Bug 1116551

To get a token with curl:

#!/bin/bash

KEYSTONE_USER=keystone
KEYSTONE_TENANT=admin
KEYSTONE_USERPASS=redhat123
KEYSTONE_DOMAIN=default
KEYSTONE_URL=http://10.35.64.157:5000/v3

cat << EOF > ~/auth1.json
{
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                    "domain": {
                        "name": "$KEYSTONE_DOMAIN"
                    },
                    "name": "$KEYSTONE_USER",
                    "password": "$KEYSTONE_USERPASS"
                }
            }
        },
        "scope": {
            "project": {
                "domain": {
                    "name": "$KEYSTONE_DOMAIN"
                },
                "name": "$KEYSTONE_TENANT"
            }
        }
    }
}
EOF

MYTOKEN=$(curl -si -d @auth1.json -H "Content-type: application/json" ${KEYSTONE_URL}/auth/tokens?nocatalog| tee result.raw | awk '/X-Subject-Token/ {print $2}')
MYTOKEN=$(echo "$MYTOKEN" | tr -d '\r')
rm -f ~/auth1.json

# echo result.raw to stderr if MYTOKEN is blank, so the user can read the error on the console
if [ "x$MYTOKEN" == "x" ]; then
    cat result.raw >&2
    echo "" >&2
else
   echo $MYTOKEN
   echo "export TESTV3_TOKEN=${MYTOKEN}" > ~/keystone_v3testtoken
fi

I recreated this bug also without LDAP, so in general we have a problem running under Apache.

This has been proposed for backport to stable/icehouse upstream:

  https://review.openstack.org/#/c/116991/

This was addressed in the upstream 2014.1.3 Icehouse release.

Verified: 
openstack-keystone-2014.1.3-2.el7ost.noarch
python-keystone-2014.1.3-2.el7ost.noarch

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2014-1790.html