"keystone user-list" is an admin only command. When a regular user tries to execute it, you get a helpful response at the command line: [root@rhel ~(keystone_username)]# keystone user-list You are not authorized to perform the requested action: admin_required (HTTP 403) However, this same message is in /var/log/keystone/keystone.log: 2012-12-17 17:27:29 WARNING [keystone.common.wsgi] You are not authorized to perform the requested action: admin_required This log entry is not helpful. As an administrator, all this tells you is that *someone* tried to execute *something* that they weren't allowed to. Without any information about who or what, the log entry isn't useful.
> This log entry is not helpful. As an administrator, all this tells you is > that *someone* tried to execute *something* that they weren't allowed to. > Without any information about who or what, the log entry isn't useful. keystone.exception.ForbiddenAction records only action, adding more context requires upstream changes in policy engine
This was closed as WONTFIX upstream, as the issue only affects the v2 API (the problem is not present in v3). Closing this as WONTFIX as well, as this doesn't seem like it's a critical issue.