Memcached Token Backend does not support list tokens

marked bug as public - no vulnerability information in this content

Reviewed: https://review.openstack.org/12506
Committed: http://github.com/openstack/keystone/commit/150413cc4ba8ec854cf6fa30efeb7a653ad5e17a
Submitter: Jenkins
Branch: master

commit 150413cc4ba8ec854cf6fa30efeb7a653ad5e17a
Author: Adam Young <email address hidden>
Date: Thu Sep 6 11:54:04 2012 -0400

    List tokens for memcached backend

    Creates and updates an index of tokens in a memcache entry keyed
    by the user id

    Bug 1046905

    Change-Id: If11d6b87b0a8ae5f8349f1ebb31790e943c70fbf

Fix proposed to branch: stable/essex
Review: https://review.openstack.org/12590

Reviewed: https://review.openstack.org/12590
Committed: http://github.com/openstack/keystone/commit/cd1e48a7d60497c528af6d311bd5048821dc1c07
Submitter: Jenkins
Branch: stable/essex

commit cd1e48a7d60497c528af6d311bd5048821dc1c07
Author: Adam Young <email address hidden>
Date: Thu Sep 6 11:54:04 2012 -0400

    List tokens for memcached backend

    Creates and updates an index of tokens in a memcache entry keyed
    by the user id

    Bug 1046905

    Change-Id: I114810297009331f491dc069d667f358092f1e34

When I use keystone client user-role-add command, it always cause error:
MemcachedStringEncodingError: Keys must be str()'s, not unicode. Convert your unicode strings using mystring.encode(charset)!

Command:
keystone --token=ADMIN --endpoint=http://127.0.0.1:35357/v2.0 user-role-add --user_id {user ID} --role_id {role ID} --tenant_id {tenant ID}

I think it a bug.

Here is a patch.
in https://github.com/openstack/keystone/blob/master/keystone/token/backends/memcache.py
def list_tokens(self, user_id):
   tokens = []
   user_record = self.client.get('usertokens-%s' % user_id) or ""
                                                                                                               ^^^^^^^
change to
user_record = self.client.get('usertokens-%s' % user_id.encode('utf-8')) or ""

Hello Adam, or anyone else affected,

Accepted keystone into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/keystone/2012.1.3+stable-20130423-f48dd0fc-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Please find the attached test log from the Ubuntu Server Team's CI infrastructure. As part of the verification process for this bug, Keystone has been deployed and configured across multiple nodes using precise-proposed as an installation source. After successful bring-up and configuration of the cluster, a number of exercises and smoke tests have be invoked to ensure the updated package did not introduce any regressions. A number of test iterations were carried out to catch any possible transient errors.

Please Note the list of installed packages at the top and bottom of the report.

For records of upstream test coverage of this update, please see the Jenkins links in the comments of the relevant upstream code-review(s):

Trunk review: https://review.openstack.org/12506
Stable review: https://review.openstack.org/12590

As per the provisional Micro Release Exception granted to this package by the Technical Board, we hope this contributes toward verification of this update.

Test coverage log.

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

This bug was fixed in the package keystone - 2012.1.3+stable-20130423-f48dd0fc-0ubuntu1

---------------
keystone (2012.1.3+stable-20130423-f48dd0fc-0ubuntu1) precise-proposed; urgency=low

  * Resynchronize with stable/essex (LP: #1089488):
    - [7402f5e] EC2 authentication does not ensure user or tenant is enabled
      LP: 1121494
    - [8945567] DoS through XML entity expansion (CVE-2013-1664) LP: 1100282
    - [7b5b72f] Add size validations for /tokens.
    - [ef1e682] docutils 0.10 incompatible with sphinx 1.1.3 LP: 1091333
    - [8735009] Removing user from a tenant isn't invalidating user access to
      tenant (LP: #1064914)
    - [025b1d5] Jenkins jobs fail because of incompatibility between sqlalchemy-
      migrate and the newest sqlalchemy-0.8.0b1 (LP: #1073569)
    - [ddb4019] Open 2012.1.4 development
    - [0e1f05e] memcache driver needs protection against unicode user keys
      (LP: #1056373)
    - [176ee9b] Token invalidation in case of role grant/revoke should be
      limited to affected tenant (LP: #1050025)
    - [58ac669] Token validation includes revoked roles (CVE-2012-4413)
      (LP: #1041396)
    - [cd1e48a] Memcached Token Backend does not support list tokens
      (LP: #1046905)
    - [5438d3b] Update user's default tenant partially succeeds without authz
      (LP: #1040626)
  * Dropped patches, superseeded by new snapshot:
    - debian/patches/CVE-2013-0282.patch [7402f5e]
    - debian/patches/CVE-2013-1664+1665.patch [8945567]
    - debian/patches/keystone-CVE-2012-5571.patch [8735009]
    - debian/patches/keystone-CVE-2012-4413.patch [58ac669]
    - debian/patches/keystone-CVE-2012-3542.patch [5438d3b]
  * Refreshed patches:
    - debian/patches/CVE-2013-0247.patch
    - debian/patches/fix-ubuntu-tests.patch
 -- Yolanda <email address hidden> Tue, 23 Apr 2013 10:30:16 +0200