OpenStack CLI commands fail with 'The request you have made requires authentication. (HTTP 401)', or getting errors when sourcing rc files

Solution In Progress - Updated -

Environment

  • Red Hat OpenStack Platform 13 (RHOSP 13)
  • Red Hat OpenStack Platform 16 (RHOSP 16)
  • Red Hat OpenStack Platform 17 (RHOSP 17)

Issue

  • Attempts to query the OpenStack CLI fail with an authentication error.
  • You may receive strange errors during the sourcing of an rc file, such as '-bash: ...: command not found', or when echoing the $OS_PASSWORD environment variable, the password is not as expected.
(undercloud) [stack@undercloud-0 ~]$ openstack server list
The request you have made requires authentication. (HTTP 401) (Request-ID: req-4a0c6362-0c81-4cd2-9b3a-036e3419a2c4)

Resolution

  • Whilst having special characters is fine in Horizon, this is because Horizon is able to escape the characters for you upon submission of the Login form.
  • As such, we need to manually escape the special characters in the OS_PASSWORD environment variable, either with backslashes or by wrapping the variable in single-quotes.
(undercloud) [stack@undercloud-0 ~]$ export OS_PASSWORD=fake;rest!ofthepa$$word!!
(undercloud) [stack@undercloud-0 ~]$ echo $OS_PASSWORD
-bash: rest!ofthepa19647word!!: command not found

(undercloud) [stack@undercloud-0 ~]$ export OS_PASSWORD=fake\;rest\!ofthepa\$\$word\!\!
(undercloud) [stack@undercloud-0 ~]$ echo $OS_PASSWORD
fake;rest!ofthepa$$word!!

## OR ##

(undercloud) [stack@undercloud-0 ~]$ export OS_PASSWORD='fake;rest!ofthepa$$word!!'
(undercloud) [stack@undercloud-0 ~]$ echo $OS_PASSWORD
fake;rest!ofthepa$$word!!

Root Cause

  • By default, the rc files generated by OpenStack do not use single-quotation marks or escape characters for any Bash special characters.
  • When the environment variable is sourced, if the Bash shell detects the presence of special characters, it will try to expand them.
    • The expansion behaviour will be different, depending on both the shell and the special character, and can result in having different error messages.
    • This article aims to cover some of the more common ones, but cannot cover all possible special character interactions.
  • Special characters, such as #, ! and $ should be escaped in the rc file or if exporting the OS_PASSWORD variable directly in the bash terminal.
  • It's generally considered easier to wrap the variable in single-quotes, which tells Bash specifically not to expand any special characters. However, double-quotes will still be expanded, so ensure you are using single-quotes or escape characters with backslashes.
  • Do not combine the two methods, or else the OS_PASSWORD variable will contain literal backslashes that do not escape any characters.

Diagnostic Steps

(undercloud) [stack@undercloud-0 ~]$  vi ~/stackrc
export OS_PASSWORD=fake;rest!ofthepa$$word!!

(undercloud) [stack@undercloud-0 ~]$  . ~/stackrc
-bash: rest!ofthepa19647word!!: command not found

(undercloud) [stack@undercloud-0 ~]$ openstack server list
The request you have made requires authentication. (HTTP 401) (Request-ID: req-4a0c6362-0c81-4cd2-9b3a-036e3419a2c4)

(undercloud) [stack@undercloud-0 ~]$ vi ~/stackrc
export OS_PASSWORD=fake\;rest!ofthepa$$word!!

(undercloud) [stack@undercloud-0 ~]$ . ~/stackrc
(undercloud) [stack@undercloud-0 ~]$ echo $OS_PASSWORD
fake;rest!ofthepa19647word!!

(undercloud) [stack@undercloud-0 ~]$ vi ~/stackrc
export OS_PASSWORD=fake\;rest\!ofthepa\$\$word\!\!

(undercloud) [stack@undercloud-0 ~]$ . ~/stackrc
(undercloud) [stack@undercloud-0 ~]$ echo $OS_PASSWORD
fake;rest!ofthepa$$word!!

(undercloud) [stack@undercloud-0 ~]$ openstack stack list
+--------------------------------------+------------+----------------------------------+-----------------+----------------------+----------------------+
| ID                                   | Stack Name | Project                          | Stack Status    | Creation Time        | Updated Time         |
+--------------------------------------+------------+----------------------------------+-----------------+----------------------+----------------------+
| e2f2f379-5617-4230-8199-b02197a088ac | overcloud  | be472a074a054d97bf4e3bfb2c1afc76 | UPDATE_COMPLETE | 2022-11-12T08:31:24Z | 2022-11-13T22:48:30Z |
+--------------------------------------+------------+----------------------------------+-----------------+----------------------+----------------------+

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments