How to Fix OpenStack’s Keystone Authentication Error – HTTP 500?

Here’s a question from one of our reader Praveen.

Question: I’m installing Openstack on a CentOS machine by following the online documentation from openstack.org. I have installed keystone package, but hit with an error while creating an admin user for the cloud. I used the below command.

keystone user-create --name=admin --pass=<admin_password> --email=<admin_email>

But the above command returned an error message :

An unexpected error prevented the server from fulfilling your request. (HTTP 500)

Could someone help me out?

Solution:

• You should check the keystone log-file. By default, the keystone logfile is located at “/var/log/keystone/keystone.log” and see what caused HTTP 500 error.
• Check if you are referring to the right ‘OS_SERVICE_ENDPOINT‘ and OS_SERVICE_TOKEN.

For example :

#export OS_SERVICE_ENDPOINT=http://localhost:35357/v2.0
#export OS_SERVICE_TOKEN=<valid_token>

You should also compare ‘OS_SERVICE_ENDPOINT‘ and ‘OS_SERVICE_TOKEN’ entries in ‘/etc/keystone/keystone.conf‘ file.

• Check if MySQL credentials for keystone is set properly.

#vi /etc/keystone/keystone.conf

and check for the correct entries under [database]

[database]
connection = mysql://keystoneUsername:keystonePassword@controller-hostname/keystone

In most cases, people make mistakes while configuring the above settings. In case, if the MySQL credentials for keystone is wrong, you should see an error message (/var/log/keystone/keystone.log) like the one shown below.

OperationalError: (OperationalError) (2005, "Unknown MySQL server host 'controller' (1)") None None

• Check if keystone database contains necessary tables: This could be one reason. For instance, while configuring keystone, did you create tables for the keystone database? To verify, login to mysql as below.

#mysql -u keystone -p
mysql>use keystone
mysql>show tables

If you find no tables in keystone database, then you should create it first. In this case, you should see a corresponding error in /var/log/keystone/keystone.log file. The sample error is posted below:

ProgrammingError: (ProgrammingError) (1146, "Table 'keystone.domain' doesn't exist") 'SELECT domain.id AS domain_id, domain.name AS domain_name, domain.enabled AS domain_enabled, domain.extra AS domain_extra \nFROM domain \nWHERE domain.id = %s' ('default',)

In case if you see the above error, then create tables for keystone database using the below command.

# keystone-manage db_sync keystone

Now verify if the tables are created in keystone database.

mysql> show tables;
+------------------------+
| Tables_in_keystone |
+------------------------+
| credential |
| domain |
| ec2_credential |
| endpoint_v2 |
| endpoint_v3 |
| metadata |
| migrate_version |
| policy |
| role |
| service |
| tenant |
| token |
| user |
| user_domain_metadata |
| user_tenant_membership |
+------------------------+
15 rows in set (0.00 sec)

Now try creating an admin user by running the below command

keystone user-create --name=admin --pass=<admin_password> --email=<admin_email>

CRITICAL keystone [-] ConfigFileNotFound: The Keystone configuration file keystone-paste.ini could not be found

# service openstack-keystone start
Stopping keystone:                                         [FAILED]

#tailf /var/log/keystone/keystone.log
CRITICAL keystone [-] ConfigFileNotFound: The Keystone configuration file keystone-paste.ini could not be found.
TRACE keystone Traceback (most recent call last):
TRACE keystone   File "/usr/bin/keystone-all", line 113, in 
TRACE keystone     paste_config = config.find_paste_config()
TRACE keystone   File "/usr/lib/python2.6/site-packages/keystone/config.py", line 90, in find_paste_config
TRACE keystone     raise exception.ConfigFileNotFound(config_file=paste_config_value)
TRACE keystone ConfigFileNotFound: The Keystone configuration file keystone-paste.ini could not be found.

Solution:

As the error message says, verify whether keystone-paste.ini file exists and identified properly by the keystone.conf file.

Open /etc/keystone/keystone.conf and see if ‘config_file‘ is referring to keystone-paste.ini file.

[paste_deploy]
config_file=/usr/share/keystone/keystone-dist-paste.ini

Try starting the service again.

#service openstack-keystone start

You might also want to read : List of Common Errors (and Solutions) while Installing and Configuring OpenStack Nova Service and Glance service

And the Bonus is here…

• Download Free ebook on OpenStack Icehouse Installation!
• Download OpenStack Command Line Interface Cheat Sheet! – Most Commonly used Commands