Ask OpenStack: Q&A Site for OpenStack Users and Developers - Latest question feed and answers OpenStack CommunityenCopyright of the authors unless stated otherwiseFri, 15 Feb 2019 13:27:23 -0600Rocky keystone: admin role on project is too permissive all, I have noticed that keystone does not properly restrict access to users that are granted the admin role on a project in a domain. I have read through [this]( bug report, which seems to describe this issue, but I am still not clear as to why I am getting the following behaviour: # Create domain openstack domain create --enable dom1 # Create project in the new domain openstack project create --domain dom1 --enable project1 # Create user belonging to dom1 and project1 openstack user create --domain dom1 --project project1 --project-domain dom1 --password <password> --enable usr1 # Add the 'admin' role to 'user1' for 'project1' openstack role add --project project1 --user usr1 --project-domain dom1 --user-domain dom1 admin # After sourcing the credentials for usr1 (v3 credentials, project scoped, downloaded via horizon interface) I can now, successfully, run the following openstack domain list The relevant sections of keystone's policy file are as follows: "cloud_admin": "role:admin and (is_admin_project:True or domain_id:default)", "identity:list_domains": "rule:cloud_admin", As I understand it this means that users may only list domains if they are the cloud_admin, which entails having an admin role and either having is_admin_project set to true ('admin_project_name' is unset in keystone.conf) or the domain_id of the request set to 'default'. The user does have the admin role for the given project, but it is not an admin project nor is the domain 'default'; and yet the user is able to list domains! Is this expected behaviour? Is keystone defaulting to the default domain for some reason when using project scoped credentials? I tried setting all of the *domain* related options of the 'openstack' command to point to dom1 to no avail. Lastly, when giving usr1 the 'admin' role on dom1 but not project1 (and unsetting OS_PROJECT_ID and OS_PROJECT_NAME) I get the desired behaviour in that I cannot list domains (no longer cloud_admin) but I can list services etc (admin role). Update (2/18/2019): Testing using latest devstack shows that the property 'is_admin_project' defaults to true if *admin_project_domain_name* and *admin_project_domain_name* are not specified in *keystone.conf*. This seemed to have been the case before Rocky, but because of the recent token overhaul my understanding was that the default behavior should be [false]( Perhaps I am mistaken? The *domain_id:default* check still does not seem to do anything, it is always false no matter what I set it to and with what credentials I perform an API request with.Mike BFri, 15 Feb 2019 13:27:23 -0600 non-admin user to grant admin role, I want to create multi-domain environment. Domain admins will have role "DomainAdmin". From keystone view: DomainAdmin have same rights as admin(done by `"admin_required": "role:admin or role:DomainAdmin"` in policy.json It was solved this way because other projects(like nova or neutron) doesn't care about domains and I don't want domain admins to be treated like global admins. This users should only have privileges to create projects&users in their own domain. And all would be fine, but "DomainAdmin" can assign "admin" role to anyone which causes a high security risk. Maybe someone know any way, to prevent this situation? I would be very grateful for any helpDamian DąbrowskiSun, 29 Jul 2018 07:43:15 -0500 Keystone Admin Pass Hi , Hope someone can help. how do i go about changing the Keystone Admin Pass in Newton. I observed that in previous releases one would use the keystone CLI command however as this is deprecated in favour of the Openstack CLI command do i just re-bootstrap the admin user ? using the following keystone-manage bootstrap --bootstrap-password ADMIN_PASS \ --bootstrap-admin-url http://controller:35357/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne Or is there a specific command that is used to change the admin user password ? Thanksk.s-deanMon, 03 Apr 2017 09:12:48 -0500 specific admin unable to list users or use horizon I've now tried everything I can in my mitaka installation, to create a project specifik admin user. I have the default domain and the admin user there, and he's capable of managing everything. (Although I had to use the admin_project_name setting in keystone.conf to get it to work. It dont NOT work with just updating the domain-version of policy.json to have the "cloud_admin" rule with the default domain id that I use for domain wide admin. Maybe the default domain is not allowed for this?) Anyway. I've created a separate Cloud1 domain, with a student1 user, and an "admin1" user. The admin1 user has the admin role on the StackLab project, belonging to domain Cloud1. [root@ctrl ~(admin)]# openstack domain list +----------------------------------+---------+---------+--------------------------+ | ID | Name | Enabled | Description | +----------------------------------+---------+---------+--------------------------+ | 9be0c728dfa34a7e90efa0863bf1c7ad | Cloud1 | True | | | default | Default | True | The default domain | | f0c0c7998c40494790af7bcd1928e658 | heat | True | Stack projects and users | +----------------------------------+---------+---------+--------------------------+ [root@ctrl ~(admin)]# openstack project list | grep StackLab1 | 67c057142c2b4dfb834fd08266d2b9ce | StackLab1 | [root@ctrl ~(admin)]# openstack role list | grep "admin|user" | 08409e0f623642c1a56a8a759546d4f2 | user | | 3fc27525b7f34fe3a211e5e4e0fbaab5 | heat_stack_user | | b05f6fad45e8403aa4f321e6622897d4 | admin | [root@ctrl ~(admin)]# openstack role assignment list --user admin1 +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | Role | User | Group | Project | Domain | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | 08409e0f623642c1a56a8a759546d4f2 | 5377c82f65244de28708cd1b40d1cbd7 | | 67c057142c2b4dfb834fd08266d2b9ce | | False | | b05f6fad45e8403aa4f321e6622897d4 | 5377c82f65244de28708cd1b40d1cbd7 | | 67c057142c2b4dfb834fd08266d2b9ce | | False | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ [root@ctrl ~(admin)]# cat /root/admin1.rc export OS_PROJECT_DOMAIN_NAME=Cloud1 export OS_USER_DOMAIN_NAME=Cloud1 export OS_PROJECT_NAME=StackLab1 export OS_USERNAME=admin1 export OS_PASSWORD=admin1 export OS_AUTH_URL= export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 [root@ctrl ~(admin)]# . /root/admin1.rc [root@ctrl ~(admin1)]# openstack user list You are not authorized to perform the requested action: identity:list_users (HTTP 403) (Request-ID: req-31a03d54-b84f-481b-98ae-c054cf9e9e20) [root@ctrl ~(admin1)]# grep "identity:list_users|admin_and_matching_domain_id\":|cloud_admin\":" /etc/keystone/policy.json "cloud_admin": "role:admin and (token.is_admin_project:True or domain_id:default)", "admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s", "identity:list_users": "rule:cloud_admin or rule:admin_and_matching_domain_id", "identity:list_users_in_group": "rule:cloud_admin or rule:admin_and_matching_target_group_domain_id", [root@ctrl ~(admin1)]# I have even used tcpdump on :35357 and checked that the token that openstack CLI is receiving says: HTTP/1.1 201 Created. Date: Fri, 28 Oct 2016 15:11:21 GMT. Server: Apache/2.4.6 (CentOS) mod_wsgi/3.4 Python/2.7.5. X-Subject-Token: gAAAAABYE2qZ61mmocCgfwNl9Ct0jxE6z34b22Kwg_HPX5skFgwyxbWazfmrYGzkmry2WwI0322S2SUySnJIr23LPetFkPo0P4Q05ppasvStBKVJsYEKKGm3yHG1MNe9BmvxbqCW_-0KUHVXaX5o2JySX11XNOzeCD6jthtN8qDPK-XfUMT1H1o. Vary: X-Auth-Token. x-openstack-request-id: req-123cb4c0-0864-4c87-9ac8-6c39b8d0a947. Content-Length: 7306. Keep-Alive: timeout=5, max=98. Connection: Keep-Alive. Content-Type: application/json. . { "token": { "methods": ["password"], "roles": [{ "id": "b05f6fad45e8403aa4f321e6622897d4", "name": "admin" }, { "id": "08409e0f623642c1a56a8a759546d4f2", "name": "user" } ], "expires_at": "2016-10-28T16:11:21.252914Z", "project": { "domain": { "id": "9be0c728dfa34a7e90efa0863bf1c7ad", "name": "Cloud1" }, "id": "67c057142c2b4dfb834fd08266d2b9ce", "name": "StackLab1" }, , "user": { "domain": { "id": "9be0c728dfa34a7e90efa0863bf1c7ad", "name": "Cloud1" }, "id": "5377c82f65244de28708cd1b40d1cbd7", "name": "admin1" }, "audit_ids": ["GdcWpJ5RRF2CAscZdqIxVg"], "issued_at": "2016-10-28T15:11:21.000000Z" } } Which to me implies that I have a token scoped to my project, WITH admin role. Using horizon allows the admin user to login, but he cant see s**t, since he's not allowed to list projects or users, or anything it seems... What is missing?!?!?! Why is the information on creating different domain/project specific admins so...sparse!? theque42Fri, 28 Oct 2016 10:41:49 -0500 to create an instance for a tenant via admin? only have the admin username and password. Via this admin tenant I need to create instances for different users. Is this possible? I could create ports via admin for different tenant's networks in quantum, but could not figure out creating instances in a similar way in nova. Saurabh ChakrabartiMon, 02 Dec 2013 00:23:24 -0600 HTTP 500 error all -- I'm trying to set up keystone and while create the admin tenant, I get this error : An unexpected error prevented the server from fulfilling your request. (HTTP 500) Looking at logs I see : OperationalError: (OperationalError) (1045, "Access denied for user 'keystone'@'allinone' (using password: YES)") None None I created the keystone database and users as directed and gave privileges to keystone user on %, localhost and allinone. What else needs to be done for this ? DorianTMon, 23 Feb 2015 13:05:09 -0600 user can't log in keystone everyone! I'm back to OS Installation as we have to test Grizzly on our lab here. For this test batch, I've 3 servers on my side, one which aim to be the CloudController and the both other servers which aim to be Compute/Storage and Network nodes. All this fancy staff is running under a fresh and shinny Fedora 19 Schrodinger Cat Inet install. I've off course install all the required package and keystone seems to be working fine but indeed its not. I don't know why, but if I try to authenticate on Horizon with the admin user which have the admin role on my demo tenant, Keystone seems to be unable to perform the authentication and seems to said that the admin user is not a member of the admin role, but when I inspect this using Keystone CLI everything seems to be OK. I've to precise that I can't login on keystone CLI using the admin username neither. So, if someone have time to help me on this issue, I'll be happy :D Of course, you'll find all Configuration information and debug output below: [Keystone Configuration file]( [Keystone Command line results]( [Keystone Debug output](, 02 Sep 2013 05:17:33 -0500 an authentication token for tenant using admin credentials (DevStack works, RDO fails)'m writing some automation scripts that instantiate Nova servers on behalf of tenants using the python-keystoneclient to perform authentication and authorization. These scripts work fine on a DevStack installation but fail on RDO because of an inability to get an authentication token for a tenant using the admin credentials. The issue can be demonstrated with the following code... #!/usr/bin/env python from keystoneclient.v2_0 import client as keystone_client def get_keystone_client(user, password, tenant): params = { "username": user, "password": password, "tenant_name": tenant, "auth_url": "http://localhost:35357/v2.0" } return keystone_client.Client(**params) tests = [ {"user": "admin", "password": "password", "tenant": "admin"}, {"user": "admin", "password": "password", "tenant": "tenant1"}, {"user": "tenant1-user", "password": "password", "tenant": "tenant1"} ] for test in tests: print "Attempting authentication for tenant %s by user %s" % ( test['tenant'], test['user'] ), try: ks = get_keystone_client(**test) print "Authorized" except: print "Denied" On DevStack, the following output is produced... Attempting authentication for tenant admin by user admin Authorized Attempting authentication for tenant tenant1 by user admin Authorized Attempting authentication for tenant tenant1 by user tenant1-user Authorized However, when I run the same script on an RDO installation with the same tenants/users/roles configured, authentication for tenant1 fails when using the admin user credentials.... Attempting authentication for tenant admin by user admin Authorized Attempting authentication for tenant tenant1 by user admin Denied Attempting authentication for tenant tenant1 by user tenant1-user Authorized I have compared the Keystone configurations on the two installations and I can't see anything that suggests it might cause this difference. I've also tried using the Keystone port 5000 endpoint, the Keystone v3 client, and plain Keystone REST requests, all with the same result. Does anyone have any idea which setting (assuming it's a setting!?) is causing this disparity? It's something of a blocker for our workflow. Matt GSun, 04 Oct 2015 03:25:17 -0500 admin user creation failed (HTTP 500) is failing with the below error [root@controller ~]# keystone user-create --name=admin --pass=paswo An unexpected error prevented the server from fulfilling your request. (HTTP 500) Debug information is as below: [root@controller ~]# keystone --debug user-create --name=admin --pass=paswo DEBUG:keystoneclient.session:REQ: curl -i -X POST http://controller:35357/v2.0/users -H "User-Agent: python-keystoneclient" -H "Content-Type: application/json" -H "X-Auth-Token: e89314d0e157ea9f07a2" -d '{"user": {"email": "", "password": "paswo", "enabled": true, "name": "admin", "tenantId": null}}' INFO:urllib3.connectionpool:Starting new HTTP connection (1): controller DEBUG:urllib3.connectionpool:"POST /v2.0/users HTTP/1.1" 500 143 DEBUG:keystoneclient.session:RESP: [500] {'date': 'Thu, 26 Feb 2015 12:33:19 GMT', 'content-type': 'application/json', 'content-length': '143', 'vary': 'X-Auth-Token'} RESP BODY: {"error": {"message": "An unexpected error prevented the server from fulfilling your request.", "code": 500, "title": "Internal Server Error"}} DEBUG:keystoneclient.session:Request returned failure status: 500 An unexpected error prevented the server from fulfilling your request. (HTTP 500) masterThu, 26 Feb 2015 06:40:21 -0600 global vs. project roles: What do they mean? someone please shed some light on the role concept of Openstack? I'm confused by contradicting statements in the admin guide, strange behaviour of my Icehouse installation, and various forum responses regarding this topic. The admin guide states that role assignments are always done in project/tenant scope. I would conclude, that the individual assignment should also only takes effect in that scope. The admin guide does not mention any concept of global roles. However, the keystone API description does: GET v2.0/users/{userId}/roles​?serviceId=string List global roles for a user. but claims this actually doesn't work. To make thing worse, here is what I observe with my Keystone setup, using horizon's identity panel. Let "michael" be my user name, with the following project and role assignments, done by admin user (who in turn is admin in tenant admin): - demo1: _member_, admin - demo2: _member_ - demo3: now, logging in as user michael, I'm getting demo1 and demo2 in the context selection box at the top. That's fine, as I'm only member of these. Selecting demo2, I'm not getting any Identity panel, which also looks plausible, as I'm not admin in that project. However, if I select demo1, I'm getting the Identity panel, and that is presenting me **all** projects including demo3! Plus, it allows me to assign myself to demo3, and to grant myself any role I like in demo3 and demo2!! That's disturbing. It looks like I acquired global admin power across all projects by just being assigned to admin role in one of them? Is that intended behavior, or is it a bug? Being there, what is the purpose of the "admin" tenant? Is being a member or an admin of this tenant supposed to introduce any more power than being admin of a mortal project? And if so, what extra power, and how is that accomplished? Thanks a lot in advance! MichaelMichael SteffensMon, 02 Feb 2015 04:23:37 -0600 user can't create users, I was using Horizon to try and elevate someone to the admin level without deleting their account and re-creating them. When I tried adding them to the admin group, the master "admin" user lost their ability to create new users or instance flavours in Horizon, and the user who I tried promoting ended up with that ability. Trying to switch back, it broke so now neither have that ability. How did this happen? I've created a full MySQL dump of the keystone database (sensitive data changed) here: I'm sadly *extremely* new to OpenStack and even used OpenCenter to even deploy it. So, I guess my main question is, what roles for what tenants do I need to set to allow the admin user to create users and edit flavours?edwin.amslerWed, 05 Jun 2013 16:20:26 -0500 admin user within single tenant there a way to create admin users that have privileges only within their tenants, not global? The documentation has mentions about *global admin* and *tenant admin*. OpenStack operations guide states: > Typical use is to only create > administrative users in a single > project, by convention the "admin" > project which is created by default > during cloud setup. If your > administrative users also use the > cloud to launch and manage instances > it is strongly recommended that you > use separate user accounts for > administrative access and normal > operations and that they be in > distinct projects. However the paragraph above says: > It is extremely important to note that > the "admin" is global not per project > so granting a user the admin role in > any project gives the administrative > rights across the whole cloud. In my understanding those statements are somewhat contradictory and do not make clear if the only possibility is to have *global admin*, or if tenant admins with elevated permissions only within specific tenant is also possible? Thank you.Ruslan KiianchukTue, 11 Jun 2013 11:25:11 -0500 APIs and Admin User are using OpenStack Folsom REST APIs to collect instance, tenant and environment related information. The challenge we are having is that there is no super-admin type user for the APIs to give us all the information we need. As a workaround we have to follow these steps to achieve what we want: - We add the OpenStack admin user to every single tenant in the environment and give him the admin role (this is done through OpenStack's Horizon UI). - We use the OpenStack admin user and Keystone's admin-token (found in keystone config file) to extract all users and tenants within the environment (by calling the keystone admin API). - Then for each tenant we authenticate using OpenStack's admin user to get detailed tenant/instance level information. As you can see this workaround involves some hacking. So, we are wondering if there is a better way of doing this. We expected the admin user to be able to access the same information through the REST APIs that he could access through the OpenStack's Horizon UI, but this doesn't seem to be the case. For example the admin user can see all tenants through the UI, but only the ones he is a member of through the REST APIs. UPDATE: Some more details on what I've tried in order to get the list of all tenants in an OpenStack installation. These scenarios were tried with "admin" user who is able see all tenants, instances, ... through the OpenStack dashbaord. I tried these scenarios on three different OpenStack installations, and they all behaved the same way. Scenario 1. Using the public URL: 1. I authenticate to http://[ip]:5000/v2.0/tokens with "admin" user. The body is {"auth":{"passwordCredentials":{"username": "admin","password":"[password]"}}} 2. Once the token is returned I use it to make a call to http://[ip]:5000/v2.0/tenants. This does not return tenants "admin" is not a member; and returns only the ones "admin" belongs to. 3. I retry step 2 with ?all_tenants=1, but The result is the same. Scenario 2. Using the admin URL: 1. I authenticate to http://[ip]:35357/v2.0/tokens with "admin" user. The body is {"auth":{"passwordCredentials":{"username": "admin","password":"[password]"}}} 2. Once the token is returned I use it to make a call to http://[ip]:35357/v2.0/tenants. It returns with an error message: { "error": { "message": "The request you have made requires authentication.", "code": 401, "title": "Not Authorized" } } 3. I retry step 2 with ?all_tenants=1, but The result is the same (the error above). Just in case, here is the output of authentication: { "access": { "token": { "expires": "2013-04-11T15:24:54Z", "id": "95fb2a3921554cc9abd74d88468d9b32" }, "serviceCatalog": [ ], "user": { "username": "admin", "roles_links": [ ], "id": "61d77b68420f4f7889c5efaad3edcb7b", "roles": [ ], "name": "admin" } } }vahidMon, 08 Apr 2013 11:21:51 -0500