OpenStack Identity (keystone)

Domains are not validated on authentication

Bug #1130236 reported by Dolph Mathews on 2013-02-19

This bug affects 2 people

Affects		Status	Importance	Assigned to	Milestone
	OpenStack Identity (keystone)	Fix Released	High	Henry Nash	OpenStack Identity (keystone) 2013.1 "grizzly"

Bug Description

There two separate problems:

In v2 authentication, currently domains are removed from user & project refs prior to validation.

https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L81

Their validation was also made conditional because the validation was merged prior to domain_id's being available on users & projects:

https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L97
https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L97

The validation needs to become unconditional and validated prior to being removed.

In v3, the domain is checked when authenticating by username, but not by user_id - the later successfully authenticates even if the domain is disabled.

See original description

OpenStack Infra (hudson-openstack) on 2013-02-19

Changed in keystone:
status:	New → In Progress

Thierry Carrez (ttx) on 2013-02-19

Changed in keystone:
milestone:	none → grizzly-3

Thierry Carrez (ttx) on 2013-02-21

Changed in keystone:
milestone:	grizzly-3 → grizzly-rc1

Thierry Carrez (ttx) on 2013-03-18

Changed in keystone:
status:	In Progress → Triaged

Dolph Mathews (dolph) on 2013-03-18

Changed in keystone:
assignee:	Dolph Mathews (dolph) → nobody

Revision history for this message

Dolph Mathews (dolph) wrote on 2013-03-18:

I started this in https://review.openstack.org/#/c/22327/ -- unassigning from myself in case Henry wants to tackle it.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2013-03-19: Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.openstack.org/24753

Changed in keystone:
assignee:	nobody → Henry Nash (henry-nash)
status:	Triaged → In Progress

Henry Nash (henry-nash) on 2013-03-19

description:

updated

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2013-03-19:

Fix proposed to branch: master
Review: https://review.openstack.org/24813

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2013-03-20: Fix merged to keystone (master)

Reviewed: https://review.openstack.org/24813
Committed: http://github.com/openstack/keystone/commit/cd3f58a8d05010838bd5e2d095103c2623499112
Submitter: Jenkins
Branch: master

commit cd3f58a8d05010838bd5e2d095103c2623499112
Author: Dolph Mathews <email address hidden>
Date: Tue Feb 19 10:39:22 2013 -0600

Validate domains unconditionally (bug 1130236)

Ensure that we validate the domain status of user/project for
a user authenticating via the v2 API.

    This patch builds on the initial functional change done by Dolph,
    and fixes up the tests that broke sure to domain being required in
    any tests that setup data directly in the backends.

Fixes Bug #1130236

Change-Id: I66dfd453fb95fa4fa3fde713b663386a2c2ecdf8