy9GtNYsrJYNO0Fl1cejzOsGotxFh1Wufg5RJ3NMgHaQ477elmixsDnLC1eUtGmP4tmdpMFFoFjMi9pusdWBnsRBWK5VpJgJsSZIMNcxMMLT4CAEM5/nTo7I8ZDtrO828IhFeity4gYZeFcMZpcO9pGKL70ruWaVh8QTV9E/7DakcTAJ6eMYmTzU7mSnT8rZbA9CVRpKwU2mF3osZfWIPdmRSjM9qR540Xkj39CUaZSf2xRIyFfLPQuyQ/tKIeQH6lrO2hKIUXqmnUw5OzJBaE+JfTuAuIcnGhfA9VESN3Ymmx71SSvRLpYwHZXEWRHo2G32iyGW6pL3pf32N72oL5odlz2a8FOzSwV4vhnOHjeB0wVymmLht5BIMy5xV+UjYNomolMXLS1vrd20aI5vXpoQZNTd5ANx+7PjkXuZSxkadxFcEJQzCTwKRs0DhF6qnsVBL5t9WjiCxkUqFNQ867ZWefDW9ZkrMbTdgJ09O94an1VTNETkUFs8feQcevYXJN87dM6tp6wMFQB51zoCaF5DlHzNtwUMtv0kD0NTILULQ9jy7N2797a16FR8eueaS0YW9troP263zGjsXGP6hu1pljDCS4SLXfA5M4fLNjheOMkqrFNyHty83jEuZaNKnjKip9KVfV02YoA/r8T7ybTXSQYEohLfwIrMqL4QgjRqlb1w9R5eaHjJZ+3N2bMqdM6i5XrD4FYOw71paIQ1KDaYWVhDYzDgporDKZdKeTjGnKZjXqOMu2NMbxQCqgRl2ffRUQqYHVlr0K+H+vLyTM1hMQYQNgTOKJzmc2X4blSH0NNmXkH4SD8WwyKrRR/pIHUMIHRoAMCARKigckEgcZ1btIWWLebFDMojIrDaSja+mlF5zhAAISr8Xs8ngjbHtv3cp/L8o2LzovHGsHLlyEOFYOk8yA7fIbJ0bdqeEZ0AGn5Y9vpUhTBAOIRt7n5Ksx4MKNCjOxeoa2m2UfUNtbMgcPgN8VNZ9Z/nYvUZW9Vyd4KbPKz7+3yrKArkjz7Q47XTRyZt49eWlThhryZT2c941m6RlP0NlMYE1iA8HZfU+hpE9ZrM4QB9rjaF3YCzNriWCW8mgpyHQC/OyPgBo6Krqe3HWc=
      
http://openstack.companyipasub.com:5000 "POST /krb/v3/auth/tokens HTTP/1.1" 401 114
      
authenticate_user(): returning <Response [401]>
      
handle_401(): returning <Response [401]>
      
handle_response(): returning <Response [401]>
      
handle_response() has seen 0 401 responses
      
handle_401(): Handling: 401
      
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
      
YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRv/cBxSains0m+hfCjXhwcg/eStoasDfYiwF56vheZT9t7EVelUjfaXEtcel9E7YShc7WtbIW73NnsSM/7h8yKsqWEGwDnnSe063SnuAMW7xK0i44q3j1UkvPF7E00wF3dPzooeDxZT2Ztqc4kQ5xU
      
%%%%%%%%%%%%%%%%%RESPONSE HEADER%%%%%%%%%
      
openstack.companyipasub.com
      
HTTP
      
10
      
#####################BEFORE NEGOTATION################
      
1
      
openstack.companyipasub.com
      
<PyCObject object at 0x7feeb1f2af58>
      
{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
      
!!!!!!!!!!!!!!!!!!!!!!!!!!NEGOTATION###################################
      
YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRv/cBxSains0m+hfCjXhwcg/eStoasDfYiwF56vheZT9t7EVelUjfaXEtcel9E7YShc7WtbIW73NnsSM/7h8yKsqWEGwDnnSe063SnuAMW7xK0i44q3j1UkvPF7E00wF3dPzooeDxZT2Ztqc4kQ5xU
      
generate_request_header(): authGSSClientStep() failed:
      
Traceback (most recent call last):
      
  File "/usr/lib/python2.7/site-packages/requests_kerberos/kerberos_.py", line 136, in generate_request_header
      
    _negotiate_value(response))
      
GSSError: (('Invalid token was supplied', 589824), ('Success', 100001))
      
(('Invalid token was supplied', 589824), ('Success', 100001))
      
Traceback (most recent call last):
      
  File "/usr/lib/python2.7/site-packages/requests_kerberos/kerberos_.py", line 136, in generate_request_header
      
    _negotiate_value(response))
      
GSSError: (('Invalid token was supplied', 589824), ('Success', 100001))
      
handle_401(): returning <Response [401]>
      
handle_response(): returning <Response [401]>
      
handle_response() has seen 1 401 responses
      
handle_response(): returning 401 <Response [401]>
      
Request returned failure status: 401
      
The request you have made requires authentication. (HTTP 401) (Request-ID: req-1f34993d-e869-491d-be4d-fc756f081beb)
      
clean_up IssueToken: The request you have made requires authentication. (HTTP 401) (Request-ID: req-1f34993d-e869-491d-be4d-fc756f081beb)
      
END return value: 1


      Could someone help me with this please?



      Thanks,

      Harry






      authentication centos kerberos openstack




      authentication centos kerberos openstack






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Dec 28 '18 at 9:36









      HarryHarry

      8431134




      8431134




      closed as off-topic by Martijn Pieters♦ Jan 2 at 8:44


      This question appears to be off-topic. The users who voted to close gave this specific reason:


      • "Questions seeking debugging help ("why isn't this code working?") must include the desired behavior, a specific problem or error and the shortest code necessary to reproduce it in the question itself. Questions without a clear problem statement are not useful to other readers. See: How to create a Minimal, Complete, and Verifiable example." – Martijn Pieters

      If this question can be reworded to fit the rules in the help center, please edit the question.




      closed as off-topic by Martijn Pieters♦ Jan 2 at 8:44


      This question appears to be off-topic. The users who voted to close gave this specific reason:


      • "Questions seeking debugging help ("why isn't this code working?") must include the desired behavior, a specific problem or error and the shortest code necessary to reproduce it in the question itself. Questions without a clear problem statement are not useful to other readers. See: How to create a Minimal, Complete, and Verifiable example." – Martijn Pieters

      If this question can be reworded to fit the rules in the help center, please edit the question.
























          0






          active

          oldest

          votes

















          0






          active

          oldest

          votes








          0






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes

          -

          Popular posts from this blog

          Mossoró

          Image
            Nota: Para outros significados, veja Mossoró (desambiguação). Município de Mossoró "Capital do Oeste Potiguar" [ 1 ] "Capital nacional do Semiárido" [ 2 ] [ 3 ] "Capital Cultural do Rio Grande do Norte" [ 1 ] "Terra de Santa Luzia" [ 4 ] "Terra do Sol, do Sal e do Petróleo" [ 5 ] "Terra da Liberdade [ 6 ] " Centro de Mossoró, com a Praça Vigário Antônio Joaquim e, ao fundo, a câmara municipal de vereadores (esquerda) e Catedral de Santa Luzia (direita) Bandeira Brasão Hino Fundação 15 de março de 1852 (166 anos) Gentílico mossoroense Padroeiro(a) Santa Luzia Prefeito(a) Rosalba Ciarlini Rosado (PP) (2017 – 2020 ) Localização Localização de Mossoró no Rio Grande do Norte Mossoró Localização de Mossoró no Brasil 05° 11' 16" S 37° 20' 38" O 05° 11' 16" S 37° 20' 38" O Unidade federativa Rio Grande do No...
          Read more

          Error while reading .h5 file using the rhdf5 package in R

          Image
          0 I'm importing a .h5 file into R by using the rhdf5 package. But a warning message showed and I found the DATE_TIME column of my data is NA when I view the imported file. Warning message: In H5Dread(h5dataset = h5dataset, h5spaceFile = h5spaceFile, h5spaceMem = h5spaceMem, : h5read for type 'TIME' not yet implemented. Values replaced by NA's. It's all normal when I use Vitables (Python) to open the .h5 file. But the DATE_TIME column is NA with HDFViewer open it. My code is: library(rhdf5) test <- h5read("mytestdata.h5", "/results") View(mydatatest) I want to use R to open .h5 file. Please give me some help! Thanks in advance! r hdf5 rhdf5 ...
          Read more

          Pushsharp Apns notification error: 'InvalidToken'

          Image
          1 1 I am currently working on automatic updates for Passbook (wallet) tickets and am experiencing some trouble using the Pushsharp library by Redth. I am using a Push notification certificate from the apple developer portal. I have tried to export my certificate as .p12, .pem and tried to use only the private key as .12 or .pem but nothing works. This is my full certificate (information is blanked out for security reasons): https://cdn.pbrd.co/images/HUJtb7b.png I dont have enough reputation to post images so a link is all i can provide. var succeeded = 0; var failed = 0; var attempted = 0; var config = new ApnsConfiguration(ApnsConfiguration.ApnsServerEnvironment.Sandbox, ConfigManager.CertPath + "PushCertificateV2.p12", ConfigManager.lvppass, fa...
          Read more