title: Unauthorized error when using OpenStack API, can't get authentication token from keystone
body: <p>I want to use the RESTful API, e.g. </p>
  
  <pre><code>https://nova.rc.nectar.org.au:8774/v1.1/1f283209946f428998e8d3930bb038d1
  </code></pre>
  
  <p>But can not get the authentication token.</p>
  
  <p>I tried the following command to get it (I don't have admin access):</p>
  
  <pre><code>curl -d '{"auth":{"passwordCredentials":{"username": "miranda.zhang", "password": "mypass"}}}' -H "Content-type: application/json"  https://keystone.rc.nectar.org.au:5000/v2.0/tokens
  </code></pre>
  
  <p>But still get</p>
  
  <pre><code>{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
  </code></pre>
  
  <p>I've also had a look at the <a href="https://github.com/openstack/python-keystoneclient" rel="nofollow">python-keystoneclient</a>
  I tried to install it</p>
  
  <pre><code>python setup.py install
  </code></pre>
  
  <p>But it returns error</p>
  
  <pre><code>Traceback (most recent call last):
    File "setup.py", line 18, in &lt;module&gt;
      import setuptools
  ImportError: No module named setuptools
  </code></pre>
  
  <p>Here is the <a href="https://support.rc.nectar.org.au/technical_guides/credentials_tech.html" rel="nofollow">openrc.sh file generated by my cloud provider</a>, which does not seem to help.</p>
  
  <pre><code>#!/bin/bash
  
  # With the addition of Keystone, to use an openstack cloud you should
  # authenticate against keystone, which returns a **Token** and **Service
  # Catalog**.  The catalog contains the endpoint for all services the
  # user/tenant has access to - including nova, glance, keystone, swift.
  #
  # *NOTE*: Using the 2.0 *auth api* does not mean that compute api is 2.0.  We
  # will use the 1.1 *compute api*
  export OS_AUTH_URL=https://keystone.rc.nectar.org.au:5000/v2.0/
  
  # With the addition of Keystone we have standardized on the term **tenant**
  # as the entity that owns the resources.
  export OS_TENANT_ID=1f283209946f428998e8d3930bb038d1
  export OS_TENANT_NAME="pt-1114"
  
  # In addition to the owning entity (tenant), openstack stores the entity
  # performing the action as the **user**.
  export OS_USERNAME="miranda.zhang"
  
  # With Keystone you pass the keystone password.
  echo "Please enter your OpenStack Password: "
  read -sr OS_PASSWORD_INPUT
  export OS_PASSWORD=$OS_PASSWORD_INPUT
  </code></pre>
  
  <p>Reference:</p>
  
  <ol>
  <li><a href="http://docs.openstack.org/developer/keystone/api_curl_examples.html" rel="nofollow">http://docs.openstack.org/developer/keystone/api_curl_examples.html</a></li>
  <li><a href="http://api.openstack.org/api-ref-identity.html#identity" rel="nofollow">http://api.openstack.org/api-ref-identity.html#identity</a></li>
  <li><a href="http://docs.openstack.org/api/openstack-identity-service/2.0/content/POST_authenticate_v2.0_tokens_.html" rel="nofollow">http://docs.openstack.org/api/openstack-identity-service/2.0/content/POST_authenticate_v2.0_tokens_.html</a></li>
  </ol>
  
  <hr>
  
  <p>I tried Barak's suggestion to include tenant name, but still get the following:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Vary: X-Auth-Token
  Content-Type: application/json
  Content-Length: 114
  Date: Sun, 29 Dec 2013 08:54:28 GMT
  
  {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
  </code></pre>
  
  <hr>
  
  <p>I have installed the keystone client with Barak's help:</p>
  
  <pre><code>sudo apt-get install python-setuptools
  sudo easy_install pip
  sudo pip install python-keystoneclient
  </code></pre>
  
  <p>But using it like this:</p>
  
  <pre><code>keystone --os-tenant-name pt-1114 --os-username USERNAME --os-password PASSWORD --os-auth-url https://keystone.rc.nectar.org.au:5000/v2.0/tokens -os-identity-api-version 2.0 --debug token-get
  </code></pre>
  
  <p>I got this error, while <code>token-get</code> is clearly a valid option.</p>
  
  <pre><code>usage: keystone [--version] [--timeout &lt;seconds&gt;]
                  [--os-username &lt;auth-user-name&gt;]
                  [--os-password &lt;auth-password&gt;]
                  [--os-tenant-name &lt;auth-tenant-name&gt;]
                  [--os-tenant-id &lt;tenant-id&gt;] [--os-auth-url &lt;auth-url&gt;]
                  [--os-region-name &lt;region-name&gt;]
                  [--os-identity-api-version &lt;identity-api-version&gt;]
                  [--os-token &lt;service-token&gt;]
                  [--os-endpoint &lt;service-endpoint&gt;]
                  [--os-cacert &lt;ca-certificate&gt;] [--insecure]
                  [--os-cert &lt;certificate&gt;] [--os-key &lt;key&gt;] [--os-cache]
                  [--force-new-token] [--stale-duration &lt;seconds&gt;]
                  &lt;subcommand&gt; ...
  keystone: error: argument &lt;subcommand&gt;: invalid choice: '2.0' (choose from 'catalog', 'ec2-credentials-create', 'ec2-credentials-delete', 'ec2-credentials-get', 'ec2-credentials-list', 'endpoint-create', 'endpoint-delete', 'endpoint-get', 'endpoint-list', 'password-update', 'role-create', 'role-delete', 'role-get', 'role-list', 'service-create', 'service-delete', 'service-get', 'service-list', 'tenant-create', 'tenant-delete', 'tenant-get', 'tenant-list', 'tenant-update', 'token-get', 'user-create', 'user-delete', 'user-get', 'user-list', 'user-password-update', 'user-role-add', 'user-role-list', 'user-role-remove', 'user-update', 'discover', 'bootstrap', 'bash-completion', 'help', 'bash_completion')
  </code></pre>
  
  <hr>
  
  <p>I just realized that my existing password for login the web portal won't work as</p>
  
  <blockquote>
    <p>To access the Nectar Cloud using the OpenStack API you will need to
    generate a password. By doing so any existing password will be
    forgotten. To generate a new password click "Reset Password" button.</p>
  </blockquote>
  
  <p>Problem solved.</p>