Repository: ansible/ansible

Issue:
OpenStack authentication not working anymore?
##### Issue Type:
- Bug Report
##### Ansible Version:

```
$ ansible --version
ansible 2.1.0 (devel 11f081cb99) last updated 2016/02/19 16:15:02 (GMT -400)
  lib/ansible/modules/core: (detached HEAD 8d126bd877) last updated 2016/02/19 16:15:05 (GMT -400)
  lib/ansible/modules/extras: (detached HEAD f6c5ed987f) last updated 2016/02/19 16:15:08 (GMT -400)
  config file = /home/darwiner/ansible/ansible.cfg
  configured module search path = Default w/o overrides
```
##### Ansible Configuration:

None relevant.
##### Environment:

Ansible host:  CentOS release 6.6 (Final)
##### Summary:

OpenStack authentication does not seem to be working anymore.
##### Steps To Reproduce:

```
$ ansible-playbook -i inventory/production --private-key=~/.ssh/ostack-infra-key playbooks/infra-ostack-create-centos7-test.yaml

PLAY [OpenStack] ***************************************************************

TASK [os-security-group : Group | Create security group] ***********************
failed: [127.0.0.1] => (item={u'name': u'infra-test', u'description': u'Infra-Test'}) => {"failed": true, "item": {"description": "Infra-Test", "name": "infra-test"}, "msg": "Error fetching security group list: SSL exception connecting to https://mtl-ostack.example.com:5000/v2.0/tokens: [Errno bad ca_certs: 'True'] [('system library', 'fopen', 'No such file or directory'), ('BIO routines', 'BIO_new_file', 'no such file'), ('x509 certificate routines', 'X509_load_cert_crl_file', 'system lib')]"}

NO MORE HOSTS LEFT *************************************************************
        to retry, use: --limit @playbooks/infra-ostack-create-centos7-test.retry

PLAY RECAP *********************************************************************
127.0.0.1                  : ok=0    changed=0    unreachable=0    failed=1

TASK: os-security-group : Group | Create security group ----------------- 2.57s
Playbook run took 0 days, 0 hours, 0 minutes, 2 seconds
```
##### Expected Results:

```
$ ansible-playbook -i inventory/production --private-key=~/.ssh/ostack-infra-key playbooks/infra-ostack-create-centos7-test.yaml

PLAY [OpenStack] ***************************************************************

TASK [os-security-group : Group | Create security group] ***********************
ok: [127.0.0.1] => (item={u'name': u'infra-test', u'description': u'Infra-Test'})

TASK [os-security-group : debug] ***********************************************

TASK [os-security-group : Group | Create security group rules] *****************
[DEPRECATION WARNING]: Using bare variables is deprecated. Update your playbooks so that the environment value uses the full variable syntax ('{{os_security_group_rule}}'). This feature will be removed in a 
future release. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.
ok: [127.0.0.1] => (item={u'port_range_min': -1, u'port_range_max': -1, u'protocol': u'icmp', u'remote_ip_prefix': u'0.0.0.0/0'})
ok: [127.0.0.1] => (item={u'port_range_min': 22, u'port_range_max': 22, u'protocol': u'tcp', u'remote_ip_prefix': u'0.0.0.0/0'})
ok: [127.0.0.1] => (item={u'port_range_min': 80, u'port_range_max': 80, u'protocol': u'tcp', u'remote_ip_prefix': u'0.0.0.0/0'})
ok: [127.0.0.1] => (item={u'port_range_min': 443, u'port_range_max': 443, u'protocol': u'tcp', u'remote_ip_prefix': u'0.0.0.0/0'})

TASK [os-security-group : debug] ***********************************************

PLAY RECAP *********************************************************************
127.0.0.1                  : ok=2    changed=0    unreachable=0    failed=0

TASK: os-security-group : Group | Create security group rules ----------- 9.32s
TASK: os-security-group : Group | Create security group ----------------- 2.87s
TASK: os-security-group : debug ----------------------------------------- 0.07s
TASK: os-security-group : debug ----------------------------------------- 0.07s
Playbook run took 0 days, 0 hours, 0 minutes, 12 seconds
```
##### Actual Results:

Running with ansible from 2016/02/19, commit 11f081cb99, the playbook does not work correctly.

Running with ansible from 2016/02/10, commit 1b8dec9c88, the playbook works correctly.

Tried looking at changes between the two dates to pinpoint what might have changed, but not finding anything in particular...

The only module that gets called before the error happens, is os_security_group.

The auth_url specified in clouds.yaml is using a valid SSL certificate (not self-signed).



Discussion:
cc @emonty @Shrews

Hrm, odd. Can you try pulling in this patch and see if you get any different results?

https://github.com/ansible/ansible/pull/14500

Just tried it out.  Seems like there's no change.  Same error happens.
- Pulled devel from today.

```
$ ansible --version
ansible 2.1.0 (devel 3e28ee0fd4) last updated 2016/02/26 11:22:55 (GMT -400)
  lib/ansible/modules/core: (detached HEAD 132b8e8f51) last updated 2016/02/26 11:22:59 (GMT -400)
  lib/ansible/modules/extras: (detached HEAD 479f99678b) last updated 2016/02/26 11:23:02 (GMT -400)
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
```

```
$ curl https://patch-diff.githubusercontent.com/raw/ansible/ansible/pull/14500.patch > 14500.patch
$ git apply 14500.patch 
```

```
$ ansible-playbook -i inventory/production --private-key=~/.ssh/ostack-infra-key playbooks/infra-ostack-create-centos7-test.yaml

PLAY [OpenStack] ***************************************************************

TASK [os-security-group : Group | Create security group] ***********************
failed: [127.0.0.1] (item={u'name': u'infra-test', u'description': u'Infra-Test'}) => {"failed": true, "item": {"description": "Infra-Test", "name": "infra-test"}, "msg": "Error fetching security group list: SSL exception connecting to https://mtl-ostack.example.com:5000/v2.0/tokens: [Errno bad ca_certs: 'True'] [('system library', 'fopen', 'No such file or directory'), ('BIO routines', 'BIO_new_file', 'no such file'), ('x509 certificate routines', 'X509_load_cert_crl_file', 'system lib')]"}

NO MORE HOSTS LEFT *************************************************************
        to retry, use: --limit @playbooks/infra-ostack-create-centos7-test.retry

PLAY RECAP *********************************************************************
127.0.0.1                  : ok=0    changed=0    unreachable=0    failed=1   

TASK: os-security-group : Group | Create security group ----------------- 3.70s
Playbook run took 0 days, 0 hours, 0 minutes, 3 seconds
```

Hi
verify parameter is a bool, maybe need to have it's type defined.
`verify=dict(default=True, type='bool', aliases=['validate_certs']),`

for me it solve the problem


Resolving patch:
diff --git a/lib/ansible/module_utils/openstack.py b/lib/ansible/module_utils/openstack.py
--- a/lib/ansible/module_utils/openstack.py
+++ b/lib/ansible/module_utils/openstack.py
@@ -77,7 +77,7 @@ def openstack_full_argument_spec(**kwargs):
         auth=dict(default=None, type='dict', no_log=True),
         region_name=dict(default=None),
         availability_zone=dict(default=None),
-        verify=dict(default=True, aliases=['validate_certs']),
+        verify=dict(default=True, type='bool', aliases=['validate_certs']),
         cacert=dict(default=None),
         cert=dict(default=None),
         key=dict(default=None, no_log=True),


Test patch: