summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Fix security issues with EC2 credentialspike-eolstable/pikeColleen Murphy2020-06-037-67/+568
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change addresses several issues in the creation and use of EC2/S3 credentials with keystone tokens. 1. Disable altering credential owner attributes or metadata Without this patch, an authenticated user can create an EC2 credential for themself for a project they have a role on, then update the credential to target a user and project completely unrelated to them. In the worst case, this could be the admin user and a project the admin user has a role assignment on. A token granted for an altered credential like this would allow the user to masquerade as the victim user. This patch ensures that when updating a credential, the new form of the credential is one the acting user has access to: if the system admin user is changing the credential, the new user ID or project ID could be anything, but regular users may only change the credential to be one that they still own. Relatedly, when a user uses an application credential or a trust to create an EC2 credential, keystone automatically adds the trust ID or application credential ID as metadata in the EC2 access blob so that it knows how the token can be scoped when it is used. Without this patch, a user who has created a credential in this way can update the access blob to remove or alter this metadata and escalate their privileges to be fully authorized for the trustor's, application credential creator's, or OAuth1 access token authorizor's privileges on the project. This patch fixes the issue by simply disallowing updates to keystone-controlled metadata in the credential. 2. Respect token roles when creating EC2 credentials Without this patch, a trustee, an application credential user, or an OAuth1 access token holder could create an EC2 credential or an application credential using any roles the trustor, application credential creator, or access token authorizor had on the project, regardless of whether the creator had delegated only a limited subset of roles. This was because the trust_id attribute of the EC2 access blob was ignored, and no metadata for the application credential or access token was recorded either. This change ensures that the access delegation resource is recorded in the metadata of the EC2 credential when created and passed to the token provider when used for authentication so that the token provider can look up the correct roles for the request. Conflicts (six removal in e2d83ae9, pep8 fixes in e2d83ae9): keystone/api/credentials.py keystone/tests/unit/test_v3_application_credential.py keystone/tests/unit/test_v3_credential.py Conflicts due to flask reorg: keystone/api/_shared/EC2_S3_Resource.py keystone/api/credentials.py keystone/api/users.py keystone/tests/unit/test_v3_credential.py Moved the test_update_credential_non_owner unit test to CredentialSelfServiceTestCase since in this branch the default policies are not affected by #1872733. NOTE: the application credential functional changes, along with its tests were removed from the stable/pike backport as stable/pike does not support application credentials. Change-Id: I39d0d705839fbe31ac518ac9a82959e108cb7c1d Closes-bug: #1872733 Closes-bug: #1872755 Closes-bug: #1872735 (cherry picked from commit 37e9907a176dad6843819b1bec4946c3aecc4548) (cherry picked from commit 2f2736ebb267c757ad77fcf25ee0aaeefab2a09d) (cherry picked from commit 27caafe3daa552663719954f2cd6713dd4493178) (cherry picked from commit bfba75fc3c5c8f119f74dbf31347e008824a2134) (cherry picked from commit 53d1ccb8a1bdbb5aa0efaacf9739b1a6f436e191) (cherry picked from commit 6db1bb09a048dfb7f337484698a9a19fdbbe9546)
* Merge "Check timestamp of signed EC2 token request" into stable/pikeZuul2020-06-024-5/+276
|\
| * Check timestamp of signed EC2 token requestColleen Murphy2020-05-314-5/+276
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EC2 token requests contain a signature that signs the entire request, including the access timestamp. While the signature is checked, the timestamp is not, and so these signed requests remain valid indefinitely, leaving the token API vulnerable to replay attacks. This change introduces a configurable TTL for signed token requests and ensures that the timestamp is actually validated against it. The check will work for either an AWS Signature v1/v2 'Timestamp' parameter[1] or the AWS Signature v4 'X-Aws-Date' header or parameter[2]. Although this technically adds a new feature and the default value of the feature changes behavior, this change is required to protect credential holders and therefore must be backported to all supported branches. [1] https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html [2] https://docs.aws.amazon.com/general/latest/gr/sigv4-date-handling.html Conflicts due to six removal in e2d83ae9: keystone/api/_shared/EC2_S3_Resource.py keystone/tests/unit/test_contrib_ec2_core.py Conflicts due to v2.0 API testing in stable/queens. The v2.0 tests were removed in Rocky but in earlier releases we tested similar functionality between v3 and v2.0. This conflict was resolved by porting the timestamp to the v2.0 API test: keystone/tests/unit/test_contrib_ec2_core.py Conflicts due to flask reorg: keystone/api/_shared/EC2_S3_Resource.py Change-Id: Idb10267338b4204b435df233c636046a1ce5711f Closes-bug: #1872737 (cherry picked from commit ab89ea749013e7f2c46260f68504f5687763e019) (cherry picked from commit 8d5becbe4b463f6a5a24a1929dd0f48dab6ae027) (cherry picked from commit e3f65d6fbcd18032a8ad3dfa3aaded264a282158) (cherry picked from commit 1ef3828516c1b87a8ca84acca73ec593b0b8591d) (cherry picked from commit 35f09e2b7c00e03cd1d52a2337b51be38dd79480) (cherry picked from commit d6f1006dd0ca8f7999f32133d348fcec8f2299d3)
* | Merge "Ensure OAuth1 authorized roles are respected" into stable/pikeZuul2020-06-021-0/+13
|\ \
| * | Ensure OAuth1 authorized roles are respectedColleen Murphy2020-05-141-0/+13
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without this patch, when an OAuth1 request token is authorized with a limited set of roles, the roles for the access token are ignored when the user uses it to request a keystone token. This means that user of an access token can use it to escallate their role assignments beyond what was authorized by the creator. This patch fixes the issue by ensuring the token model accounts for an OAuth1-scoped token and correctly populating the roles for it. Modified to work with older test helper function: keystone/tests/unit/test_v3_oauth1.py Conflicts: keystone/models/token_model.py The keystone token model was refactored in the Rocky release. This commit only backports the test so that we have test coverage against the bug and proves there wasn't a regression in Queens. As such, the code changes to token_model.py (where the bug was introduced) are not applicable to Pike. releasenotes/notes/bug-1873290-ff7f8e4cee15b75a.yaml Removed the release note since there isn't anything to signal to operators regarding a vulnerability. We're only adding test coverage to prove that stable/queens isn't vulnerable. Change-Id: I02f9836fbd4d7e629653977fc341476cfd89859e Closes-bug: #1873290 (cherry picked from commit 6c73690f779a42a5c62914b6bc37f0ac2f41a3e3) (cherry picked from commit ba89d27793c2d3a26ad95642660fa9bd820ed3be) (cherry picked from commit 5ff52dbaa2082991d229d8557a8e4b65256d6c53) (cherry picked from commit 2483a578a80a916d9f5acd672d85830385b236e2) (cherry picked from commit 10bc689a6796f85c44d19e0c18f0e37b0a87474c) (cherry picked from commit d590441ce6897a7a169db7262eb17bcd5d90bcd2)
* | Remove neutron-grenade jobGuang Yee2020-05-181-21/+0
|/ | | | | | | | | | | | | | | Neutron-grenade have a dependency on stestr 1.0.0 or later in stable/ocata. Unfortunately, we didn't add stestr to openstack/requirements till stable/pike. There's been an attempts to fix the problem in stable/ocata [1][2]. But it appears we won't be able to retrofit it because of the dependency conflicts. However, we still want to land critical security patches in stable/pike and since stable/pike is already in Extended Maintenance, it's best to just remove the neutron-grenade job. [1] https://review.opendev.org/#/c/718202/ [2] https://review.opendev.org/#/c/726983/ Change-Id: Icb32bda29b3c12d54269f4f257db5658538a5620
* Import LDAP job into projectColleen Murphy2019-10-171-1/+11
| | | | | | | | | | | | | | | | | | Import the legacy-tempest-dsvm-ldap-domain-specific-driver job[1] into the keystone repo and convert it to be Zuulv3 native. This cherry-pick removes the explicit use of python3 since it doesn't quite work on this old of a branch. [1] https://opendev.org/openstack/openstack-zuul-jobs/src/branch/master/playbooks/legacy/tempest-dsvm-ldap-domain-specific-driver Change-Id: Ie0b9f13d6fb06b776d6a58d5d1087c20df8a7cda Needed-by: https://review.opendev.org/687444 (cherry picked from commit 52ab0cf579445190483f3a6f0e3aa5db0a9ebdef) (cherry picked from commit 0f6c6061b3026dc7a33bffad20848ebd3341af4b) (cherry picked from commit 429923fbb3be7229b0c6c1b6136b230d86672bcf) (cherry picked from commit 2f7155065456a3142ea05317dd82b370c70a7fdf) (cherry picked from commit 8b8a8f2c54820e13403746784843df017812896f)
* Remove experimental openSUSE 42.3 jobAndreas Jaeger2019-08-221-10/+0
| | | | | | | | | The openSUSE 42.3 distribution is eol, remove this experimental job so that the job can be removed from Zuul. Note that master has job for newer openSUSE running. Change-Id: Icd25b8695816f4d89a7aa00a9b9e9387866438f3
* Cap banditAndreas Jaeger2019-08-221-1/+1
| | | | | | | | | | Bandit is a linter, let's cap the version in a stable branch so that new versions of bandit do not introduce pepe8 failures. This is capped to version 1.4, same version as listed in upper-constraints file in requirements repo for stable/pike branch. Change-Id: Idd2b6254bb4fcf4b168cd35a1a27a9da2ca2280d
* Blacklist bandit 1.6.0Jim Rollenhagen2019-05-091-1/+1
| | | | | | | | | | | | | | There's a regression[0] in bandit 1.6.0 which causes bandit to stop respecting excluded directories, and our tests throw a bunch of violations. Blacklist this version, but allow newer versions as there is already a pull request[1] to fix it, and I expect it will be included in the next release. [0] https://github.com/PyCQA/bandit/issues/488 [1] https://github.com/PyCQA/bandit/pull/489 Change-Id: Ie4dbfb3f54e4aac00e0537d5760b7a8fc81b35a2 (cherry picked from commit ebac8330d8ac81c491a1cb0e16eb23b93d7932ee)
* OpenDev Migration PatchOpenDev Sysadmins2019-04-191-1/+1
| | | | | | | | | | | | | | | This commit was bulk generated and pushed by the OpenDev sysadmins as a part of the Git hosting and code review systems migration detailed in these mailing list posts: http://lists.openstack.org/pipermail/openstack-discuss/2019-March/003603.html http://lists.openstack.org/pipermail/openstack-discuss/2019-April/004920.html Attempts have been made to correct repository namespaces and hostnames based on simple pattern matching, but it's possible some were updated incorrectly or missed entirely. Please reach out to us via the contact information listed at https://opendev.org/ with any questions you may have.
* Merge "Delete shadow users when domain is deleted" into stable/pikepike-em12.0.3Zuul2019-04-153-9/+22
|\
| * Delete shadow users when domain is deletedColleen Murphy2019-04-053-9/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without this change, when an admin tries to delete an LDAP-backed domain, it fails due to the foreign key relationship in the users table. Previously, we were assuming that LDAP users existed solely in the LDAP directory, but this is not true with shadow users. This patch fixes the logic to delete the shadow users upon domain deletion. Altered cherry-pick: use injected API provider since provider_api mechanism doesn't exist in pike. Change-Id: I12a08001e3aa08e4db9438cae425ad1a0a8070f7 Closes-bug: #1801873 (cherry picked from commit 1b16725d066f71a833ca74656c0c3dfe5f815e98)
* | Replace openstack.org git:// URLs with https://Ian Wienand2019-03-241-1/+1
|/ | | | | | | | | | | | | | | | | This is a mechanically generated change to replace openstack.org git:// URLs with https:// equivalents. This is in aid of a planned future move of the git hosting infrastructure to a self-hosted instance of gitea (https://gitea.io), which does not support the git wire protocol at this stage. This update should result in no functional change. For more information see the thread at http://lists.openstack.org/pipermail/openstack-discuss/2019-March/003825.html Change-Id: Ifbe3d26c4bf37831fefd3737e7c8e1d90d6f6db7
* Remove publish-loci post jobColleen Murphy2019-03-121-3/+0
| | | | | | | | | | | | The publishing credentials for this job are misconfigured in Zuul and result in the whole post pipeline failing, which causes tarballs not to be updated on tarballs.openstack.org[1]. Remove the misconfigured job to get the post pipeline working again. [1] http://eavesdrop.openstack.org/irclogs/%23openstack-release/%23openstack-release.2019-03-11 Change-Id: I4d94a433ba32bce7ee926cdde487eeec980c6b8b (cherry picked from commit f0c2e798f7e706acbaf600bd06521a0e4c514477)
* Merge "Mapped Groups don't exist breaks WebSSO" into stable/pike12.0.2Zuul2018-10-192-5/+8
|\
| * Mapped Groups don't exist breaks WebSSOVishakha Agarwal2018-09-242-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The issue occurs if a user has a group that does not map to a project in OpenStack. At which point an exception is raised and the websso login blows up with a 500 message. This is because of the exception being raised when the group name not matches thus replacing that with a log. Change-Id: Ia7321705db118af28f3dc6e01d5b18e8650aa633 Closes-Bug: #1789450 (cherry picked from commit ee46f735359cb5381024a7dfa3f2b297badc6247)
* | LDAP attribute names non-case-sensitiveVishakha Agarwal2018-10-023-9/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | keystone was not able to find any users while the LDAP user name attribute was configured to "samaccountname", but could find users when reconfigured to use "sAMAccountName". LDAP is not supposed to be case-sensitive, so either should work. This patch addresses the above problem by making both the attributes into lower case. Also updated the ldap_result example supporting python3. Change-Id: I51813ac41489baed04f3cadbccd748e03025313e Closes-Bug: #1753585 (cherry picked from commit 816b472a9d20e4e7cfe33f2f40ef5daae590795e)
* | import zuul job settings from project-configDoug Hellmann2018-08-291-0/+100
|/ | | | | | | | | | | | | | | | | | | | This is a mechanically generated patch to complete step 1 of moving the zuul job settings out of project-config and into each project repository. Because there will be a separate patch on each branch, the branch specifiers for branch-specific jobs have been removed. Because this patch is generated by a script, there may be some cosmetic changes to the layout of the YAML file(s) as the contents are normalized. See the python3-first goal document for details: https://governance.openstack.org/tc/goals/stein/python3-first.html Change-Id: I549ec25953d8a5870c0aad211ccb9ca8418ba151 Story: #2002586 Task: #24304
* Reduce duplication in federated auth APIs12.0.1Lance Bragstad2018-07-252-15/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The GET /v3/OS-FEDERATION/projects and GET /v3/OS-FEDERATION/domains APIs were introduced to handle tokens from federated users, but now that GET /v3/auth/projects and GET /v3/auth/domains know how to handle federated tokens, they're just duplicate APIs. In the past we deprecated these federated auth APIs, but they still used separate code paths from GET /v3/auth/projects and GET /v3/auth/domains. The two code paths are true duplication in that they don't expect to differ over time and should provide the same user experience. Instead of running the risk that comes with two code paths that do the same thing, we should consolidate them. Conflicts: keystone/federation/controllers.py due to the fact that pre-Queens code used a different dependency framework. This was reworked in the Queens release, causing a conflict with this patch since it touches the same code. Co-Authored-By: Kristi Nikolla <kristi@nikolla.me> Closes-Bug: 1779205 Change-Id: Ib906c42e1dd2c2408ccd2e256ffd876af02af3fe (cherry picked from commit df5d75571ed274b2964ed52048768c6d9f24d138)
* Fix json schema nullable to add None to ENUMMorgan Fainberg2018-04-193-3/+53
| | | | | | | | | | | | The JSON Schema validation implementation of nullable(), which makes values possible to be null was not adding None to the enum if it exists. This causes validation to fail on ``None`` especially in the case of keystone's boolean parameter_type implementation. ``nullable()`` now adds ``None`` to the enum if the enum exists. Closes-Bug: #1763824 Change-Id: I176fa90df63049661413c445554dba9b7d87272a (cherry picked from commit 78adf4b40fb88e371101ed065ac1d15063d8d86e)
* Merge "Remove deprecation of domain_config_upload" into stable/pikeZuul2018-02-201-6/+0
|\
| * Remove deprecation of domain_config_uploadLance Bragstad2017-08-161-6/+0
| | | | | | | | | | | | | | | | | | This was the outcome of a discussion on the mailing list: http://lists.openstack.org/pipermail/openstack-dev/2017-June/119090.html Change-Id: I835e4a722855756035725fa7d4524c1fe641ffcf (cherry picked from commit ad094a6184e0508d1091804439ecb27e86b9e084)
* | Merge "Expose a get_enforcer method for oslo.policy scripts" into stable/pikeZuul2018-02-144-0/+38
|\ \
| * | Expose a get_enforcer method for oslo.policy scriptsLance Bragstad2018-01-164-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Because we have policy in code, we should be able to use the oslo.policy CLI scripts to produce sample policy files and render complete policies based on overrides on disk. This was broken because keystone wasn't removing unexpected commandline arguments before passing them to oslo.config to parse. This prevented people from generating complete policy files like they would for horizon. This commit exposes a get_enforcer() that substitutes an empty list in place of arguments passed in through the system. This makes it so that oslo.config doesn't choke when processing configuration values. Change-Id: I22583258eac5b3a64208355d18ccfa62dba1871d Closes-Bug: 1740951 (cherry picked from commit 85c957c50387ca47b68bc412879c753e7618f86b)
* | | Merge "Add New in Pike note to using db_sync check" into stable/pikeZuul2018-02-141-4/+5
|\ \ \
| * | | Add New in Pike note to using db_sync checkGage Hugo2017-11-291-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds a note (*New in Pike*) to the section for running db_sync --check to clarify which release this feature was added. This is similar to other sections in this document that specify the release that a feature was added in and when it is available. Change-Id: I7d778fa249997bb24e4563d6960910b93637bbf2 Closes-Bug: #1734549 (cherry picked from commit 756d28149043f298ba25c654e1ef31d7e690c909)
* | | | Merge "Update the release name in install tutorial" into stable/pikeZuul2018-02-143-3/+3
|\ \ \ \
| * | | | Update the release name in install tutorialHongbin Lu2017-10-113-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks the document will land on latest release page (https://docs.openstack.org/keystone/latest), but it declares for documenting the OpenStack Ocata release, which seems outdated. Change-Id: I88ecd028eb31b9eaf68ddf743e949de8302736ac (cherry picked from commit ad1b677c91b5dedd3334620abde440fc775a5445)
* | | | | Merge "Remove admin_token_auth steps from install guide" into stable/pikeZuul2018-02-143-33/+9
|\ \ \ \ \
| * | | | | Remove admin_token_auth steps from install guideLance Bragstad2017-10-083-33/+9
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The installation guide previously listed this as a step but it is no longer needed since `admin_token_auth` is no longer in the paste file by default Change-Id: If36bafbecd657c3acd769f11636a1d844be0ac66 Closes-Bug: 1716797 (cherry picked from commit 5194a369613588fb805450e9288ee636cfbcaf8f)
* | | | | Delete SQL users before deleting domainColleen Murphy2018-02-094-2/+35
| |_|/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the users table has a foreign key to the projects table[1], users must be deleted before the domain can be deleted. However, the notification emitted from the domain deletion comes too late, and keystone runs into a foreign key reference error before it can delete the users. This patch addresses the problem by adding a new internal notification to alert the identity manager that users should be deleted. This uses a new notification rather than the existing notification because the existing one is used to alert listeners that the domain deletion has been fully completed, whereas this one must happen in the middle of the domain delete process. The callback must also only try to delete SQL users. The LDAP driver doesn't support deleting users, and we can't assume other drivers support it either. Moreover, the foreign key reference is only a problem for SQL users anyway. Because our backend unit tests run with SQLite and foreign keys do not work properly, we can't properly expose this bug in our unit tests, but there is an accompanying tempest test[2][3] to validate this fix. [1] https://github.com/openstack/keystone/blob/2bd88d3/keystone/common/sql/expand_repo/versions/014_expand_add_domain_id_to_user_table.py#L140-L141 [2] https://review.openstack.org/#/c/509610 [3] https://review.openstack.org/#/c/509947 Change-Id: If5bdb6f5eef80b50b000aed5188ce7da4dfd1083 Closes-bug: #1718747 (cherry picked from commit 62ee18b359cbb2e6a9469bdaac9057ef19de1bdf)
* | | | Create doc/requirements.txtqinglin.cheng2018-01-123-6/+24
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For compliance with the Project Testing Interface as described in: https://governance.openstack.org/tc/reference/project-testing-interface.html Refer to: http://lists.openstack.org/pipermail/openstack-dev/2017-November/124815.html Change-Id: Ic05a55fb14741bb0802c217c81b0035b6e1f7de2 (cherry picked from commit 07bba320ae3d0e7fb9d2fb2a1c5df51735761bac)
* | | Filter users/groups in ldap with whitespacesprashkre2017-11-153-2/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All users and groups are required to have a name. With this fix, Keystone will ignore users and groups that do have only white spaces as value for the LDAP attribute which Keystone has been configured to use for that entity's name. Change-Id: Id539e1b7e1cea8b05cd9bb753707e1fc98244d29 Closes-Bug: #1727726 (cherry picked from commit 789573a0f17fd3ea8abd1a89034b865035925a8f)
* | | Handle ldap size limit exeeded exceptionprashkre2017-10-253-3/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | LDAP servers have sizelimit configuration to limit the number of user/group objects that can be returned for an LDAP query. This change catches the size limit exceeded exception when users/groups returned from ldap search query exceeds the configured limit and responds with an appropriate error message instead of default 500 error message. Change-Id: I9949bb7d458b4b037616c701e0e4d362bfa36473 Closes-Bug: #1712415 (cherry picked from commit f776fc18383fcfdc97932eaaab261a0b85e0ef68)
* | | Copy specific distro pages for install guideGage Hugo2017-10-0915-16/+29
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change breaks the get-started-identity, keystone-users, and keystone-openrc pages into multiple copies for each distribution release in the keystone install guides. Before this change, sphinx would not render the links correctly and these pages would be skipped in both the RDO and Ubuntu guides. To avoid unnecessary duplication of the same text, the files were moved into common/ and are simply included into the newly created files for each release. Change-Id: I7b478504f1e68034ea993c0214705045da86bb6e Closes-Bug: #1716899 Closes-Bug: #1716792 (cherry picked from commit 04515333f44736f4e85f12c2534a1c4b0479ec03)
* | Merge "Update UPPER_CONSTRAINTS_FILE for stable/pike" into stable/pikeJenkins2017-08-261-1/+1
|\ \
| * | Update UPPER_CONSTRAINTS_FILE for stable/pikeOpenStack Release Bot2017-08-111-1/+1
| | | | | | | | | | | | Change-Id: Iadab65ef6a8a105283ed24c729a701a14488f214
* | | Merge "Update .gitreview for stable/pike" into stable/pikeJenkins2017-08-261-0/+1
|\ \ \ | |/ /
| * | Update .gitreview for stable/pikeOpenStack Release Bot2017-08-111-0/+1
| |/ | | | | | | Change-Id: Ibceff2223a858790cae54992ca6e5a2e9e126e3b
* | Update pike to ignore specific release notesLance Bragstad2017-08-221-0/+13
| | | | | | | | | | | | | | | | Some notes were updated due to the docs migration but they were only relevant for the ocata or newton release. This commit prevents those notes from being rendered in the pike release notes document. Change-Id: Id705bad286c75870746ef56c2c9c44a1cdf049a7
* | Merge "Remove duplicate roles from federated auth" into stable/pike12.0.0.0rc212.0.0Jenkins2017-08-173-5/+47
|\ \
| * | Remove duplicate roles from federated authLance Bragstad2017-08-163-5/+47
| |/ | | | | | | | | | | | | | | | | | | | | | | We were using a one-liner to prune duplicate role references from a list of roles, but it didn't work in all cases. This reworks the logic to pass the existing test case. I also added a comment explaining why the logic we used previously doesn't work so we can hopefully avoid the pattern in the future. Change-Id: Id786d6463364ad8f4f02c22bb83221baac4b83d0 Closes-Bug: 1701324 (cherry picked from commit 058a23c0873723d5a4ffa8e99121f7b3b4485db5)
* | Merge "Resource backend is SQL only now" into stable/pikeJenkins2017-08-166-17/+35
|\ \
| * | Resource backend is SQL only nowMorgan Fainberg2017-08-146-17/+35
| |/ | | | | | | | | | | | | | | | | | | This change has been implemented to avoid the need to backport signficantly impactful Foreign Key dropping backports. Resource is highly relational data and it makes sense to allow the use of FKs from other subsystems to project/domains. Change-Id: Ic3831d1c7ae41fe4d406d60a013770cc1258584f
* | Add int storage of datetime for password created/expiresMorgan Fainberg2017-08-1511-4/+298
|/ | | | | | | | | | | | | Due to MySQL (in some versions) not storing datetime resolution below one second, keystone occasionally ends up with weird behavior such as a New password not being valid. The password created at and expires at columns now store both datetime (for rolling upgrades) and integers. Keystone from Pike and beyond leans on the new created_at_int column and expires_at_int column. Change-Id: I2c219b4b9b353f1e2cce6088849a773196f0e443 Closes-Bug: #1702211
* Merge "Unset project ids for all identity backends"12.0.0.0rc1Jenkins2017-08-112-9/+28
|\
| * Unset project ids for all identity backendsLance Bragstad2017-08-102-9/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the default behavior for the callback that unset default project ids was to only call the method for the default domain's identity driver. This meant that when a project was deleted, only the default identity backend would have references to that project removed. This means it would be possible for other identity backends to still have references to a project that doesn't exist because the callback wasn't invoked for that specific backend. This commit ensures each backend clears project id from a user's default_project_id attribute when a project is deleted. Change-Id: Ibb5396f20101a3956fa91d6ff68155d4c00ab0f9 Closes-Bug: 1705072
* | Merge "Cache list projects and domains for user"Jenkins2017-08-103-0/+20
|\ \
| * | Cache list projects and domains for userLance Bragstad2017-08-093-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Listing projects and domains for a user based on their role assignments was noted as being really slow, especially when users have a lot of assignments. This commit implements caching to mitigate the issue while we continue to investigate ways to speed up the assignment API. Change-Id: I72e398c65f01aa4f9a37f817d184a13ed01089ce Closes-Bug: 1700852
View Lorry Controller Status