python-oauth2 dependency is unmaintained and has security issues

links to the 2 CVE issues
https://github.com/simplegeo/python-oauth2/issues/129
https://github.com/simplegeo/python-oauth2/issues/9

https://pypi.python.org/pypi/oauthlib is certainly a better choice

That would indeed be great.

Not sure if we want to merge these two bugs or not, but downstream issue in ubuntu is tracked in bug 1223010

Some notes Steve Martinelli sent me to help:

1. The following are spots where we currently use the old library:
https://github.com/openstack/keystone/blob/master/keystone/contrib/oauth1/core.py#L33 (to 40 - plug points for the library)
https://github.com/openstack/keystone/blob/master/keystone/contrib/oauth1/core.py#L123 (splitting headers)
https://github.com/openstack/keystone/blob/master/keystone/contrib/oauth1/controllers.py#L181 (to 192 - verifying request for request token call)
https://github.com/openstack/keystone/blob/master/keystone/contrib/oauth1/controllers.py#L251 (to 267 - verifying request for access token call)
https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/oauth1.py#L57 (to 72 - verifying request for authenticate call)
https://github.com/openstack/keystone/blob/master/keystone/tests/test_v3_oauth1.py (a bunch of places)

2a. The part that bugs me about oauthlib is the fact that you have to implement an interface (RequestValidator), https://oauthlib.readthedocs.org/en/latest/oauth1/server.html#implement-a-validator . At least this is my impression upon reading the docs.
2b. Actual RequestValidator class: https://github.com/idan/oauthlib/blob/master/oauthlib/oauth1/rfc5849/request_validator.py , raises a lot of not implemented exceptions.

3. I did find one instance of a coder that had to switch from using python-oauth2 to oauthlib, for a client application he was writing, it'll be handy for migrating the tests: https://github.com/gfairchild/yelpapi/commit/71b0a947d56445fe71750255827a07c56ce3f1e5

Indeed, the RequestValidator might be the tricky part.

any thing useful here ? http://requests-oauthlib.readthedocs.org/en/latest/index.html

@pmakowski, had a quick look, seems to be a client lib. it could be useful for testing. Thanks !

Hi,

I'd like to point out that, because nobody took care of fixing this issue fast enough, python-oauth2 and Keystone were removed from Debian testing today. It'd be nice if this issue could be addressed.

Hi Thomas,
I am having some trouble with the new library, as it implements oauth more strictly than the previous one. I am going to push my work as WIP, hopefully the community can provide some suggestions to go on with it.

Hi Matthieu,

since in Mageia we also , as in Debian testing, removed python-oauth2, if you have any visible WIP, please tell me where I can look at. May be I can help, even if my keystone knowledge is weak today. It could be an opportunity to learn.

Hi Philippe,

Here is the WIP patch: https://review.openstack.org/#/c/64427/

Reviewed: https://review.openstack.org/64427
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=bed88a2e724f5f23a1c839b7872b1bc56f059df5
Submitter: Jenkins
Branch: master

commit bed88a2e724f5f23a1c839b7872b1bc56f059df5
Author: Matthieu Huin <email address hidden>
Date: Mon Dec 2 10:43:10 2013 +0100

    Replacing python-oauth2 by oauthlib

    This patch replaces the old, unmaintained python-oauth2 library
    by the better suited oauthlib in keystone oAuth modules.

    The library switch comes with two notable changes in terms of use:

    * the client must set the callback uri to 'oob' (out-of-band)
      explicitly when requesting a Request Token
    * the requested_project_id header is not included in the signature
      anymore, in compliance with the oAuth1 spec.

    Closes-Bug: 1240382
    Change-Id: Ie553830cc80075aa818e719604e6bc4c754d2ae3

Hi,

Is there someone working on the backport to Havana? FYI, keystone is currently blocked from migrating from Debian Sid to Debian testing because of this problem (eg: oauth2 has been removed from testing because unmaintained).

Cheers,

Thomas

As discussed on the stable-maint list[1] such change isn't appropriate for the stable branch.
Distros can carry the proposed patch[2] or drop oauth support in their Havana packages, to address security concerns with oauth2.

[1] http://lists.openstack.org/pipermail/openstack-stable-maint/2014-March/002242.html
[2] https://review.openstack.org/70750