Submitted review request for django-horizon (openstack dashboard)

[Cole Robinson]

Hi all, I've submitted a review request for django-horizon, the django module
for talking to Openstack. This contains the openstack-dashboard subpackage
which is the web UI implementation (basically the openstack shiny goodness) :)

I'm hitting an annoying problem though. The httpd+wsgi integration allows the
dashboard to start up, but I can't log in, the UI just reports that I'm 'not
authorized to view /syspanel' (which is the screen it generally dumps the
admin user to after login). Some debugging shows that we are successfully
authenticating, but it seems like the code is reinvoked several times which
stomps our http_session ID and horizon forgets about our authentication before
we can advance to the next screen. The package works fine if you use a django
style manage.py script, so it doesn't seem to be anything fundamentally busted.

Here's the file I'm dropping in /etc/httpd/conf.d:
$ cat /etc/httpd/conf.d/openstack-dashboard.conf
WSGIDaemonProcess openstack-dashboard
WSGIScriptAlias / /usr/share/openstack-dashboard/dashboard/wsgi/django.wsgi

<Directory /usr/share/openstack-dashboard/dashboard/wsgi>
  Order allow,deny
  Allow from all
</Directory>

Any pointers appreciated. And here's the review if anyone wanted to poke at it:

https://bugzilla.redhat.com/show_bug.cgi?id=785946

Thanks,
Cole

[Derek Higgins]

On 01/31/2012 12:39 AM, Cole Robinson wrote:
>  I'm hitting an annoying problem though. The httpd+wsgi
> integration allows the
>  dashboard to start up, but I can't log in, the UI just reports that I'm 'not
>  authorized to view /syspanel' (which is the screen it generally dumps the
>  admin user to after login). Some debugging shows that we are successfully
>  authenticating, but it seems like the code is reinvoked several times which
>  stomps our http_session ID and horizon forgets about our authentication before
>  we can advance to the next screen. The package works fine if you use a django
>  style manage.py script, so it doesn't seem to be anything fundamentally busted.
>  
>  Here's the file I'm dropping in /etc/httpd/conf.d:
>  $ cat /etc/httpd/conf.d/openstack-dashboard.conf
>  WSGIDaemonProcess openstack-dashboard
>  WSGIScriptAlias / /usr/share/openstack-dashboard/dashboard/wsgi/django.wsgi
>  
>  <Directory /usr/share/openstack-dashboard/dashboard/wsgi>
>    Order allow,deny
>    Allow from all
>  </Directory>
>  
>  Any pointers appreciated. 
Hi Cole,

   I havn't tried any of this but Can you see if the same thing happens
if you restrict apache to 1 python process, by setting up a process group

WSGIDaemonProcess pgroup processes=1 threads=1
WSGIProcessGroup pgroup

it may be no help at all but if you still have the same problem after
this change you know its not caused by having multiple python processes.

what I'm trying to rule out is the possibility of one python process
authenticating and then another (if there is one) receiving the second
request from your browser. The default number of processes may actually
be 1 but its worth trying by setting it explicitly.

Thanks,
Derek.

[Cole Robinson]

On 01/31/2012 05:25 AM, Derek Higgins wrote:
>  On 01/31/2012 12:39 AM, Cole Robinson wrote:
> > I'm hitting an annoying problem though. The httpd+wsgi integration allows the
> > dashboard to start up, but I can't log in, the UI just reports that I'm
> 'not
> > authorized to view /syspanel' (which is the screen it generally dumps the
> > admin user to after login). Some debugging shows that we are successfully
> > authenticating, but it seems like the code is reinvoked several times which
> > stomps our http_session ID and horizon forgets about our authentication before
> > we can advance to the next screen. The package works fine if you use a django
> > style manage.py script, so it doesn't seem to be anything fundamentally busted.
> >
> > Here's the file I'm dropping in /etc/httpd/conf.d:
> > $ cat /etc/httpd/conf.d/openstack-dashboard.conf
> > WSGIDaemonProcess openstack-dashboard
> > WSGIScriptAlias / /usr/share/openstack-dashboard/dashboard/wsgi/django.wsgi
> >
> > <Directory /usr/share/openstack-dashboard/dashboard/wsgi>
> >   Order allow,deny
> >   Allow from all
> > </Directory>
> >
> > Any pointers appreciated.
>  
>  Hi Cole,
>  
>     I havn't tried any of this but Can you see if the same thing happens
>  if you restrict apache to 1 python process, by setting up a process group
>  
>  WSGIDaemonProcess pgroup processes=1 threads=1
>  WSGIProcessGroup pgroup
>  
>  it may be no help at all but if you still have the same problem after
>  this change you know its not caused by having multiple python processes.
>  
>  what I'm trying to rule out is the possibility of one python process
>  authenticating and then another (if there is one) receiving the second
>  request from your browser. The default number of processes may actually
>  be 1 but its worth trying by setting it explicitly.
>  
>  Thanks,
>  Derek. 
Derek, you are my hero. A minor variation of that worked, I needed to add

WSGISocketPrefix /tmp

to silence socket permission errors in /var/log/httpd/error_log (we can
probably change that to /var/lib/openstack-dashboard or similar, i'll play
around with it).

Thanks a bunch!
- Cole

[Derek Higgins]

On 01/31/2012 03:27 PM, Cole Robinson wrote:
>  Derek, you are my hero. A minor variation of that worked, I needed to
> add
>  
>  WSGISocketPrefix /tmp
>  
>  to silence socket permission errors in /var/log/httpd/error_log (we can
>  probably change that to /var/lib/openstack-dashboard or similar, i'll play
>  around with it).
>  
>  Thanks a bunch!
>  - Cole 
No problem, I'm not sure I was even thinking of that as a possibility
but hey, I'll take the credit :-)

Thanks,
Derek.

[Cole Robinson]

On 01/31/2012 10:42 AM, Derek Higgins wrote:
>  On 01/31/2012 03:27 PM, Cole Robinson wrote:
> > Derek, you are my hero. A minor variation of that worked, I needed to add
> >
> > WSGISocketPrefix /tmp
> >
> > to silence socket permission errors in /var/log/httpd/error_log (we can
> > probably change that to /var/lib/openstack-dashboard or similar, i'll play
> > around with it).
> >
> > Thanks a bunch!
> > - Cole
>  
>  No problem, I'm not sure I was even thinking of that as a possibility
>  but hey, I'll take the credit :-)
>   
Well, I meant a minor variation _on_top_ of what you suggested :) End result is:

$ cat /etc/httpd/conf.d/openstack-dashboard.conf
WSGIDaemonProcess dashboard processes=1 threads=1
WSGIProcessGroup dashboard
WSGISocketPrefix /tmp
WSGIScriptAlias / /usr/share/openstack-dashboard/dashboard/wsgi/django.wsgi

<Directory /usr/share/openstack-dashboard/dashboard/wsgi>
  Order allow,deny
  Allow from all
</Directory>

Thanks,
Cole