summaryrefslogtreecommitdiff
path: root/keystonemiddleware
Commit message (Collapse)AuthorAgeFilesLines
* Add timeout for requestsHEAD10.3.0masterHiromu Asahina2023-03-182-4/+17
| | | | | | | | | | | Bandit emits errors for request methods without the timeout parameter. It's better to follow the instruction to avoid hanging. Added timeout parameters and config options to set timeout. [1] https://bandit.readthedocs.io/en/1.7.5/plugins/b113_request_without_timeout.html Change-Id: I0c022c3cc57f30530ebdef6e434753ece2bdf912
* OAuth 2.0 Mutual-TLS Supportsunyonggen2023-03-033-0/+638
| | | | | | | | | | | | The oauth2_mtls_token filter has been added for accepting or denying incoming requests containing OAuth 2.0 certificate-bound access tokens that are obtained from keystone identity server by users through their OAuth 2.0 credentials and Mutual-TLS certificates. Co-Authored-By: Hiromu Asahina <hiromu.asahina.az@hco.ntt.co.jp> Depends-On: https://review.opendev.org/c/openstack/keystoneauth/+/860614 Change-Id: I49127d845954ad6eab39e6e6305948ef0e4ed7b5 Implements: blueprint support-oauth2-mtls
* Remove cache invalidation when using expired token10.2.0stable/2023.1Jorge Merlino2022-12-122-25/+0
| | | | | | | | | | | | | | | | | This can create a race condition for long running services that reuse their token (eg. Kubernetes Cinder CSI plugin) in this case for example: 1 [user] Asks nova to attach a volume to a server 2 ...the user's token expires 3 [user] Asks cinder if the volume has been attached 4 [nova] Asks cinder to attach the volume In step 3 the token is marked as invalid in the cache and step 4 fails even if allow_expired is true Closes-Bug: #1987355 Change-Id: Ice8e34440a5fe1baa370646ed70b5e085c4af70e
* Fix pep8 gateDave Wilde2022-12-091-4/+1
| | | | | | | | This updates the test-requirements to more recent flake8-docstrings and pep8 versions. I also added some more ignores that would take significant work to update and fixed some minor linting issues. Change-Id: Ia416658b8a4bfb8f43f8df170053abb3ae958d44
* OAuth2.0 Client Credentials Grant Flow Support10.1.0Yi Feng2022-08-232-0/+404
| | | | | | | | | The oauth2_token filter has been added for accepting or denying incoming requests containing OAuth2.0 client credentials access tokens that are obtained from keystone identity server by users through their application credentials. Change-Id: I15e438681749ed2c2666804a9efd8d4712a7b01c
* Fix logging notifier unit test10.0.1Ayumu Ueha2022-08-091-0/+2
| | | | | | | | | | | | For unknown reasons, the `create_notifier()` in `test_api_request_no_messaging()` used `oslo_messaging.Notifier` instead of the `_LogNotifier` that should be originally used, causing unit test to fail. This patch fixes this issue by changing `use_oslo_messaging` config to False for this test. Change-Id: I32f9dc596525e912e37984764f68564e26ecfd3b
* Merge "Remove references to 'sys.version_info'"Zuul2022-05-301-18/+0
|\
| * Remove references to 'sys.version_info'dengzhaosen2021-04-271-18/+0
| | | | | | | | | | We support Python 3.6 as a minimum now, making these checks no-ops. Change-Id: Iff6abdc56c5627505e774f40af339e1b5790c4d5
* | Add oslo.config.opts entrypoint for audit middleware optionsTakashi Kajinami2021-08-121-2/+2
|/ | | | | | | | | ... so that each service using the audit middleware can include these parameters in .conf file generated by oslo-config-generator by adding that entrypoint to the command. Closes-Bug: #1939632 Change-Id: Ied954c633570c51af9504514ffed18e12de8caac
* Switch to eventlet-safe oslo.cache's MemcacheClientPoolMichal Arbet2021-02-112-4/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In past days there were discussions about various issues with memcached connections [1][2][3]. After investigation it looks like common root cause for above problems is keystonemiddleware. More precisely said the way how keystonemiddleware is caching tokens. Currently it's using some home-made CachePool with direct usage of memcached library, moreover it looks like its approach is not eventlet-safe. Discussion can be mainly found in [4]. Fortunately keystonemiddleware can use "advanced cache pool", which is oslo.cache's implementation and was added long time ago [5], but it is turned on only if memcache_use_advanced_pool=True. This patch is switching to more elaborated oslo.cache CachePool and adding deprecation warning about eventlet-unsafe variant of keystonemiddleware's memcache pool. How to reproduce ? with memcache_use_advanced_pool=False 1. Build clean ENV of openstack 2. Deploy core projects (keystone,glance,nova,placement...) 3. Run while true; do COMMAND FOR SERVICE; done - several bashes, in parallel (5-7) COMMAND FOR SERVICE: - openstack network list - openstack volume list - openstack server list - openstack image list 4. Check memcached connections (which will grow up): - ss | grep 11211 | wc -l every second How to fix and test it ? Repeat above, to fix: - with memcache_use_advanced_pool=True OR - apply this patch Compare measurements in graph. [1] https://bugs.launchpad.net/keystonemiddleware/+bug/1892852 [2] https://bugs.launchpad.net/oslo.cache/+bug/1888394 [3] https://bugs.launchpad.net/keystonemiddleware/+bug/1883659 [4] https://review.opendev.org/c/openstack/oslo.cache/+/742193 [5] https://review.opendev.org/c/openstack/keystonemiddleware/+/268664 Closes-Bug: #1883659 Closes-Bug: #1892852 Closes-Bug: #1888394 Change-Id: I0e96334b65a0bf369ebf1d88651d13feb8d2ecac
* Merge "Use unittest.mock instead of third party mock"Zuul2020-08-2410-10/+13
|\
| * Use unittest.mock instead of third party mockSean McGinnis2020-04-1810-10/+13
| | | | | | | | | | | | | | | | Now that we no longer support py27, we can use the standard library unittest.mock module instead of the third party mock lib. Change-Id: Idc319f3f8a3ddd57cba91e4cefc66dbb18d5cc22 Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
* | Merge "Change the default Identity endpoint to internal"victoria-em9.1.0stable/victoriaZuul2020-07-062-5/+5
|\ \ | |/ |/|
| * Change the default Identity endpoint to internalJens Harbott2020-06-142-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | In [0] the ``interface``option was added in order to allow the Identity endpoint that is being used when validating tokens to be configured by the deployer. Change the default to using the internal endpoint, as that should be what most deployments will end up using. [0] https://review.opendev.org/651790 Depends-On: https://review.opendev.org/651492 Closes-Bug: 1830002 Change-Id: I0ce8b6d8cd408c7fac8107972e7be70839e337fb
* | Update hacking for Python3Andreas Jaeger2020-03-302-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | The repo is Python 3 now, so update hacking to version 3.0 which supports Python 3. Blacklist: W504 line break after binary operator W503 line break before binary operator Fix other problems found Change-Id: I2fb257a4f42b499df3702f3e8f3c99ecb28557d6
* | Merge "Remove keystoneclient exception usage in tests"Zuul2020-01-021-3/+2
|\ \
| * | Remove keystoneclient exception usage in testsGage Hugo2019-11-241-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change replaces the usage of keystoneclient exceptions in the auth_token_middleware unit tests to use the ConnectFailure exception from keystoneauth. This is part of the process of removing keystoneclient from keystonemiddleware. Change-Id: Ie00fc310728c319faf2cfdfb651f0c7a8f48d757
* | | Merge "Fix DeprecationWarning: invalid escape sequence issues"Zuul2020-01-021-4/+4
|\ \ \
| * | | Fix DeprecationWarning: invalid escape sequence issuesSean McGinnis2019-11-131-4/+4
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | Some regex strings contain invalid escape sequences for normal strings, causing newer version of Python to emit DeprecationWarning messages. This updates those instances to raw strings so they are not interpreted as invalid. Change-Id: I28ac26516bacab36578a5a7f6ec7f9dcf7d7eeb1 Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
* | | Imported Translations from ZanataOpenStack Proposal Bot2019-12-222-20/+2
| | | | | | | | | | | | | | | | | | | | | For more information about this automatic import see: https://docs.openstack.org/i18n/latest/reviewing-translation-import.html Change-Id: I4a5f9f48ae099291cf47f4d08c40535223761b1b
* | | Rename _v3_to_v2_catalog to _normalize_catalog8.0.0Gage Hugo2019-12-202-16/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change renames the _v3_to_v2_catalog to _normalize_catalog as part of the v2 removal effort. Several services still rely on the converted catalog format, so this change maintains the conversion but removes the v2 association. Change-Id: Ic7bca16d8c6211d006fc2ba09dc2ecd83f8955db Partial-Bug: #1845539 Partial-Bug: #1777177
* | | Merge "Change ec2 URLs to v3"Zuul2019-12-032-16/+10
|\ \ \
| * | | Change ec2 URLs to v3Gage Hugo2019-11-292-16/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change modifies any URLs specifying v2.0 to v3. This is part of the effort to remove v2.0 functionality from keystonemiddleware. Change-Id: I9cde8963333ea95b4ab05d9aea4d196ab4357763 Partial-Bug: #1829453 Partial-Bug: #1845539
* | | | Remove v2.0 functionalityGage Hugo2019-11-273-340/+17
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | This change removes v2.0 functionality from keystonemiddleware, as well as associated tests. Partial-Bug: #1845539 Partial-Bug: #1777177 Change-Id: If47e90085d8a59c52fb23876dc329cd4f0b05ef0
* | | Make tests pass in 2022Bernhard M. Wiedemann2019-09-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Background: As part of my work on reproducible builds for openSUSE, I check that software still gives identical build results in the future. The usual offset is +15 years, because that is how long I expect some software will be used in some places. This showed up failing tests in our package build. See https://reproducible-builds.org/ for why this matters. This makes it expire 1 year in the future to model realistic tokens. Change-Id: I73bde68be53afff4e8dff12d756b8381f34b2adb
* | | Fix misspell wordQ.hongtao2019-09-091-1/+1
|/ / | | | | | | Change-Id: I2b727f28733b1f7e2bb0e2dfa94a39bfdd7449fc
* | Merge "Add validation of app cred access rules"7.0.0Zuul2019-07-187-2/+365
|\ \
| * | Add validation of app cred access rulesColleen Murphy2019-07-157-2/+365
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds a validation step in the auth_token middleware to check for the presence of an access_rules attribute in an application credential token and to validate the request against the permissions granted for that token. During token validation it sends a header to keystone to indicate that it is capable of validating these access rules, and not providing this header for a token like this would result in the token failing validation. This disregards access rules for a service request made by a service on behalf of a user, such as nova making a request to glance, because such a request is not under the control of the user and is not expected to be explicitly allowed in the access rules. bp whitelist-extension-for-app-creds Depends-On: https://review.opendev.org/670377 Change-Id: I185e0541d5df538d74edadf9976b3034a2470c88
* | | Merge "print auth version for request strategy in debug"Zuul2019-07-121-1/+1
|\ \ \ | |/ / |/| |
| * | print auth version for request strategy in debugushen2019-05-201-1/+1
| | | | | | | | | | | | | | | | | | | | | previously it will print auth version of _requested_auth_version which will be none all the time. Change it to klass makes more sense. Change-Id: I1cec8f163e808f03f15ef053e5768cf711238f0d
* | | Merge "Remove PKI/PKIZ support"Zuul2019-06-218-868/+14
|\ \ \
| * | | Remove PKI/PKIZ supportMorgan Fainberg2019-06-198-868/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Keystone server no longer supports PKI/PKIZ. This change removes keystonemiddleware's support of PKI/PKIZ and associated code. Change-Id: I9a6639a2aa3774be61972d57f38220f66fd5c0e8 closes-bug: #1649735 partial-bug: #1736985
* | | | Remove Diablo compatibility testsColleen Murphy2019-06-202-62/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We really don't care about Diablo compatibility any more. Clean up the old cruft. Change-Id: Ib1f628eb40ba0cb6334300cb6dca7dcdfcddba1b
* | | | Fix bandit warningLance Bragstad2019-06-201-2/+2
|/ / / | | | | | | | | | | | | | | | | | | Bandit is throwing warnings because we use 'token' in a couple of variables. Change-Id: I9fd21974027bc2bda6036c34fa587a044faaacae
* | | Merge "Add a new option to choose the Identity endpoint"6.1.0Zuul2019-06-124-8/+22
|\ \ \ | |/ / |/| / | |/
| * Add a new option to choose the Identity endpointJens Harbott2019-06-034-8/+22
| | | | | | | | | | | | | | | | | | | | | | Previously the admin Identity endpoint was hardcoded to be used. Now that keystone has dropped v2 support, deploying an admin Identity endpoint is no longer useful, so allow this to be changed by the deployer. Keep the default as using the `admin` endpoint, but create a deprecation message so that we can change the default in the future. Partial-Bug: 1830002 Change-Id: I993a45ccb1109d67e65bf32d1e134cc9bec2d88e
* | Fix string format errorSean McGinnis2019-04-091-1/+1
|/ | | | | | | | Attempt to escape quotes actually forgot one of the quotes, causing "invalid escape sequence" warnings in the logs. Change-Id: I843257ba5c26f7ba6c5cd3b1b7c53ed26cb9ee8d Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com>
* Fix service_token_role_required optionZhongShengping2019-02-151-3/+3
| | | | | | The service_token_roles_required should be correct. Change-Id: I009e3a495953d61fb0c29a8b629efa3322cb0ddd
* Add auth invalidation in auth_token for identity endpoint updateYang Youseok2019-02-073-0/+20
| | | | | | | | | | | | | Currently auth_token middleware does not concern identity endpoint update since service catalog is not updated after service having auth_token middleware started. Add invalidation logic when EndpointNotfound exception occurs so that auth_token middleware can be notified of sevice catalog update without restart. Change-Id: I631ee1538883d732fe3987b172d987f703dad5c0 Closes-Bug: #1813739
* Make sure audit middleware use own contextLeehom Li (feli5)2018-12-243-10/+11
| | | | | | | | | | | | Keystone audit middleware requires to iterate req.context as dict, but Glance requires to access req.context.read_only. When glance enabled audit, they are conflict with each other. This patch fix this issue by store audit context in req.environ['audit.context'] Change-Id: Ib9a62a4cd0b7b9ffb9fa2d6440e8072d45ee0fee Closes-Bug: #1809101 Signed-off-by: Leehom Li <feli5@cisco.com>
* Added request_id and global_request_id to CADF notificationsArtem Vasilyev2018-11-192-2/+32
| | | | | Change-Id: I8d571d3414071c68b4fa565dec46cc2d2941331c Closes-Bug: #1803940
* Merge "Stop supporting revocation list"Zuul2018-11-078-696/+1
|\
| * Stop supporting revocation listMorgan Fainberg2018-10-308-696/+1
| | | | | | | | | | | | | | | | | | | | | | With keystone's move to eliminating pki, pkiz, and uuid tokens the revocation list is no longer generated. Keystonemiddleware no longer needs to attempt to retrieve it and reference it. Change-Id: Ief3bf1941e62f9136dbed11877bca81c4102041b closes-bug: #1361743 partial-bug: #1649735 partial-bug: #1736985
* | Documentation Fix - auth_url Port NumberDavid Olorundare2018-11-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Made a small fix to the documentation - replacing the current auth_url port number 35357, in the configuration section of the [keystone_authtoken], with 5000. This was based on an online conversation with Colleen; with the removal of the v2 API from keystone the project now recommends use of port 5000 instead of the previous one. Change-Id: I750a4d0e75e0b919fd00ddf21c0e7ce62d495f95
* | Fix audit target service selectionMichael Johnson2018-10-292-2/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The keystonemiddleware audit code would select the wrong OpenStack service endpoint for a request if the cloud is not using unique TCP ports for each service endpoint. As most services are no longer using a port per service, but instead using unique paths, this caused the audit to select the wrong target service. This leads to incorrect audit logging due to the wrong audit map being used. This patch checks the request to see if a TCP port was present in the request, and if not, fall back to using the target_endpoint_type configured in the audit map file. Change-Id: Ie2e0bf74ecca485d599a4041bb770bd6e296bc99 Closes-bug: 1797584
* | Merge "Skip the services with no endpoints when parsing service catalog"Zuul2018-10-282-0/+22
|\ \
| * | Skip the services with no endpoints when parsing service catalogGuang Yee2018-10-262-0/+22
| |/ | | | | | | | | | | | | | | | | When parsing the service catalog to find the source, audit middleware should skip over the services which have no endpoints instead of assuming they will have at least one endpoint. Change-Id: I287873e99338d95baaf20d52ecb3a43763a401fc Closes-Bug: #1800017
* | Merge "Expect paste.deploy and gnocchi/panko options"Zuul2018-10-262-6/+7
|\ \ | |/ |/|
| * Expect paste.deploy and gnocchi/panko optionsAbhishek Sharma2017-12-072-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The authtoken middleware has been printing warning log messages to the API logs for all services, reporting unexpected conf keys. This was traced back to paste.deploy adding 'here' and '__file__' and both gnocchi and panko adding 'configkey' keys in wsgi apps though these do not actually exist in the conf file. This change allows for those keys without printing a warning that unnecessarily confuses operators. But it's kind of a hack, especially the configkey bit. We shouldn't have to know about gnocchi/panko specifics like this. And it doesn't address the comment in the bug about what is seen for ironic. So I think there will still be more to do here. Change-Id: I678482309c7dd35ce147bebf13ebefc84251fe91 Partial-Bug: 1722444
* | Respect delay_auth_decision when Keystone is unavailableTim Burke2018-09-112-0/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The delay_auth_decision option has two main uses: 1. Allow a service to provide its own auth mechanism, separate from auth tokens (like Swift's tempurl middleware). 2. Allow a service to integrate with multiple auth middlewares which may want to use the same X-Auth-Token header. The first case works fine even when the service has trouble talking to Keystone -- the client doesn't send an X-Auth-Token header, so we never even attempt to contact Keystone. The second case can be problematic, however. The client will provide some token, and we don't know whether it's valid for Keystone, the other auth system, or neither. We have to *try* contacting Keystone, but if that was down we'd previously return a 503 without ever trying the other auth system. As a result, a Keystone failure results in a total system failure. Now, when delay_auth_decision is True and we cannot determine whether a token is valid or invalid, we'll instead declare the token invalid and defer the rejection. As a result, Keystone failures only affect Keystone users, and tokens issued by the other auth system may still be validated and used. Change-Id: Ie4b3319862ba7fbd329dc6883ce837e894d5270c
View Lorry Controller Status