Fernet TypeError: token must be bytes.

BTW, this is with the master branch code as of 8:00 PM PST 03/12

INFO:__main__:{"auth": {"scope": {"service_provider": {"id": "ks_sp1"}}, "identity": {"token": {"id": "gAAAAABVAldqGaZeAQbn37Vh4Gdb2CUfn2UHTCoqWKUTiFD8S0R6wc8SfuzEhk90xrQwDM415hodebk0HjjPH479cj3f6eIh05jR41cSouiYTRyB8yH6TvUQhRk6hei2O5dM6AEwii0uFodJ6zspuF62xyDWISn41_sFwcpv3fvrbgz2-nzQHPU="}, "methods": ["token"]}}}

I reproduced this a bit more simply by rescoping a token from unscoped to project-scoped using v3:

======================================================================
ERROR: test_token_rescoping (test_exercises.TestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/dolph/dolph/keystone-deploy/test_exercises.py", line 192, in test_token_rescoping
    auth_url=KEYSTONE_ENDPOINT + 'v3')
  File "/home/dolph/Environments/ansible/local/lib/python2.7/site-packages/keystoneclient/v3/client.py", l
ine 196, in __init__
    self.authenticate()
  File "/home/dolph/Environments/ansible/local/lib/python2.7/site-packages/keystoneclient/utils.py", line
318, in inner
    return func(*args, **kwargs)
  File "/home/dolph/Environments/ansible/local/lib/python2.7/site-packages/keystoneclient/httpclient.py",
line 503, in authenticate [293/1965]
    resp = self.get_raw_token_from_identity_service(**kwargs)
  File "/home/dolph/Environments/ansible/local/lib/python2.7/site-packages/keystoneclient/v3/client.py", l
ine 281, in get_raw_token_from_identity_service
    _('Authorization failed: %s') % e)
AuthorizationFailure: Authorization failed: token must be bytes. (HTTP 400)

The backtrace can be reproduced in isolation with just:

  $ python -c "from cryptography.fernet import Fernet; f = Fernet(Fernet.generate_key()).decrypt(u'asdf')"

I think the cause is that tokens which pass through json.loads() are read in as unicode, and pypi/cryptography simply refuses to operate on them. It should be safe to cast them to bytes()

here is the review addressing this:

https://review.openstack.org/#/c/165279/

Reviewed: https://review.openstack.org/165279
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=68a54c2cf1a7210abae9292aede5737203eb733a
Submitter: Jenkins
Branch: master

commit 68a54c2cf1a7210abae9292aede5737203eb733a
Author: Dolph Mathews <email address hidden>
Date: Wed Mar 18 03:18:31 2015 +0000

    URL quote Fernet tokens

    The padding in base64.urlsafe_b64encode()'s output is not actually URL
    safe, so you have to quote the result when it's of variable length.

    In addition, Fernet tokens can always be handled as bytes, despite being
    passed in from json.loads() as Unicode.

    Change-Id: I72dbd4ddc066706f6af6ea2f2bcd5f0a6cb9b30c
    Closes-Bug: 1433372
    Closes-Bug: 1431669