request: when using an auth-helper fail early if exit code is not zero

[justdan96]

I'm using an authentication helper command to help us integrate the Rust Openstack clients with SSO. However in cases where the SSO authentication fails, or we need to repopulate the local SSO cache, I'd like for the client's authentication flow to fail early. Ideally if the exit code is not zero then the clients would just not proceed with the rest of the request. At the moment my authentication helper exits with code 1 but the osc command will continue until it gets a 404 against the /auth/tokens endpoint. Perhaps it would be nicer if the Openstack client quit when it got exit code !=0 from the auth-helper, and then the stderr warning messages get upgraded to error messages instead, to make it clearer what has happened?

[gtema]

I am right now in the process of a heavy rework of auth methods (separating them into individual "plugins") what affects auth_helper. In general - sure, when auth_helper raises an error there is no need to proceed and honestly wondering that it does not behave like that. Can you please put here small log so that I nail down where it is ignored.
Other question - which type of the SSO are you building this way? I just want to understand how you are building the flow (eventually there is an error in the specific auth method implementation)

[justdan96]

Sure, the authentication flow currently looks like this:

1. Run osc command
2. osc calls out to authentication helper (written in Python) to gather token
3. Authentication helper checks local SSO cache, if it is empty or expired then error out and prompt user to run authentication helper command standalone to do the SSO process (this doesn't really work, user sees a 404 error!)
4. User runs authentication helper command standalone, it prompts for their password
5. User types their password and then responds to MFA
6. If it fails then the user sees the same 404 error
7. Authentication helper command adds the SSO token to its own cache, so we don't have to do MFA every time
8. Next time we run an osc command for that cloud the authentication helper can find the token in its own cache

How I would like it to work is:

1. Run osc command
2. osc determines if cached token has expired based on time (more than 24 hours old)
3. If so osc calls out to authentication helper (written in Python) to gather token
4. Authentication helper starts the password entry + MFA process
5. User types their password and then responds to MFA
6. If it fails then end osc command early, with error message passed back to the user on why the authentication failed
7. Authentication passes the SSO token back to osc, osc caches that token and then continues with the rest of the process

Some logs from trying to implement the new process, if I type the password incorrectly:

2026-03-10T10:37:31.402226Z TRACE openstack_sdk::config: Try load configuration file "/Users/user/.config/openstack/osc-clouds.yaml"
2026-03-10T10:37:31.406456Z TRACE openstack_sdk::config: Using config file "/Users/user/.config/openstack/osc-clouds.yaml"
2026-03-10T10:37:31.409649Z  WARN connect{renew_auth=false}: openstack_sdk::openstack_async: SSL Verification is disabled! Please consider using `cacert` for adding custom certificate instead.
2026-03-10T10:37:31.417500Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::catalog: Using catalog endpoint `ServiceEndpoint { url: "https://keystone.aznp-1.apc.example-np.net:5000/", region: Some("aznp-1"), interface: Some("public"), version: ApiVersion { major: 0, minor: 0 }, min_version: None, max_version: None, pid_segment: None }` for service_type: `identity` and version `None`
2026-03-10T10:37:31.417679Z  INFO connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::openstack_async: Performing `identity` endpoint version discovery
2026-03-10T10:37:31.418737Z  INFO connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: openstack_sdk::openstack_async: Sending request Request { method: GET, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("keystone.aznp-1.apc.example-np.net")), port: Some(5000), path: "/", query: None, fragment: None }, headers: {} }
2026-03-10T10:37:31.419068Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: checkout waiting for idle connection: ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:37:31.419095Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: reqwest::connect: starting new connection: https://keystone.aznp-1.apc.example-np.net:5000/
2026-03-10T10:37:31.419318Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::connect::http: Http::connect; scheme=Some("https"), host=Some("keystone.aznp-1.apc.example-np.net"), port=Some(Port(5000))
2026-03-10T10:37:31.602568Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::connect::http: connecting to 192.168.209.20:5000
2026-03-10T10:37:31.603100Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: mio::poll: registering event source with poller: token=Token(4873797888), interests=READABLE | WRITABLE
2026-03-10T10:37:31.753092Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::connect::http: connected to 192.168.209.20:5000
2026-03-10T10:37:31.950647Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::client: http1 handshake complete, spawning background dispatcher task
2026-03-10T10:37:31.950709Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::client: waiting for connection to be ready
2026-03-10T10:37:31.950795Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::client: connection is ready
2026-03-10T10:37:31.950839Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: checkout dropped for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:37:32.103771Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: put; add idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:37:32.103821Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: pooling idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:37:32.103989Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: reqwest::retry: shouldn't retry!
2026-03-10T10:37:32.104211Z  INFO connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: openstack_sdk::openstack_async: Request completed with status 300 Multiple Choices url="https://keystone.aznp-1.apc.example-np.net:5000/" duration_ms=685 status=300 method="GET" request_id="req-da5163d6-9ce1-4b50-b26e-17981a6c606a"
2026-03-10T10:37:32.109290Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::catalog::service_endpoint: Constructing request url for service endpoint https://keystone.aznp-1.apc.example-np.net:5000/ for ./
2026-03-10T10:37:32.109337Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::catalog::service_endpoint: Constructing request url for service endpoint https://keystone.aznp-1.apc.example-np.net:5000/v3/ for ./
2026-03-10T10:37:32.109351Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::openstack_async: Finished service version discovery at https://keystone.aznp-1.apc.example-np.net:5000/
2026-03-10T10:37:32.109449Z TRACE connect{renew_auth=false}: openstack_sdk::state: Get authz information for Unscoped
2026-03-10T10:37:32.111319Z TRACE connect{renew_auth=false}: openstack_sdk::state: Cached Auth info: ScopeAuths({})
2026-03-10T10:37:32.111426Z TRACE connect{renew_auth=false}: openstack_sdk::state: Searching requested scope authz in state
2026-03-10T10:37:32.111778Z TRACE connect{renew_auth=false}: openstack_sdk::state: Cached Auth info: ScopeAuths({})
2026-03-10T10:37:32.111894Z TRACE connect{renew_auth=false}: openstack_sdk::openstack_async: No Auth already available. Proceeding with new login
Password:
2026-03-10T10:37:36.812638Z  WARN connect{renew_auth=false}: openstack_sdk::auth::auth_helper: "osc-okta-auth" written to stderr during invocation: "Token has expired. Re-authenticating...\n/Users/user/.pyenv/versions/3.13.5/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'keystone.aznp-1.apc.example-np.net'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings\n  warnings.warn(\nERROR:__main__:Authentication failed: Authentication failed"
2026-03-10T10:37:36.813562Z DEBUG connect{renew_auth=false}:query: openstack_sdk::catalog: Using discovered endpoint `ServiceEndpoint { url: "https://keystone.aznp-1.apc.example-np.net:5000/v3/", region: Some("aznp-1"), interface: None, version: ApiVersion { major: 3, minor: 14 }, min_version: None, max_version: None, pid_segment: None }` for service_type: `identity` and version `Some(ApiVersion { major: 3, minor: 0 })`
2026-03-10T10:37:36.813580Z TRACE connect{renew_auth=false}:query: openstack_sdk::catalog::service_endpoint: Constructing request url for service endpoint https://keystone.aznp-1.apc.example-np.net:5000/v3/ for auth/tokens
2026-03-10T10:37:36.815115Z  INFO connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: openstack_sdk::openstack_async: Sending request Request { method: POST, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("keystone.aznp-1.apc.example-np.net")), port: Some(5000), path: "/v3/auth/tokens", query: Some(""), fragment: None }, headers: {"accept": "application/json", "content-type": "application/json"} }
2026-03-10T10:37:36.815140Z TRACE connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: openstack_sdk::openstack_async: Request Body: "{\"auth\":{\"identity\":{\"methods\":[\"token\"],\"token\":{\"id\":\"\"}}}}"
2026-03-10T10:37:36.815178Z TRACE connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: hyper_util::client::legacy::pool: take? ("https", keystone.aznp-1.apc.example-np.net:5000): expiration = Some(30s)
2026-03-10T10:37:36.815187Z DEBUG connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: hyper_util::client::legacy::pool: reuse idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:37:36.973623Z TRACE connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: hyper_util::client::legacy::pool: put; add idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:37:36.973674Z DEBUG connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: hyper_util::client::legacy::pool: pooling idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:37:36.973692Z TRACE connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: reqwest::retry: shouldn't retry!
2026-03-10T10:37:36.973987Z  INFO connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: openstack_sdk::openstack_async: Request completed with status 404 Not Found url="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" duration_ms=158 status=404 method="POST" request_id="req-428dbb8b-f85b-4614-8f33-3c15a5f8af7b"
2026-03-10T10:37:36.975930Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: pool closed, canceling idle interval
2026-03-10T10:37:36.976057Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: mio::poll: deregistering event source from poller
Error:
   0: authentication error
   1: api error: openstack server error:
      	uri: `/`
      	status: `404 Not Found`
      	message: `{"error":{"code":404,"message":"No token in the request","title":"Not Found"}}`
      	request-id: `req-428dbb8b-f85b-4614-8f33-3c15a5f8af7b`
   2: openstack server error:
      	uri: `/`
      	status: `404 Not Found`
      	message: `{"error":{"code":404,"message":"No token in the request","title":"Not Found"}}`
      	request-id: `req-428dbb8b-f85b-4614-8f33-3c15a5f8af7b`

Location:
   openstack_cli/src/bin/osc.rs:31

Going through the SSO process correctly results in this - from a user perspective the error is the same:

2026-03-10T10:41:43.853242Z TRACE openstack_sdk::config: Try load configuration file "/Users/user/.config/openstack/osc-clouds.yaml"
2026-03-10T10:41:43.856119Z TRACE openstack_sdk::config: Using config file "/Users/user/.config/openstack/osc-clouds.yaml"
2026-03-10T10:41:43.858324Z  WARN connect{renew_auth=false}: openstack_sdk::openstack_async: SSL Verification is disabled! Please consider using `cacert` for adding custom certificate instead.
2026-03-10T10:41:43.865736Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::catalog: Using catalog endpoint `ServiceEndpoint { url: "https://keystone.aznp-1.apc.example-np.net:5000/", region: Some("aznp-1"), interface: Some("public"), version: ApiVersion { major: 0, minor: 0 }, min_version: None, max_version: None, pid_segment: None }` for service_type: `identity` and version `None`
2026-03-10T10:41:43.865912Z  INFO connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::openstack_async: Performing `identity` endpoint version discovery
2026-03-10T10:41:43.866498Z  INFO connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: openstack_sdk::openstack_async: Sending request Request { method: GET, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("keystone.aznp-1.apc.example-np.net")), port: Some(5000), path: "/", query: None, fragment: None }, headers: {} }
2026-03-10T10:41:43.867112Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: checkout waiting for idle connection: ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:41:43.867138Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: reqwest::connect: starting new connection: https://keystone.aznp-1.apc.example-np.net:5000/
2026-03-10T10:41:43.867192Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::connect::http: Http::connect; scheme=Some("https"), host=Some("keystone.aznp-1.apc.example-np.net"), port=Some(Port(5000))
2026-03-10T10:41:44.030533Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::connect::http: connecting to 192.168.209.20:5000
2026-03-10T10:41:44.030820Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: mio::poll: registering event source with poller: token=Token(4930426624), interests=READABLE | WRITABLE
2026-03-10T10:41:44.184295Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::connect::http: connected to 192.168.209.20:5000
2026-03-10T10:41:44.378697Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::client: http1 handshake complete, spawning background dispatcher task
2026-03-10T10:41:44.378747Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::client: waiting for connection to be ready
2026-03-10T10:41:44.379039Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::client: connection is ready
2026-03-10T10:41:44.379091Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: checkout dropped for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:41:44.530056Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: put; add idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:41:44.530095Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: pooling idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:41:44.530159Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: reqwest::retry: shouldn't retry!
2026-03-10T10:41:44.530255Z  INFO connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: openstack_sdk::openstack_async: Request completed with status 300 Multiple Choices url="https://keystone.aznp-1.apc.example-np.net:5000/" duration_ms=663 status=300 method="GET" request_id="req-2d44d8f3-dfc7-4d27-ab3f-1c4b6751ba67"
2026-03-10T10:41:44.537058Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::catalog::service_endpoint: Constructing request url for service endpoint https://keystone.aznp-1.apc.example-np.net:5000/ for ./
2026-03-10T10:41:44.537094Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::catalog::service_endpoint: Constructing request url for service endpoint https://keystone.aznp-1.apc.example-np.net:5000/v3/ for ./
2026-03-10T10:41:44.537106Z DEBUG connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}: openstack_sdk::openstack_async: Finished service version discovery at https://keystone.aznp-1.apc.example-np.net:5000/
2026-03-10T10:41:44.537164Z TRACE connect{renew_auth=false}: openstack_sdk::state: Get authz information for Unscoped
2026-03-10T10:41:44.538491Z TRACE connect{renew_auth=false}: openstack_sdk::state: Cached Auth info: ScopeAuths({})
2026-03-10T10:41:44.538543Z TRACE connect{renew_auth=false}: openstack_sdk::state: Searching requested scope authz in state
2026-03-10T10:41:44.538711Z TRACE connect{renew_auth=false}: openstack_sdk::state: Cached Auth info: ScopeAuths({})
2026-03-10T10:41:44.538738Z TRACE connect{renew_auth=false}: openstack_sdk::openstack_async: No Auth already available. Proceeding with new login
Password:
2026-03-10T10:42:07.785380Z  WARN connect{renew_auth=false}: openstack_sdk::auth::auth_helper: "osc-okta-auth" written to stderr during invocation: "Token has expired. Re-authenticating...\n/Users/user/.pyenv/versions/3.13.5/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'keystone.aznp-1.apc.example-np.net'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings\n  warnings.warn(\n/Users/user/.pyenv/versions/3.13.5/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'keystone.aznp-1.apc.example-np.net'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings\n  warnings.warn(\n/Users/user/.pyenv/versions/3.13.5/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'keystone.aznp-1.apc.example-np.net'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings\n  warnings.warn(\nINFO:__main__:Token saved to /Users/user/.osc/aznp-1-token\nCOMMAND WILL FAIL, PLEASE RE-RUN!"
2026-03-10T10:42:07.785899Z DEBUG connect{renew_auth=false}:query: openstack_sdk::catalog: Using discovered endpoint `ServiceEndpoint { url: "https://keystone.aznp-1.apc.example-np.net:5000/v3/", region: Some("aznp-1"), interface: None, version: ApiVersion { major: 3, minor: 14 }, min_version: None, max_version: None, pid_segment: None }` for service_type: `identity` and version `Some(ApiVersion { major: 3, minor: 0 })`
2026-03-10T10:42:07.785917Z TRACE connect{renew_auth=false}:query: openstack_sdk::catalog::service_endpoint: Constructing request url for service endpoint https://keystone.aznp-1.apc.example-np.net:5000/v3/ for auth/tokens
2026-03-10T10:42:07.786527Z  INFO connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: openstack_sdk::openstack_async: Sending request Request { method: POST, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("keystone.aznp-1.apc.example-np.net")), port: Some(5000), path: "/v3/auth/tokens", query: Some(""), fragment: None }, headers: {"accept": "application/json", "content-type": "application/json"} }
2026-03-10T10:42:07.786549Z TRACE connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: openstack_sdk::openstack_async: Request Body: "{\"auth\":{\"identity\":{\"methods\":[\"token\"],\"token\":{\"id\":\"\"}}}}"
2026-03-10T10:42:07.786605Z TRACE connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: hyper_util::client::legacy::pool: take? ("https", keystone.aznp-1.apc.example-np.net:5000): expiration = Some(30s)
2026-03-10T10:42:07.786613Z DEBUG connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: hyper_util::client::legacy::pool: reuse idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:42:07.941739Z TRACE connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: hyper_util::client::legacy::pool: put; add idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:42:07.941805Z DEBUG connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: hyper_util::client::legacy::pool: pooling idle connection for ("https", keystone.aznp-1.apc.example-np.net:5000)
2026-03-10T10:42:07.941841Z TRACE connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: reqwest::retry: shouldn't retry!
2026-03-10T10:42:07.941985Z  INFO connect{renew_auth=false}:query:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" http.method="POST"}: openstack_sdk::openstack_async: Request completed with status 404 Not Found url="https://keystone.aznp-1.apc.example-np.net:5000/v3/auth/tokens?" duration_ms=155 status=404 method="POST" request_id="req-b694a161-7a58-431c-8a0e-74fd21a61a2a"
2026-03-10T10:42:07.943646Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: hyper_util::client::legacy::pool: pool closed, canceling idle interval
2026-03-10T10:42:07.944293Z TRACE connect{renew_auth=false}:discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.aznp-1.apc.example-np.net:5000/" http.method="GET"}: mio::poll: deregistering event source from poller
Error:
   0: authentication error
   1: api error: openstack server error:
      	uri: `/`
      	status: `404 Not Found`
      	message: `{"error":{"code":404,"message":"No token in the request","title":"Not Found"}}`
      	request-id: `req-b694a161-7a58-431c-8a0e-74fd21a61a2a`
   2: openstack server error:
      	uri: `/`
      	status: `404 Not Found`
      	message: `{"error":{"code":404,"message":"No token in the request","title":"Not Found"}}`
      	request-id: `req-b694a161-7a58-431c-8a0e-74fd21a61a2a`

Location:
   openstack_cli/src/bin/osc.rs:31

I realise this might be an issue with how I've written the authentication helper and maybe I could have architected this better! But in general the SSO process can't change so being able to fail the authentication process early and give the user more information on what happened would be great.

[justdan96]

Apologies, I just figured out today that if I pop up a message box to ask for the user's password, instead of prompting in the terminal, then the flow seems to work how I would like. Sorry again!