Keystone Validation Error Code 404

[Oliver Wehrli]

Dear community,

**Update**

On my HP VAN SDN Controller v2.3.5 I continuously receive the following error:

Failed to validate token f16056645b7a486f9112d68a573377bf due to com.hp.api.auth.AuthenticationException: Validation error code 404.

The error keeps reappearing in intervals of a few minutes.

Any input on the root cause of this error and how to resolve it would be highly appreciated. If you need any additional input please let me know.

Regards

[EricAtHP · Accepted solution]

Hi Oliver,

I have seen this before. In my case, it was a broswer window that has been open for longer than the token expiration time. Try closing all browsers that are connected to protector and re-launching.

[Oliver Wehrli]

Hi Eric,

I've monitored the situation for a few days now. I see the error reappearing every once in a while, but not in the frequency that I had before.

It appears that this has been the root cause after all.

Thank you very much and best regards,

Oliver

[sdnindia]

Hello Oliver,

Doing a follow up to check if you need any further assistance with respect to the query posted.

Please do let us know  if your problem is solved.

If you have more questions on the same topic please do reply on the same thread or open a new post if new topic.

Thanks

HP SDN Team

[sllow]

Hi

I got the same error after i upgarde my controller from 2.4 to 2.5.15

[2015-05-27 05:21:17.247] ERROR http-bio-8443-exec-7 hp.keystone Failed to validate token 8aa8ad5823f646b69508aebd12a787db due to com.hp.api.auth.AuthenticationException: Validation error code 404

I reinstall keystone , restart SDNC , but everytime when i try to login to controller UI using sdn/skyline i got the above error

[piricchio72]

Hello,

After you reinstalled keystone, did you check whether the sdn user is present in keystone? 

keystone --os-endpoint http://127.0.0.1:35357/v2.0 --os-token ADMIN user-list

or

keystone --endpoint http://127.0.0.1:35357/v2.0 --token ADMIN user-list

the above depending from the keystone version running.

If the user is not there, please try to create it executing the script:

sudo /opt/sdn/admin/config_local_keystone

as from the installation guide.

Regards,

Antonio

SDN Team

[sllow]

Yes The user are in keystone.

oneadmin@ubuntu:/etc/sdn$ keystone --os-endpoint http://127.0.0.1:35357/v2.0 --os-token ADMIN user-list
+----------------------------------+------+---------+-------+
| id | name | enabled | email |
+----------------------------------+------+---------+-------+
| 05fd7f1101814ea7a526cb59dfb04860 | sdn | True | |
| c8077212660c469ca711968b1b508cd3 | test | True | test |
+----------------------------------+------+---------+-------+

The strange thing is i can do CURL via command line successfully , but i am unable to login to UI even after i restart the browser

/usr/bin/curl -sk -H Content-Type:application/json -d {"login":{"user":"sdn","password":"skyline","domain":"sdn"}} https://172.16.4.8:8443/sdn/v2.0/auth
{"record":{"token":"59a27f7d913e4cb1adaae3bd74253ca4","expiration":1432780102000,"expirationDate":"2015-05-27 22-28-22 -0400","userId":"05fd7f1101814ea7a526cb59dfb04860","userName":"sdn","domainId":"ae3ef03bbfc44ad2a90ea5173aa1dc31","domainName":"sdn","roles":["sdn-user","sdn-admin"]}}

[piricchio72]

Hi,

Then I suspect the issue is on the keystone.conf file.

As explained the installation manual:

UUID is the default provider type for the Folsom release of Keystone. However, if the remote machine

supporting your Keystone server is running the Grizzly, Havana, or Icehouse version of Keystone

(which all use the PKI provider type), edit the /etc/keystone/keystone.conf file on your

Keystone server by adding the following line to set UUID as the provider type:

provider=keystone.token.providers.uuid.Provider

Can you please check whether the setting is correct on your file.

If not present please add it to the file accordingly (as from the manual):

#

# Options defined in keystone

#

# External auth mechanisms that should add bind information to

# token e.g. kerberos, x509. (list value)

#bind=

# Enforcement policy on tokens presented to keystone with bind

# information. One of disabled, permissive, strict, required

# or a specifically required bind mode e.g. kerberos or x509

# to require binding to that authentication. (string value)

#enforce_token_bind=permissive

# Amount of time a token should remain valid (in seconds).

# (integer value)

#expiration=3600

# Controls the token construction, validation, and revocation

# operations. Core providers are

# "keystone.token.providers.[pki|uuid].Provider". (string

# value)

provider=keystone.token.providers.uuid.Provider1

# Keystone Token persistence backend driver. (string value)

#driver=keystone.token.backends.sql.Token

# Toggle for token system cacheing. This has no effect unless

# global caching

Let me know whether this solves the issue.

Regards,

Antonio

SDN Team

[sllow]

Thanks , I   reinstall the controller to solve the problem before i see your post , i will try this out next time if i encountered it again

Thanks