OS_AUTH_TOKEN/API_KEY issue with openstack provider

[pryorda]

No matter if I use keystone v2 or v3 I continue to get this failure ( * The base Identity V2 API does not accept authentication by APIKey) when connecting using APIKEY/AUTH Token . Any guidance is appreciated.

(1:527)$ terraform --version
Terraform v0.6.14

Error refreshing state: 1 error(s) occurred:

• The base Identity V2 API does not accept authentication by APIKey

[jtopjian]

Hi there,

Yes, thank you for pointing this out. It's been something I've been meaning to look into and resolve. The api_key attribute was accidentally added as a way to enable token authentication, but api_key serves a totally different purpose: it acts as a secondary password for specialized OpenStack environments such as Rackspace.

AFAIK, the vast majority of OpenStack environments do not support an API Key authentication method. At minimum, I need to update the docs to reflect this.

The secondary issue here is how one can authenticate with a token. Coincidentally, I just close #4430 which talks about tokens a little bit. What I've found is that even if you authenticate with a token in Gophercloud (the underlying Golang OpenStack library), that token is simply used to create another token, so it's not useful in situations when you want to use a persistent token throughout your entire session.

Let me know if this helps.

I'll get a doc patch shortly to better describe api_key.

[pryorda]

Is there a way to use OS_AUTH_TOKEN rather then password? #4430 did not really go into any details of what values need to be set for it to work.

[jtopjian]

At this time it's not possible to use OS_AUTH_TOKEN rather than a password. The testing I did in #4430 either reported the generated token from the username/password combination or was a test with Gophercloud directly.

I can look into adding OS_AUTH_TOKEN functionality, but with the understanding that specifying a token will simply create another token once authenticated. I just want to be explicit about that because I think people use token authentication for a few different reasons; two being: cut down on token traffic in the underlying infrastructure and not using a password for authentication. This would help the latter case.

[pryorda]

Yeah that would be fine. Tokens in source files usually expire, passwords are permanent. We are trying to get by having to store the password, but still allow it be automated without having to prompt for a password. We got past this by storing the password as an ENV variable and would like to remove this and just use a auth_token/username pair.

BTW, Thanks for all the fast responses. This is the second issue you jumped on within 24 hours 👍

[jtopjian]

No problem at all - It's all in the gmail filters 😉

This sounds good and as I wrote out my last response even wondered why it hasn't been done yet. I'll put this on my TODO.

[jtopjian]

@pryorda Sorry for the delay. I've just opened #6081. Would you be able to test it out and let me know what you think?

[pryorda]

This worked as expected.

[jtopjian]

That's great news! Thank you for testing it out.

I'm going to leave the PR opened a little longer than usual to see if anyone else will come across and comment on it. It's making some changes to the login configuration (albeit minor and retains backwards compatibility) so I want to be a little cautious.

[pryorda]

Did you have to change anything in gophercloud or strictly the 3 files that were part of this commit?

[jtopjian]

It was all strictly in Terraform.

[thishitshome]

Maybe not worth opening a new bug for this, but when I am attempting to use token against a v3 keystone auth_url, terraform outputs the following error, saying it requires a password.

"
Error refreshing state: 1 error(s) occurred:

* You must provide a password to authenticate
"

Specifying a v2.0 keystone URL allows it to connect, but I get an authentication error back from keystone as v2.0 obviously doesn't support v3 project-scoped tokens.

[pryorda]

What Variables do you have set and what os?

[thishitshome]

CentOS 6.6, 2.6.32-504.30.3.el6.x86_64

example.tf:

provider "openstack" {
auth_url = "https://devcloud.mycompany.com:5000/v3"
domain_name = "development"
tenant_name = "dev2"
token = ""
}

No "OS_" environment variables are set; however I get the same behavior if I do set OS_AUTH_TOKEN, though.

[jtopjian]

@delias- I think this is worth opening a new issue for 😄

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.