How to Fix OpenStack’s Keystone Authentication Error – HTTP 500?

Here’s a question from one of our reader Praveen.

Question: I’m installing Openstack on a CentOS machine by following the online documentation from I have installed keystone package, but hit with an error while creating an admin user for the cloud. I used the below command.

keystone user-create --name=admin --pass=<admin_password> --email=<admin_email>

But the above command returned an error message :

An unexpected error prevented the server from fulfilling your request. (HTTP 500)

Could someone help me out?

openstack error solution


  • You should check the keystone log-file. By default, the keystone logfile is located at “/var/log/keystone/keystone.log” and see what caused HTTP 500 error.
  • Check if you are referring to the right ‘OS_SERVICE_ENDPOINT‘ and OS_SERVICE_TOKEN.

For example :

#export OS_SERVICE_ENDPOINT=http://localhost:35357/v2.0
#export OS_SERVICE_TOKEN=<valid_token>

You should also compare ‘OS_SERVICE_ENDPOINT‘ and ‘OS_SERVICE_TOKEN’ entries in ‘/etc/keystone/keystone.conf‘ file.

  • Check if MySQL credentials for keystone is set properly.
#vi /etc/keystone/keystone.conf

and check for the correct entries under [database]

connection = mysql://keystoneUsername:keystonePassword@controller-hostname/keystone

In most cases, people make mistakes while configuring the above settings. In case, if the MySQL credentials for keystone is wrong, you should see an error message (/var/log/keystone/keystone.log) like the one shown below.

OperationalError: (OperationalError) (2005, "Unknown MySQL server host 'controller' (1)") None None
  • Check if keystone database contains necessary tables: This could be one reason. For instance, while configuring keystone, did you create tables for the keystone database? To verify, login to mysql as below.
#mysql -u keystone -p
mysql>use keystone
mysql>show tables

If you find no tables in keystone database, then you should create it first. In this case, you should see a corresponding error in /var/log/keystone/keystone.log file. The sample error is posted below:

ProgrammingError: (ProgrammingError) (1146, "Table 'keystone.domain' doesn't exist") 'SELECT AS domain_id, AS domain_name, domain.enabled AS domain_enabled, domain.extra AS domain_extra \nFROM domain \nWHERE = %s' ('default',)

In case if you see the above error, then create tables for keystone database using the below command.

# keystone-manage db_sync keystone

Now verify if the tables are created in keystone database.

mysql> show tables;
| Tables_in_keystone |
| credential |
| domain |
| ec2_credential |
| endpoint_v2 |
| endpoint_v3 |
| metadata |
| migrate_version |
| policy |
| role |
| service |
| tenant |
| token |
| user |
| user_domain_metadata |
| user_tenant_membership |
15 rows in set (0.00 sec)

Now try creating an admin user by running the below command

keystone user-create --name=admin --pass=<admin_password> --email=<admin_email>

CRITICAL keystone [-] ConfigFileNotFound: The Keystone configuration file keystone-paste.ini could not be found

# service openstack-keystone start
Stopping keystone:                                         [FAILED]
#tailf /var/log/keystone/keystone.log
CRITICAL keystone [-] ConfigFileNotFound: The Keystone configuration file keystone-paste.ini could not be found.
TRACE keystone Traceback (most recent call last):
TRACE keystone   File "/usr/bin/keystone-all", line 113, in 
TRACE keystone     paste_config = config.find_paste_config()
TRACE keystone   File "/usr/lib/python2.6/site-packages/keystone/", line 90, in find_paste_config
TRACE keystone     raise exception.ConfigFileNotFound(config_file=paste_config_value)
TRACE keystone ConfigFileNotFound: The Keystone configuration file keystone-paste.ini could not be found.


As the error message says, verify whether keystone-paste.ini file exists and identified properly by the keystone.conf file.

Open /etc/keystone/keystone.conf and see if ‘config_file‘ is referring to keystone-paste.ini file.


Try starting the service again.

#service openstack-keystone start

You might also want to read : List of Common Errors (and Solutions) while Installing and Configuring OpenStack Nova Service and Glance service

And the Bonus is here…

Updated on September 1, 2017

Was this article helpful?

Related Articles


  1. If you are getting same error while creating a project then you just need to assign IP in place hostname in command: export OS_AUTH_URL=http://:35357/v3

Leave a Comment