You are not authorized to perform the requested action: identity:list_users

Created by: apdibbo

Hi,

I am currently trying to run CASO against our OpenStack Queens Deployment and getting the following errors:

2019-07-02 09:14:55.391 29569 INFO caso.extract.manager [-] Extracting records for project 'monitoring' 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager [-] Cannot extract records for 'monitoring': Forbidden: You are not authorized to perform the requested action: identity:list_users. (HTTP 403) (Request-ID: req-e5a9c2e7-3587-4721-bee4-72f67ebff0cf) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager Traceback (most recent call last): 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/caso/extract/manager.py", line 104, in _extract 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager extract_to) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/caso/extract/nova.py", line 114, in extract_for_project 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager users = self._get_keystone_users(ks_client) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/caso/extract/base.py", line 89, in _get_keystone_users 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager users = ks_client.users.list(project_id=project_id) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/debtcollector/renames.py", line 43, in decorator 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager return wrapped(*args, **kwargs) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneclient/v3/users.py", line 136, in list 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager **kwargs) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 75, in func 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager return f(*args, **new_kwargs) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 397, in list 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager self.collection_key) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 125, in _list 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager resp, body = self.client.get(url, **kwargs) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 304, in get 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager return self.request(url, 'GET', **kwargs) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 463, in request 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager resp = super(LegacyJsonAdapter, self).request(*args, **kwargs) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 189, in request 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager return self.session.request(url, method, **kwargs) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 737, in request 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager raise exceptions.from_response(resp, method, url) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager Forbidden: You are not authorized to perform the requested action: identity:list_users. (HTTP 403) (Request-ID: req-e5a9c2e7-3587-4721-bee4-72f67ebff0cf) 2019-07-02 09:14:55.602 29569 ERROR caso.extract.manager 2019-07-02 09:14:55.606 29569 INFO caso.extract.manager [-] Extracting records for project 'admin' 2019-07-02 09:15:33.040 29569 INFO caso.extract.manager [-] Extracted 76 records for project 'admin' from 2019-06-30 00:00:00 to 2019-07-02 09:14:55.391782 2019-07-02 09:15:33.041 29569 INFO caso.extract.manager [-] Extracting records for project 'Condor' 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager [-] Cannot extract records for 'Condor': Forbidden: You are not authorized to perform the requested action: identity:list_users. (HTTP 403) (Request-ID: req-02387e59-d7f0-417d-90f7-da8e4c83a042) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager Traceback (most recent call last): 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/caso/extract/manager.py", line 104, in _extract 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager extract_to) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/caso/extract/nova.py", line 114, in extract_for_project 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager users = self._get_keystone_users(ks_client) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/caso/extract/base.py", line 89, in _get_keystone_users 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager users = ks_client.users.list(project_id=project_id) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/debtcollector/renames.py", line 43, in decorator 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager return wrapped(*args, **kwargs) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneclient/v3/users.py", line 136, in list 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager **kwargs) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 75, in func 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager return f(*args, **new_kwargs) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 397, in list 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager self.collection_key) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 125, in _list 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager resp, body = self.client.get(url, **kwargs) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 304, in get 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager return self.request(url, 'GET', **kwargs) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 463, in request 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager resp = super(LegacyJsonAdapter, self).request(*args, **kwargs) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 189, in request 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager return self.session.request(url, method, **kwargs) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 737, in request 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager raise exceptions.from_response(resp, method, url) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager Forbidden: You are not authorized to perform the requested action: identity:list_users. (HTTP 403) (Request-ID: req-02387e59-d7f0-417d-90f7-da8e4c83a042) 2019-07-02 09:15:33.364 29569 ERROR caso.extract.manager

I get this whether using a separate accounting account as per the docs or using a cloud_admin account.

The admin project seems to generate accounting records fine but our monitoring and Condor projects do not.

This is using version 1.2.0-2 on SL7 from the EGI repository. I am using the v3password auth type.

Can you provide any advice on this?

Thanks

Alex