Skip to main content

Swift Public Token Access Error - Troubleshooting Guide

Problem​

A user reports that public access via a Swift URL is not working when the URL includes the account ID (e.g. AUTH_<account_id>). Authenticated access works correctly. The issue is likely related to the rgw_swift_account_in_url configuration not being applied to the running RGW daemons, and/or rgw_keystone_implicit_tenants being incorrectly set to true.

Symptoms​

  • Swift stat command succeeds with a valid auth token.
  • Public URL access using the account-in-URL format returns an error (likely 404).
  • The container has a public Read ACL set (.r:*,.rlistings), so public access should work.

Example of a URL format that works:

https://<endpoint>/v1/AUTH_<account_id>/<container>

Example of a URL format that returns the error but is expected to work:

https://<rgw-endpoint>/swift/v1/AUTH_<account_id>/<container>

Root Cause​

The feature that allows Swift URLs to include the account ID requires the following RGW setting:

rgw_swift_account_in_url = true

Even if this setting appears in ceph config dump, it may not be applied to the currently running RGW daemons — particularly in containerized deployments where a restart is required for config changes to take effect.

Additionally, the following setting should be verified:

rgw_keystone_implicit_tenants = false

If this is set to true on any RGW daemon, it may interfere with account-in-URL access. The default is false, but some daemons may have it overridden.

Note: This issue has been observed on Ceph 18.2.2 (Reef). It was previously reported upstream and marked as resolved, but may still appear on this version. See:

Troubleshooting Steps​

1. Verify that rgw_swift_account_in_url is applied to running daemons​

Enter the RGW daemon container and run:

ceph daemon /var/run/ceph/ceph-client.rgw.{id}.asok config show | grep rgw_swift_account_in_url

The output should show true. If it does not, the config has not been applied to the running daemon.

2. Verify that rgw_keystone_implicit_tenants is set correctly​

On the same daemon, run:

ceph daemon /var/run/ceph/ceph-client.rgw.{id}.asok config show | grep rgw_keystone_implicit_tenants

The value should be false. If it is true, it needs to be corrected.

3. Apply the configuration globally and restart RGW daemons​

If the settings are not applied, set them at the client.rgw level to ensure all RGW daemons pick them up:

ceph config set client.rgw global rgw_swift_account_in_url true

For troubleshooting you may also use global or client insteaed of client.rgw.

Then restart the RGW daemons. For example:

ceph orch restart rgw

4. Re-test public access​

After restarting, re-test the public URL:

curl -v https://<rgw-endpoint>/swift/v1/AUTH_<account_id>/<container>

5. Further troubleshooting​

If the issue persists, further troubleshooting is needed. The recommended steps are as follows: turn on the debug log on both the RGW and the client side, and then capture the problematic request and response on both RGW and the client.

Resolution​

The issue is resolved when:

  1. rgw_swift_account_in_url = true is confirmed active on all running RGW daemons.
  2. rgw_keystone_implicit_tenants = false is confirmed active on all running RGW daemons.
  3. Public Swift URL access returns the expected result.