# Openstack swift as a cache proxy for nginx, swift proxy report 401 error when authenticate

**URL:** <https://www.ruby-forum.com/t/openstack-swift-as-a-cache-proxy-for-nginx-swift-proxy-report-401-error-when-authenticate/244180>\
**Category:** NGINX\
**Created:** [March 2, 2016, 4:20am UTC](https://www.ruby-forum.com/t/openstack-swift-as-a-cache-proxy-for-nginx-swift-proxy-report-401-error-when-authenticate/244180 "2016-03-02T04:20:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [March 2, 2016, 4:20am UTC](https://www.ruby-forum.com/t/openstack-swift-as-a-cache-proxy-for-nginx-swift-proxy-report-401-error-when-authenticate/244180/1 "2016-03-02T04:20:37Z")

</div>

hello, everybody.

I am trying to find a way to use Openstack swift to cache static file  
for a  
web server such as nginx, the below are request step:

1. nginx is configured as a load balance proxy server and web server.
2. There are several swift , suppose there are 2, that is  
swift-A,swift-B  
,swift-A is control node,and swift-B is storage node
3. client send a request to nginx for url:  
[http://domain.com/filename.txt](http://domain.com/filename.txt)
4. nginx received the request and it is a cache miss, it need to fetch  
the  
content from SWIFT proxy server,
5. nginx send a request to swift proxy server for authentication, the  
url  
looks like [http://swift-proxy/auth-account](http://swift-proxy/auth-account), account information is set  
in  
header, the response from swift proxy server contains a auth-token for  
that  
account if authentication success.
6. then nginx use this auth-token and put it in a new request header,  
and  
send the new request to the swift proxy server for the original request  
content, there could be a map between client request url to the swift  
proxy  
url, for example, /filename.txt → /account/container/filename.txt, so  
the  
new request url could be  
[http://swift-proxy/account/container/filename.txt,plus](http://swift-proxy/account/container/filename.txt,plus) the auth-token.
7. swift proxy server response the content to nginx, then nginx cache  
the  
content and pass the response to the client.

I have search for the answer on the internet, and referent this  
solution:

> **[Re: Does nginx support openstack swift API?](https://forum.nginx.org/read.php?2,250458,250463#msg-250463)**
>
> Hello guys, I'm trying to find a way to use OpenStack SWIFT with nginx, the below are request steps: 1. nginx is configured as proxy cache 2. client send a request to nginx for url: http://domain.com/filename.txt 3. nginx received the request and it...

Then ,I change my nginx configuration like this:

server {  
listen 80;  
server\_name localhost;  
location / {  
root html;  
index index.html index.htm;  
auth\_request /auth/v1.0;  
}  
location /auth/v1.0 {  
proxy\_pass [http://192.168.1.1:8080](http://192.168.1.1:8080);  
proxy\_pass\_request\_body off;  
proxy\_set\_header Content-Length “”;  
proxy\_set\_header X-Original-URI $request\_uri;  
}  
}

Port 80 is for nginx,port 8080 is for swift, both can work  
independently,  
but after I change the configuration ,use chrome browser enter:10.67.  
247.21,it just not working like what I expect, swift proxy return 401  
error,  
swift proxy logs report like this :

Mar 1 20:43:48 localhost journal: proxy-logging 192.168.1.1 192.168.1.1  
01/Mar/2016/20/43/48 GET /auth/v1.0 HTTP/1.0 401 -  
Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/28.0.1500.72%20Safari/537.36

- 
  - 131 - txbfc24355780143568445c4ddf5d774e3 - 0.0003 -  
Mar 1 20:43:48 localhost journal: tempauth - 192.168.1.1  
01/Mar/2016/20/43/48 GET /auth/v1.0 HTTP/1.0 401 -  
Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/28.0.1500.72%20Safari/537.36

- 
  - 
    - 
      - txbfc24355780143568445c4ddf5d774e3 - 0.0007

I don’t know does it matter if I use a chrome browser to send request to  
swift ,it looks like some unrecognized char are include in the request  
header .while I use shell command to send request, it works fine, like  
this  
:

[root@localhost ~]# curl -v -H ‘X-Storage-User: service:swift’ -H  
'X-Storage-Pass:swift ’ [http://192.168.1.1:8080/auth/v1.0](http://192.168.1.1:8080/auth/v1.0)

- Trying 192.168.1.1…
- Connected to 192.168.1.1 (192.168.1.1) port 8080 (#0)

> GET /auth/v1.0 HTTP/1.1  
> Host: 192.168.1.1:8080  
> User-Agent: curl/7.47.1  
> Accept: _/_  
> X-Storage-User: service:swift  
> X-Storage-Pass:swift

\< HTTP/1.1 200 OK  
\< X-Storage-Url: [http://192.168.1.1:8080/v1/AUTH\_service](http://192.168.1.1:8080/v1/AUTH_service)  
\< X-Auth-Token: AUTH\_tk4f2eaa45b35c47b4ab0b955710cce6da  
\< Content-Type: text/html; charset=UTF-8  
\< X-Storage-Token: AUTH\_tk4f2eaa45b35c47b4ab0b955710cce6da  
\< Content-Length: 0  
\< X-Trans-Id: tx3b90f2a8a3284f52951cc80ca41f104a  
\< Date: Tue, 01 Mar 2016 21:10:50 GMT  
\<

- Connection #0 to host 192.168.1.1 left intact

Below is my swift proxy-server.conf:

[DEFAULT]

bind\_port = 8080  
bind\_ip = 192.168.1.1

workers = 1

user = swift

log\_facility = LOG\_LOCAL1

eventlet\_debug = true

[pipeline:main]

pipeline = catch\_errors healthcheck proxy-logging cache tempurl  
ratelimit  
tempauth staticweb proxy-logging proxy-server

[filter:catch\_errors]

use = egg:swift#catch\_errors  
set log\_name = cache\_errors

[filter:healthcheck]

use = egg:swift#healthcheck  
set log\_name = healthcheck

[filter:proxy-logging]

use = egg:swift#proxy\_logging  
set log\_name = proxy-logging

[filter:ratelimit]

use = egg:swift#ratelimit  
set log\_name = ratelimit

[filter:crossdomain]

use = egg:swift#crossdomain  
set log\_name = crossdomain

[filter:tempurl]

use = egg:swift#tempurl  
set log\_name = tempurl

[filter:tempauth]  
use = egg:swift#tempauth  
set log\_name = tempauth  
user\_admin\_admin = admin .admin .reseller\_admin  
user\_test\_tester = testing .admin  
user\_test2\_tester2 = testing2 .admin  
user\_test\_tester3 = testing3  
user\_service\_swift = swift .admin

[filter:staticweb]

use = egg:swift#staticweb  
set log\_name = staticweb

[filter:cache]

use = egg:swift#memcache  
set log\_name = memcache

[app:proxy-server]

use = egg:swift#proxy  
set log\_name = proxy  
allow\_account\_management = true

account\_autocreate = true

I have no idea for the 401 error occurred and how to solve this  
question.Are  
there some configuration error in my swift or nginx configuration file?

Thanks for your time,  
Amy

Posted at Nginx Forum:

> **[openstack swift as a cache proxy for nginx,swift proxy report 401 error when...](https://forum.nginx.org/read.php?2,264991,264991#msg-264991)**
>
> hello, everybody. I am trying to find a way to use Openstack swift to cache static file for a web server such as nginx, the below are request step: 1. nginx is configured as a load balance proxy server and web server. 2. There are several swift ,...

---

<div class="post-metadata">

**Author:** ![AmyAmy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/76d3ee/32.png) [@AmyAmy](https://www.ruby-forum.com/u/AmyAmy)\
**Post date:** [March 2, 2016, 10:13am UTC](https://www.ruby-forum.com/t/openstack-swift-as-a-cache-proxy-for-nginx-swift-proxy-report-401-error-when-authenticate/244180/2 "2016-03-02T10:13:28Z")

</div>

Hi Amy,

On 02/03/16 03:19, AmyAmy wrote:

> hello, everybody.
> 
> I have search for the answer on the internet, and referent this solution:  
> [https://forum.nginx.org/read.php?2,250458,250463#msg-250463](https://forum.nginx.org/read.php?2,250458,250463#msg-250463)
> 
> Then ,I change my nginx configuration like this:

> ```
> proxy_pass_request_body off;
> proxy_set_header Content-Length "";
> proxy_set_header X-Original-URI $request_uri;
> }
> 
> ```
> 
> }

[trimmed much of the email]

Have you tried looking at your swift logs when NGINX passes on the  
request? I suspect this will give a good indication as to what is wrong.

In addition you probably need to set the following, although I’m  
uncertain as to whether it will fix your problem:

proxy\_http\_version 1.1

## Kind Regards

Andrew H. (LinuxJedi)  
Technical Product Manager, NGINX Inc.

---

<div class="post-metadata">

**Author:** ![AmyAmy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/76d3ee/32.png) [@AmyAmy](https://www.ruby-forum.com/u/AmyAmy)\
**Post date:** [March 2, 2016, 11:42am UTC](https://www.ruby-forum.com/t/openstack-swift-as-a-cache-proxy-for-nginx-swift-proxy-report-401-error-when-authenticate/244180/3 "2016-03-02T11:42:16Z")

</div>

Hi Amy,

I suggest trying to talk to the Swift community. If you can’t get any  
more information than that out of the Swift logs it is going to be  
difficult for you to determine what it is actually looking for.

In general though you probably shouldn’t be using a web browser to talk  
to an OpenStack API.

Kind Regards  
Andrew

On 02/03/16 09:44, AmyAmy wrote:

> 

Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/28.0.1500.72%20Safari/537.36

> txc35cdcf0cc6f4d938e57772da694352a - 0.0015 -  
> Best,  
> Amy
> 
> Posted at Nginx Forum:  
> [https://forum.nginx.org/read.php?2,264996,264997#msg-264997](https://forum.nginx.org/read.php?2,264996,264997#msg-264997)
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx)

–  
Andrew H. (LinuxJedi)  
Technical Product Manager, NGINX Inc.

---

<div class="post-metadata">

**Author:** ![AmyAmy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/76d3ee/32.png) [@AmyAmy](https://www.ruby-forum.com/u/AmyAmy)\
**Post date:** [March 2, 2016, 10:44am UTC](https://www.ruby-forum.com/t/openstack-swift-as-a-cache-proxy-for-nginx-swift-proxy-report-401-error-when-authenticate/244180/4 "2016-03-02T10:44:26Z")

</div>

Thanks for answer.  
As my swift server is serverd as a proxy server, I can look at swift  
proxy-server’s log which I have mention on my post, it report like this  
:

Mar 1 20:43:48 localhost journal: proxy-logging 192.168.1.1 192.168.1.1  
01/Mar/2016/20/43/48 GET /auth/v1.0 HTTP/1.0 401 -  
Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/28.0.1500.72%20Safari/537.36

- 
  - 131 - txbfc24355780143568445c4ddf5d774e3 - 0.0003 -  
Mar 1 20:43:48 localhost journal: tempauth - 192.168.1.1  
01/Mar/2016/20/43/48 GET /auth/v1.0 HTTP/1.0 401 -  
Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/28.0.1500.72%20Safari/537.36

- 
  - 
    - 
      - txbfc24355780143568445c4ddf5d774e3 - 0.0007

It seems there are some unrecognized char are contained in the request  
which nginx send to swift server .while I use curl command to send  
request,  
it works fine, swift server log report like this :

Mar 1 18:38:44 localhost journal: proxy-server 192.168.1.1 192.168.1.1  
01/Mar/2016/18/38/44 GET /auth/v1.0 HTTP/1.0 200 - curl/7.47.1 - - - -  
txc35cdcf0cc6f4d938e57772da694352a - 0.0015 -  
Mar 1 18:38:44 localhost journal: proxy-server - 192.168.1.1  
01/Mar/2016/18/38/44 GET /auth/v1.0 HTTP/1.0 200 - curl/7.47.1 - - - -  
txc35cdcf0cc6f4d938e57772da694352a - 0.0020

It seems swift cannot recognize the request from my nginx which has  
configed  
with an addictional module named ngx\_http\_auth\_request\_module. Maybe  
nginx  
was not passes right user and password to swift, but i have no idea  
which  
way to figure it out.

Best,  
Amy

Posted at Nginx Forum:

> **[Nginx Forum :: Nginx Mailing List - English](https://forum.nginx.org/read.php?2,264996,264997#msg-264997)**
>
> A portal to and from the mailing list.