ec2tokens passes AWS Access Key ID twice

Which of those two places would you expect it to be?

I don't mind at all... just want to avoid the "man with two watches" problem and the potential security holes that might result if we checked one but used the other.

.

Is one of them intended to continue support for a deprecated behavior?

file keystone/middleware/ec2_token.py method EC2Token.__call__ generates the request
access = req.params['AWSAccessKeyId'] is explicitly culled out of the request. This is what is set in the json request:
        creds = {
            'ec2Credentials': {
                'access': access,
                'signature': signature,
                'host': req.host,
                'verb': req.method,
                'path': req.path,
                'params': auth_params,
            }

The value in Params comes from the auth_params = dict(req.params) which will include the value above. We could pop the AWSAccessKeyId out of there, just like

auth_params.pop('Signature')

On the receiving side, the implementation is done in keystone/contrib/ec2/core.py Ec2Controller:authenticate.

self._get_credentials(context, credentials['access']) is passed on, which maps to the access key in the above JSON. The fact that it is duplicated in the params is coincidental and ignored.

Fix proposed to branch: master
Review: https://review.openstack.org/39484

I think it's a bit late to see this "fixed" as we have no guarantee that api clients aren't dependent on the "wrong" value. If anything we should be testing to ensure that this bug remains and that the two values match.