Pass the project domain ID to novaclient

When the nova client creates a new session, knowing only the ID and
project of a token but not the project's domain, it calls keystoneauth
with None as the project domain. Keystoneauth takes this to mean
novaclient wants to authenticate with the Identity v2.0 API, which
fails if the user is a federated user. This patch grabs the project
domain ID from the request and passes it along to novaclient so that it
can properly create a v3 Token session.

Change-Id: I7f00a9fefd64c453c40b08fbe235ac7e42153050
Depends-on: I18a9d42906cb2116903600d47880ebdfff1e1ef9
Partial-bug: #1660436
This commit is contained in:
Colleen Murphy 2017-02-01 15:08:56 +01:00
parent 4f654e30c3
commit f7e2d7883d

View File

@ -457,6 +457,7 @@ def get_auth_params_from_request(request):
request.user.username,
request.user.token.id,
request.user.tenant_id,
request.user.token.project.get('domain_id'),
base.url_for(request, 'compute'),
base.url_for(request, 'identity')
)
@ -464,13 +465,21 @@ def get_auth_params_from_request(request):
@memoized_with_request(get_auth_params_from_request)
def novaclient(request_auth_params, version=None):
username, token_id, project_id, nova_url, auth_url = request_auth_params
(
username,
token_id,
project_id,
project_domain_id,
nova_url,
auth_url
) = request_auth_params
if version is None:
version = VERSIONS.get_active_version()['version']
c = nova_client.Client(version,
username,
token_id,
project_id=project_id,
project_domain_id=project_domain_id,
auth_url=auth_url,
insecure=INSECURE,
cacert=CACERT,