summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Update TOX_CONSTRAINTS_FILE for stable/2023.1stable/2023.1OpenStack Release Bot2023-03-071-4/+4
| | | | | | | | | | | | Update the URL to the upper-constraints file to point to the redirect rule on releases.openstack.org so that anyone working on this branch will switch to the correct upper-constraints list automatically when the requirements repository branches. Until the requirements repository has as stable/2023.1 branch, tests will continue to use the upper-constraints list on master. Change-Id: I423d390c52d8867f7a847830554f17ead9d3e2e7
* Update .gitreview for stable/2023.1OpenStack Release Bot2023-03-071-0/+1
| | | | Change-Id: I5f70bc44c4fc9b4ac76f4d7676ea35703e0cfd6a
* Merge "OAuth 2.0 Mutual-TLS Support"23.0.0.0rc123.0.0Zuul2023-03-0317-111/+2428
|\
| * OAuth 2.0 Mutual-TLS Supportsunyonggen2023-03-0317-111/+2428
| | | | | | | | | | | | | | | | | | | | The OAuth2.0 Access Token API is modified, support to get an OAuth2.0 certificate-bound access token from the keystone identity server with OAuth 2.0 credentials and Mutual-TLS certificates. Co-Authored-By: Hiromu Asahina <hiromu.asahina.az@hco.ntt.co.jp> Change-Id: I885527bec61429b1437a046097a16491848b5a0a Implements: blueprint support-oauth2-mtls
* | Merge "Add oidc federation test setup"Zuul2023-03-027-1/+346
|\ \
| * | Add oidc federation test setupAde Lee2023-01-307-1/+346
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | Add devstack testing setup for OIDC using an instance of keycloak which is instantiated from a keycloak image. This is largely taken from Kristi's work in https://github.com/knikolla/devstack-plugin-oidc This configuration is triggered by enabling the devstack service keystone-oidc-federation. The expectation is that either SAML2 or OIDC is enabled, but not both. Depends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/864571 Co-Authored-By: David Wilde <dwilde@redhat.com> Change-Id: I1ff4d48c05cef1022dc510df03104f36cdd7a953
* | Merge "Force algo specific maximum length"Zuul2023-02-285-3/+48
|\ \
| * | Force algo specific maximum lengthDave Wilde (d34dh0r53)2023-02-225-3/+48
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | The bcrypt algorithm that we use for password hashing silently length limits the size of the password that is hashed giving the user a false sense of security [0]. This patch adds a check in the verify_length_and_trunc_password function for the hash in use and updates the max_length accordingly, this will override the configured value and log a warning if the password is truncated. [0]: https://passlib.readthedocs.io/en/stable/lib/passlib.hash.bcrypt.html#security-issues Closes-bug: #1901891 Change-Id: I8d0bb2438b23227b5a66b94af6f8e198084fcd8d
* | Merge "[PooledLDAPHandler] Ensure result3() invokes message.clean()"Zuul2023-02-233-10/+138
|\ \ | |/ |/|
| * [PooledLDAPHandler] Ensure result3() invokes message.clean()Mustafa Kemal Gilor2022-12-063-10/+138
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | result3 does not invoke message.clean() when an exception is thrown by `message.connection.result3()` call, causing pool connection associated with the message to be marked active forever. This causes a denial-of-service on ldappool. The fix ensures message.clean() is invoked by wrapping the offending call in try-except-finally and putting the message.clean() in finally block. Closes-Bug: #1998789 Change-Id: I59ebf0fa77391d49b2349e918fc55f96318c42a6 Signed-off-by: Mustafa Kemal Gilor <mustafa.gilor@canonical.com>
* | Fix passenv syntax in tox and update python jobsKristi Nikolla2023-01-032-22/+4
|/ | | | | | | | | | | This updated the Python jobs and fixes the following error with tox 4: tox.tox_env.errors.Fail: pass_env values cannot contain whitespace, use comma to have multiple values in a single line, invalid values found 'http_proxy HTTP_PROXY https_proxy HTTPS_PROXY no_proxy NO_PROXY PBR_VERSION'PROXY PBR_VERSION' Change-Id: I003723766b1dba7f54c9800364207191597c6741
* Merge "requirements: Bump linter requirements"Zuul2022-10-2811-48/+31
|\
| * requirements: Bump linter requirementsStephen Finucane2022-10-2611-48/+31
| | | | | | | | | | | | | | | | | | | | | | | | The pep257 dependency does not support Python 3.10 and has been deprecated in favour of flake8-docstrings. While we're here, we bump the other linter dependencies and remove a note regarding the order of dependencies, which is no longer true with the new dependency resolver introduced in pip 20.3. We also remove an import exception for six.moves since we no longer use six. Change-Id: I4aae75f513568126230becf27b2e07d6682d35a1 Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
* | Limit token expiration to application credential expirationDave Wilde (d34dh0r53)2022-10-213-0/+42
|/ | | | | | | | | | | | If a token is issued with an application credential we need to check the expiration of the application credential to ensure that the token does not outlive the application credential. This ensures that if the token expiration is greaten than that of the application credential it is reset to the expiration of the application credential and a warning is logged. Please see CVE-2022-2447 for more information. Closes-Bug: 1992183 Change-Id: If6f9f72cf25769d022a970fac36cead17b2030f2
* Merge "Update master for stable/zed"Zuul2022-09-272-0/+7
|\
| * Update master for stable/zedOpenStack Release Bot2022-09-142-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | Add file to the reno documentation build to show release notes for stable/zed. Use pbr instruction to increment the minor version number automatically so that master versions are higher than the versions on stable/zed. Sem-Ver: feature Change-Id: I1f5579cf3b8e5055b3a26867c8cb1d39d2ea86fc
* | Merge "Use TOX_CONSTRAINTS_FILE"Zuul2022-09-161-4/+4
|\ \
| * | Use TOX_CONSTRAINTS_FILEjiaqi072022-07-261-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | UPPER_CONSTRAINTS_FILE is old name and deprecated This allows to use upper-constraints file as more readable way instead of UPPER_CONSTRAINTS_FILE=<lower-constraints file>. Change-Id: Id78b5ab392ac52a52731c87a4c06cbad1516ea85
* | | Merge "remove unicode prefix from code"Zuul2022-09-162-15/+15
|\ \ \ | |_|/ |/| |
| * | remove unicode prefix from codeniuke2022-08-152-15/+15
| | | | | | | | | | | | Change-Id: I0de3c786fa2617a44094c37827ebd93a8dfcf3b6
* | | Imported Translations from Zanata22.0.0.0rc122.0.0OpenStack Proposal Bot2022-09-085-1014/+42
| | | | | | | | | | | | | | | | | | | | | For more information about this automatic import see: https://docs.openstack.org/i18n/latest/reviewing-translation-import.html Change-Id: I2d496fd5a76ca31a2ebbf275fdc348e8fc44394f
* | | Fix host:port handlingBence Romsics2022-08-301-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | When we check the EC2 signature without the port part of the host value received, we should properly split host:port. Keep in mind the splitting should work for values like [fc00::]:123 too. Change-Id: I1d90dfcea3568e2a9b22069daa428ea6a2a38bd6 Closes-Bug: #1988168
* | | Merge "OAuth2.0 Client Credentials Grant Flow Support"Zuul2022-08-2612-4/+843
|\ \ \ | |/ / |/| |
| * | OAuth2.0 Client Credentials Grant Flow SupportYi Feng2022-06-1412-4/+843
| | | | | | | | | | | | | | | | | | | | | | | | The OAuth2.0 Access Token API is added, support to get an OAuth2.0 access token from the keystone identity server with application credentials. Change-Id: I4c54649a51534637be831450afc32d3ef8644ee5
* | | Merge "docs: Update docs to reflect migration to Alembic"Zuul2022-07-295-129/+58
|\ \ \
| * | | docs: Update docs to reflect migration to AlembicStephen Finucane2022-06-205-129/+58
| | | | | | | | | | | | | | | | | | | | Change-Id: Iabc8cd0746871ea6ab81af9d3f0149644a489f3d Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
* | | | Merge "sql: Integrate alembic"Zuul2022-07-298-1034/+855
|\ \ \ \ | |/ / /
| * | | sql: Integrate alembicStephen Finucane2022-06-208-1034/+855
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switch to alembic for real by integrating it into the 'db sync' command flow. From a user-facing perspective, things should remain pretty much the same as before, with the key difference being that version information (i.e. what's shown by 'keystone-manage db_sync --check' or 'keystone-manage db_version') will now take the form of a hash rather than an integer. There are a few differences for contributors however. The changes are described in the included release note and documentation. Note that there are a couple of important design decisions here that are worth examining: - We drop the idea of the 'data_migration' branch entirely and the 'keystone-manage db_sync --migrate' command is now a no-op. Neutron doesn't do data migrations like we do and yet they manage just fine. Dropping this gets us closer to neutron's behavior, which is a good thing for users. - We haven't re-added the ability to specify a version when doing 'db_sync'. Neutron has this, but the logic needed to get this working is complex and of questionable value. We've managed without the ability to sync to a version since Newton and can continue to do so until someone asks for it (and does the work). - sqlalchemy-migrate is not removed entirely. Instead, upon doing a 'db_sync' we will apply all sqlalchemy-migrate migrations up to the final '079_expand_update_local_id_limit' migration and dummy apply the initial alembic migration, after which we will switch over to alembic. In a future release we can remove the sqlalchemy-migrate migrations and rely entirely on alembic. Until then, keeping this allows fast forward upgrades to continue as a thing. - Related to the above, we always apply *all* sqlalchemy-migrate migrations when calling 'db_sync', even if this command is called with e.g. '--expand' (meaning only apply the expand branch). This is because there is at most one "real" migration to apply, the Xena-era '079_expand_update_local_id_limit' migration, which is an expand-only migration. There is no risk to applying the empty "data_migration" and "contract" parts of this migration, and applying everything in one go results in *much* simpler logic. Future changes will update documentation and add developer tooling for (auto-)generating new migrations, a la 'neutron-db-manage revision'. Change-Id: Ia376cb87f5159a4e79e2cfbab8442b6bcead708f Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
* | | | Merge "Only log warnings about token length when length exceeds max_token_size"Zuul2022-07-253-4/+68
|\ \ \ \
| * | | | Only log warnings about token length when length exceeds max_token_sizeLance Bragstad2021-05-033-4/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the fernet token provider would log warnings when a fernet token exceeded 255 characters, which is common for LDAP-backed deployments. The warning is always issued, even when operators configure keystone's max_token_size to a higher value, causing confusion because it appears the configuration value is silently ignored. This commit fixes that issue by using the max_token_size configuration parameter consistently in the fernet token provider. Closes-Bug: 1926483 Change-Id: I4bb54aac9b950d59082a4468203a3249790839d7
* | | | | Merge "Change error response status code in master branch"Zuul2022-07-251-1/+1
|\ \ \ \ \
| * | | | | Change error response status code in master branchchenwei2022-06-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closed bug: #1916662 Change-Id: I3ae502580588af42ac5d5f9fc6718a639b443e98
* | | | | | Imported Translations from ZanataOpenStack Proposal Bot2022-07-022-6/+108
| |_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | For more information about this automatic import see: https://docs.openstack.org/i18n/latest/reviewing-translation-import.html Change-Id: I69d52a1d921e2c9376baef9ab54ba41aa9602b07
* | | | | Merge "Move fips job to centos-9"Zuul2022-07-011-2/+4
|\ \ \ \ \ | |_|_|/ / |/| | | |
| * | | | Move fips job to centos-9Ade Lee2022-06-211-2/+4
| |/ / / | | | | | | | | | | | | | | | | | | | | Move FIPS job to centos 9 and add new required nslookup_target variable. Change-Id: Ifef262cfca4ecb8ad1222da3c43e5749f40c1f24
* | | | tests: Don't monkeypatch functionsStephen Finucane2022-06-201-5/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We were inadvertently monkeypatching a variety of functions in 'keystone.common.sql.upgrades'. We should be configuring mocks for these that we teardown at the end of the test. This has been an issue since we first added these tests way back in change I9f138fe0bcbf5ffbb98e6fcebd7d897329a301b7. Fix it now. Change-Id: I185420e6d16276e7d184146f6a38b098abc00b25 Signed-off-by: Stephen Finucane <sfinucan@redhat.com> Suggested-by: Mike Bayer <mike_mp@zzzcomputing.com>
* | | | sql: Don't create a new connection in migrationsStephen Finucane2022-06-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We can use the existing connection. No need to create a new one. Change-Id: I2165710ee83dad12ddd795b665ecac6c8bd42a93 Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
* | | | Ignore UserWarning for scope checks during test runsStephen Finucane2022-06-171-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Keystone's API policy rules are defaulting to system scope. Scope checks are disabled by default in oslo.policy, but if you hit the API with a token that doesn't match the scope, it generates a UserWarning, for every policy check on that request. This is pretty annoying, so just filter those warnings during our test runs. Change-Id: I150b8fa19d4ec1582234caa4c25db905e6403590 Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
* | | | tox: Don't generate byte codeStephen Finucane2022-06-171-2/+3
|/ / / | | | | | | | | | | | | | | | | | | Keeps directories clean. Change-Id: I8fcd9370a6adbfe8bbb2ce441a6f2efad45d089a Signed-off-by: Stephen Finucane <sfinucan@redhat.com>
* | | Merge "Fix typo in documentation"Zuul2022-06-031-1/+1
|\ \ \
| * | | Fix typo in documentationNikita Koltsov2022-05-161-1/+1
| | | | | | | | | | | | | | | | Change-Id: I92a8cfaef350bb61330d9ef02c0fd9e6f6c5854a
* | | | Merge "Changed minversion in tox to 3.18.0"Zuul2022-06-031-3/+3
|\ \ \ \
| * | | | Changed minversion in tox to 3.18.0wu.shiming2022-05-221-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch bumps min version of tox to 3.18.0 in order to replace tox's whitelist_externals by allowlist_externals option: https://github.com/tox-dev/tox/blob/master/docs/changelog.rst#v3180-2020-07-23 Change-Id: Iab6f7759de5cc0b5f52a6e5aa2069f5640d06e34
* | | | | Imported Translations from ZanataOpenStack Proposal Bot2022-05-2612-61/+24
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | For more information about this automatic import see: https://docs.openstack.org/i18n/latest/reviewing-translation-import.html Change-Id: I64d941148743d2c7902f16f5e81888a647249c6f
* | | | Update python testing as per zed cycle teting runtimeGhanshyam Mann2022-05-104-5/+10
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | In Zed cycle, we have dropped the python 3.6/3.7[1] testing and its support. [1] https://governance.openstack.org/tc/reference/runtimes/zed.html Change-Id: I817a4d1506fb7f15e72d37015ae0ba9547e2aa52
* | | Drop lower-constraints.txt and its testingGhanshyam Mann2022-04-303-74/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As discussed in TC PTG[1] and TC resolution[2], we are dropping the lower-constraints.txt file and its testing. We will keep lower bounds in the requirements.txt file but with a note that these are not tested lower bounds and we try our best to keep them updated. [1] https://etherpad.opendev.org/p/tc-zed-ptg#L326 [2] https://governance.openstack.org/tc/resolutions/20220414-drop-lower-constraints.html#proposal Change-Id: Id276f7efef3ef955b4c0b4b8d62f7c38cb535b33
* | | Merge "Log the traceback in _handle_keystone_exception"Zuul2022-04-291-3/+1
|\ \ \
| * | | Log the traceback in _handle_keystone_exceptionGrzegorz Grasza2022-03-171-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some errors were logged without a traceback because they were logged as a warning instead. Change-Id: I68595e4e2c37279585f0434a173596e43e047004 Related-Bug: #1965316
* | | | Add service_type config info for access rulesMarcin Wilk2022-04-251-2/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The service_type config param is crucial to successfully use application credentials with access rules. Closes-Bug: #1950464 Change-Id: I98d1cfcbd229f2939d900861f453efa996466c32
* | | | Merge "typo fix in docstring"Zuul2022-04-221-4/+5
|\ \ \ \
View Lorry Controller Status