Errors — keystonemiddleware — branch stable/2026.2
Branch
stable/2026.2@3a8a835bb573— repository https://opendev.org/openstack/keystonemiddleware — analysed on 2026-10-28
1. What the caller of the protected service receives
| Situation | Status returned by the middleware | Source |
|---|---|---|
no token, invalid token (Keystone 404), expired token, access rules not satisfied, bind not satisfied, invalid service token, service token without a service role (if required) | 401 {"error": {"code": 401, "title": "Unauthorized", "message": "The request you have made requires authentication."}} + WWW-Authenticate: Keystone uri="…", **unless delay_auth_decision** | keystonemiddleware/auth_token/__init__.py:675-693 |
Keystone unreachable, timeout, discovery failure, or ServiceError (5xx from Keystone, or the middleware's own credentials refused twice) | 503 "The Keystone service is temporarily unavailable." (with delay_auth_decision: the token is treated as invalid) | keystonemiddleware/auth_token/__init__.py:727-776 |
EndpointNotFound (no identity endpoint in the middleware's catalog) | the identity server cache is invalidated and the exception is re-raised: 500 [inferred: not caught higher up] | keystonemiddleware/auth_token/__init__.py:770-773 |
| 401 sent by the protected service itself | WWW-Authenticate is added | keystonemiddleware/auth_token/__init__.py:710-725 |
The messages sent to the caller are generic. The detail only goes to the logs.
2. Translation of Keystone's responses (keystonemiddleware/auth_token/_identity.py:130-170)
Keystone response to GET /v3/auth/tokens | Middleware exception | Log |
|---|---|---|
| 404 | InvalidToken → 401 to the caller | INFO "Authorization failed for token", plus Keystone's response |
| 401 (the middleware's token rejected) | one retry with a fresh service token, then ServiceError → 503 | INFO "Identity server rejected authorization", WARNING with the response |
| other HTTP error | ServiceError → 503 | ERROR "Bad response code while validating token: …" |
| unreadable token body | InvalidToken | WARNING "Invalid token contents." (keystonemiddleware/auth_token/__init__.py:439-450) |
Classes: InvalidToken, ServiceError and RevocationListError (keystonemiddleware/auth_token/_exceptions.py:19-27); ConfigurationError (keystonemiddleware/exceptions.py:18).
3. Errors that only show in the logs
CRITICAL "Unable to validate token: …": Keystone unreachable (keystonemiddleware/auth_token/__init__.py:754-765).WARNING "A valid token was submitted as a service token, but it was not a valid service token…": once per process, whenservice_token_roles_required = false(keystonemiddleware/auth_token/__init__.py:371-382).WARNING "Cannot validate request with restricted access rules. Set service_type in [keystone_authtoken]…"(keystonemiddleware/auth_token/__init__.py:543-570).- audit: any error while building or sending the CADF event is logged and ignored, so the request still goes through (
_log_and_ignore_error,keystonemiddleware/audit/__init__.py:71-80).
Source: reverse-spec-keystonemiddleware/02-errors_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.