carbon@carbon-R5300-G4X:/$ openstack --debug token issue # 启用调试模式查看详细过程 START with options: ['--debug', 'token', 'issue'] options: Namespace(access_key='', access_secret='***', access_token='***', access_token_endpoint='', access_token_type='', auth_type='', auth_url='', authorization_code='', cacert=None, cert='', client_id='', client_secret='***', cloud='', consumer_key='', consumer_secret='***', debug=True, default_domain='default', default_domain_id='', default_domain_name='', deferred_help=False, discovery_endpoint='', domain_id='', domain_name='', endpoint='', identity_provider='', identity_provider_url='', insecure=None, interface='', key='', log_file=None, openid_scope='', os_beta_command=False, os_compute_api_version='', os_identity_api_version='3', os_image_api_version='', os_network_api_version='', os_object_api_version='', os_project_id=None, os_project_name=None, os_volume_api_version='', passcode='', password='***', project_domain_id='', project_domain_name='Default', project_id='', project_name='admin', protocol='', redirect_uri='', region_name='', timing=False, token='***', trust_id='', url='http://controller:35357/v3', user_domain_id='', user_domain_name='Default', user_id='', username='admin', verbose_level=3, verify=None) Auth plugin token_endpoint selected auth_config_hook(): {'dns_api_version': '2', 'api_timeout': None, 'secgroup_source': 'neutron', 'interface': None, 'default_domain': 'default', 'url': 'http://controller:35357/v3', 'deferred_help': False, 'object_store_api_version': '1', 'identity_api_version': '3', 'network_api_version': '2', 'networks': [], 'region_name': '', 'database_api_version': '1.0', 'volume_api_version': '2', 'container_api_version': '1', 'verbose_level': 3, 'disable_vendor_agent': {}, 'image_format': 'qcow2', 'image_api_version': '2', 'floating_ip_source': 'neutron', 'verify': True, 'compute_api_version': '2', 'username': 'admin', 'password': 'Hbis@123', 'auth_type': 'token_endpoint', 'baremetal_api_version': '1', 'beta_command': False, 'cert': None, 'cacert': None, 'debug': True, 'auth': {'project_domain_name': 'Default', 'project_name': 'admin', 'user_domain_name': 'Default', 'token': '4dfca0e2d881e685109d'}, 'orchestration_api_version': '1', 'image_api_use_tasks': False, 'metering_api_version': '2', 'key': None, 'key_manager_api_version': 'v1', 'timing': False} defaults: {'dns_api_version': '2', 'api_timeout': None, 'object_store_api_version': '1', 'interface': None, 'verify': True, 'container_api_version': '1', 'identity_api_version': '2.0', 'network_api_version': '2', 'volume_api_version': '2', 'secgroup_source': 'neutron', 'database_api_version': '1.0', 'disable_vendor_agent': {}, 'image_format': 'qcow2', 'image_api_version': '2', 'compute_api_version': '2', 'cert': None, 'auth_type': 'token_endpoint', 'baremetal_api_version': '1', 'cacert': None, 'orchestration_api_version': '1', 'image_api_use_tasks': False, 'metering_api_version': '2', 'key': None, 'key_manager_api_version': 'v1', 'floating_ip_source': 'neutron'} cloud cfg: {'dns_api_version': '2', 'api_timeout': None, 'secgroup_source': 'neutron', 'interface': None, 'default_domain': 'default', 'object_store_api_version': '1', 'url': 'http://controller:35357/v3', 'deferred_help': False, 'container_api_version': '1', 'identity_api_version': '3', 'network_api_version': '2', 'networks': [], 'region_name': '', 'database_api_version': '1.0', 'volume_api_version': '2', 'verbose_level': 3, 'disable_vendor_agent': {}, 'image_format': 'qcow2', 'image_api_version': '2', 'verify': True, 'compute_api_version': '2', 'cert': None, 'username': 'admin', 'password': '***', 'auth_type': 'token_endpoint', 'timing': False, 'beta_command': False, 'baremetal_api_version': '1', 'floating_ip_source': 'neutron', 'debug': True, 'auth': {'url': 'http://controller:35357/v3', 'project_name': 'admin', 'user_domain_name': 'Default', 'project_domain_name': 'Default', 'token': '***'}, 'orchestration_api_version': '1', 'image_api_use_tasks': False, 'metering_api_version': '2', 'key': None, 'key_manager_api_version': 'v1', 'cacert': None} object_store API version 1, cmd group openstack.object_store.v1 identity API version 3, cmd group openstack.identity.v3 network API version 2, cmd group openstack.network.v2 volume API version 2, cmd group openstack.volume.v2 compute API version 2, cmd group openstack.compute.v2 image API version 2, cmd group openstack.image.v2 neutronclient API version 2, cmd group openstack.neutronclient.v2 Auth plugin token_endpoint selected auth_config_hook(): {'dns_api_version': '2', 'api_timeout': None, 'secgroup_source': 'neutron', 'interface': None, 'default_domain': 'default', 'url': 'http://controller:35357/v3', 'deferred_help': False, 'object_store_api_version': '1', 'identity_api_version': '3', 'network_api_version': '2', 'networks': [], 'region_name': '', 'database_api_version': '1.0', 'volume_api_version': '2', 'container_api_version': '1', 'verbose_level': 3, 'disable_vendor_agent': {}, 'image_format': 'qcow2', 'image_api_version': '2', 'floating_ip_source': 'neutron', 'verify': True, 'compute_api_version': '2', 'username': 'admin', 'password': 'Hbis@123', 'auth_type': 'token_endpoint', 'baremetal_api_version': '1', 'beta_command': False, 'cert': None, 'cacert': None, 'debug': True, 'auth': {'project_domain_name': 'Default', 'project_name': 'admin', 'user_domain_name': 'Default', 'token': '4dfca0e2d881e685109d'}, 'orchestration_api_version': '1', 'image_api_use_tasks': False, 'metering_api_version': '2', 'key': None, 'key_manager_api_version': 'v1', 'timing': False} command: token issue -> openstackclient.identity.v3.token.IssueToken Using auth plugin: token_endpoint Using parameters {'url': 'http://controller:35357/v3', 'project_name': 'admin', 'user_domain_name': 'Default', 'project_domain_name': 'Default', 'token': '***'} Get auth_ref run(Namespace(columns=[], formatter='table', max_width=0, noindent=False, prefix='', variables=[])) Get auth_ref Only an authorized user may issue a new token. Traceback (most recent call last): File "/usr/lib/python3/dist-packages/cliff/app.py", line 387, in run_subcommand result = cmd.run(parsed_args) File "/usr/lib/python3/dist-packages/osc_lib/command/command.py", line 41, in run return super(Command, self).run(parsed_args) File "/usr/lib/python3/dist-packages/cliff/display.py", line 100, in run column_names, data = self.take_action(parsed_args) File "/usr/lib/python3/dist-packages/openstackclient/identity/v3/token.py", line 180, in take_action _("Only an authorized user may issue a new token.")) osc_lib.exceptions.AuthorizationFailure: Only an authorized user may issue a new token. clean_up IssueToken: Only an authorized user may issue a new token. Traceback (most recent call last): File "/usr/lib/python3/dist-packages/osc_lib/shell.py", line 135, in run ret_val = super(OpenStackShell, self).run(argv) File "/usr/lib/python3/dist-packages/cliff/app.py", line 267, in run result = self.run_subcommand(remainder) File "/usr/lib/python3/dist-packages/osc_lib/shell.py", line 180, in run_subcommand ret_value = super(OpenStackShell, self).run_subcommand(argv) File "/usr/lib/python3/dist-packages/cliff/app.py", line 387, in run_subcommand result = cmd.run(parsed_args) File "/usr/lib/python3/dist-packages/osc_lib/command/command.py", line 41, in run return super(Command, self).run(parsed_args) File "/usr/lib/python3/dist-packages/cliff/display.py", line 100, in run column_names, data = self.take_action(parsed_args) File "/usr/lib/python3/dist-packages/openstackclient/identity/v3/token.py", line 180, in take_action _("Only an authorized user may issue a new token.")) osc_lib.exceptions.AuthorizationFailure: Only an authorized user may issue a new token. END return value: 1
时间: 2025-06-19 20:13:58 浏览: 13
<think>我们正在解决OpenStacktokenissue授权失败的问题,特别是针对IdentityV3的admin用户。根据引用内容,我们可以总结以下关键点:1.引用[1]提到配置keystone后,openstacktokenissue失败,并参考了第三个解决方法(但未详细说明)。2.引用[2]展示了admin用户的权限和角色可能不明确,通过重新设置admin用户的项目和角色(将admin用户加入admin项目的admin角色)来修复。3.引用[3]说明获取token的三种方式,其中第一种是通过openstack命令获取。4.引用[4]提供了解决“Failedtodiscoveravailableidentityversions”错误的方法,即创建admin-openrc.sh环境变量文件并source它。结合以上引用和之前的问题,我们可以制定以下解决方案:###核心问题:admin用户权限不足或环境变量配置错误####解决步骤:#####1.验证admin用户权限(关键)根据引用[2],确保admin用户属于admin项目的admin角色:```bash#检查admin用户是否在admin项目中具有admin角色openstackroleassignmentlist--useradmin--projectadmin--roleadmin#如果没有,则添加:openstackroleadd--projectadmin--useradminadmin```#####2.配置正确的环境变量(关键)根据引用[4],创建`admin-openrc.sh`文件:```bashcat>admin-openrc.sh<<EOFexportOS_USERNAME=adminexportOS_PASSWORD=<your_admin_password>#替换为实际密码exportOS_PROJECT_NAME=adminexportOS_USER_DOMAIN_NAME=DefaultexportOS_PROJECT_DOMAIN_NAME=DefaultexportOS_AUTH_URL=http://controller:5000/v3#确保controller解析正确,或使用IPexportOS_IDENTITY_API_VERSION=3exportOS_REGION_NAME=RegionOneEOF#加载环境变量sourceadmin-openrc.sh```#####3.验证环境变量```bashecho$OS_AUTH_URL#应输出http://controller:5000/v3```#####4.重新获取令牌```bashopenstacktokenissue```####故障排除:-**错误:`Failedtodiscoveravailableidentityversions`**检查`OS_AUTH_URL`是否包含API版本(/v3)且Keystone服务运行正常[^4]。-**错误:`Identityserverrejectedauthorization`**检查admin用户密码是否正确,以及是否在admin项目中具有admin角色[^2]。-**网络问题**:确保能解析`controller`主机名(或在`/etc/hosts`中配置):```bashping-c4controller```-**服务状态**:确认Keystone服务运行:```bashsystemctlstatusopenstack-keystone```####补充:手动获取令牌(调试用)如果`openstacktokenissue`仍然失败,使用curl手动获取:```bashcurl-i\-H"Content-Type:application/json"\-d'{"auth":{"identity":{"methods":["password"],"password":{"user":{"domain":{"name":"Default"},"name":"admin","password":"<your_admin_password>"}}},"scope":{"project":{"domain":{"name":"Default"},"name":"admin"}}}}'\"http://controller:5000/v3/auth/tokens"```>返回的`X-Subject-Token`即为令牌(在HTTP头中)。###预防措施-**定期验证环境变量**:执行关键操作前务必确认`OS_*`变量正确。-**权限审计**:使用`openstackroleassignmentlist`定期检查关键用户权限。>通过以上步骤,应能解决admin用户生成令牌的授权问题。若仍失败,请检查Keystone日志:>```bash>tail-f/var/log/keystone/keystone.log>```§§相关问题§§1.如何为OpenStack创建具有管理员权限的新用户?2.如何重置OpenStackadmin用户的密码?3.OpenStack服务端点(endpoint)管理的最佳实践是什么?4.如何诊断OpenStackKeystone的身份验证流程?5.在OpenStack中,项目(project)、域(domain)和角色(role)之间的关系是什么?</think>### OpenStack Token Issue 授权失败解决方案 (Identity V3 Admin User)
根据引用内容,您遇到的`Only an authorized user may issue a new token`错误主要是由于admin用户权限配置问题或环境变量缺失导致的。以下是系统化的解决方案:
---
#### 1. **验证admin用户权限配置** [^2]
关键检查admin用户的项目和角色关联:
```bash
# 检查admin用户详情
openstack user show admin
# 确保admin用户关联到admin项目
openstack user set --project admin admin
# 添加admin角色到用户和项目
openstack role add --project admin --user admin admin
# 验证关联关系
openstack role assignment list --user admin --project admin
```
> **预期输出**:应显示`admin`用户、`admin`项目、`admin`角色的关联关系
---
#### 2. **配置环境变量文件** [^4]
创建`admin-openrc.sh`文件:
```bash
cat > admin-openrc.sh <<EOF
export OS_USERNAME=admin
export OS_PASSWORD=your_admin_password # 替换为实际密码
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://controller:5000/v3 # 确认IP/域名
export OS_IDENTITY_API_VERSION=3
export OS_REGION_NAME=RegionOne
EOF
# 加载环境变量
source admin-openrc.sh
```
---
#### 3. **手动获取Token验证**
使用curl直接测试Keystone API:
```bash
curl -i \
-H "Content-Type: application/json" \
-d '
{
"auth": {
"identity": {
"methods": ["password"],
"password": {
"user": {
"domain": {"name": "Default"},
"name": "admin",
"password": "your_admin_password"
}
}
},
"scope": {
"project": {
"domain": {"name": "Default"},
"name": "admin"
}
}
}
}' \
"http://controller:5000/v3/auth/tokens"
```
> **关键检查**:
> - 响应头中的`X-Subject-Token`
> - HTTP状态码应为201 Created
---
#### 4. **Keystone服务端验证**
在控制节点执行:
```bash
# 检查服务状态
sudo systemctl status openstack-keystone
# 检查端点注册
openstack endpoint list --service identity
# 查看错误日志
sudo tail -50 /var/log/keystone/keystone.log | grep -i token
```
---
#### 5. **权限策略修复** [^1]
如果日志显示策略错误:
```bash
# 临时放宽策略(测试用)
sudo setenforce 0 # 关闭SELinux
或
sudo aa-complain /usr/bin/keystone-all # AppArmor
# 永久修复
sudo vi /etc/keystone/policy.json
# 确保包含:"admin_required": "role:admin"
```
---
### 验证步骤
```bash
# 1. 加载环境变量
source admin-openrc.sh
# 2. 获取令牌
openstack token issue
# 3. 验证输出
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | 2023-08-15T10:00:00+0000 |
| id | gAAAAABl... (长字符串) |
| project_id | fda820529c814812a7ab5fdcb878b291 |
| user_id | 840931be05dc4e36945bc8d1a6d0fe1c |
+------------+----------------------------------+
```
> **常见错误原因**:
> 1. 环境变量未正确加载(特别是`OS_AUTH_URL`缺少`/v3`后缀)
> 2. admin用户未关联admin项目 [^2]
> 3. Keystone策略文件(`policy.json`)配置错误
> 4. 防火墙阻止5000端口访问
阅读全文
相关推荐


















