Keystone v3 auth error - list

Question

I am following keystone ocata installation guide https://docs.openstack.org/ocata/install-guide-ubuntu/keystone-install.html
Post installation, I am able to get the user list using openstack user list command.
openstack --os-auth-url="[keystone_url]" --os-identity-api-version="3" --os-password="mypwd123" --os-project-domain-name="Default" --os-project-name="admin" --os-username="admin" --os-user-domain-name="Default" user list
Outputs the User list properly.
But when I take auth token with below command :
curl -si -d '{"auth": {"identity": {"methods": ["password" ],"password": {"user": {"domain": {"id": "default" },"name": "admin","password": "mypwd123" }}}}}' -H "Content-type: application/json" [keystone_url]/v3/auth/tokens
and then use the token from the output of above command in below command to list the users:
curl -s -H "X-Auth-Token: gAAAAABZlAN0NPibgBLcUW3aAcgNYIGaRH98M7w6b4tRliXC4LQB4dr5cGxTJmF5-iKvY2U_AU3c71uJUqgaQJP-iyURCBzBqYHlHtTGqofzzVndVncBRU5z4iLbArBdbJCI2Wd-1No9C0cq4iWB6RBNa9wqXWm-Gw" "[keystone_url]/v3/users" | python -mjson.tool
Returns :
{
"error": {
"code": 403,
"message": "You are not authorized to perform the requested action: identity:list_users.",
"title": "Forbidden"
}
}
Any help would be appreciated.
Thanks,
Viral

Answer 1

because list users need token with scope， you should add scope for query, like this:
curl -i http://ip:5000/v3/auth/tokens -H "Content-
Type: application/json" -d '
{
"auth": {
"identity": {
"methods": [
"password"
],
"password": {
"user": {
"name": "admin",
"domain": {
"name": "Default"
},
"password": "secret"
}
}
},
"scope": {
"domain": {
"id": "default"
}
}
}
}'
then use X-Subject-Token to query users.
See the official documentation for details.https://docs.openstack.org/keystone/pike/api_curl_examples.html#tokens