author | Drew Fisher <drew.fisher@oracle.com> |
Fri, 13 Jun 2014 09:10:23 -0700 | |
branch | s11-update |
changeset 3178 | 77584387a894 |
permissions | -rw-r--r-- |
3178
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
1 |
Upstream patch for CVE-2014-3476. This fix will be included in the |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
2 |
Juno-2 development milestone and in future 2013.2.4 and 2014.1.2 releases |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
3 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
4 |
From 9162837329665b4316afc2270a602dc8ae11f6d2 Mon Sep 17 00:00:00 2001 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
5 |
From: Adam Young <[email protected]> |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
6 |
Date: Thu, 29 May 2014 13:56:17 -0400 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
7 |
Subject: [PATCH] Block delegation escalation of privilege |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
8 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
9 |
Forbids doing the following with either a trust |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
10 |
or oauth based token: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
11 |
creating a trust |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
12 |
approving a request_token |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
13 |
listing request tokens |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
14 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
15 |
Change-Id: I1528f9dd003f5e03cbc50b78e1b32dbbf85ffcc2 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
16 |
Closes-Bug: 1324592 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
17 |
--- |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
18 |
keystone/common/controller.py | 36 +++++++++++- |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
19 |
keystone/contrib/oauth1/controllers.py | 12 ++++ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
20 |
keystone/tests/test_v3_auth.py | 62 ++++++++++++++++++++ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
21 |
keystone/tests/test_v3_oauth1.py | 98 ++++++++++++++++++++++++++++++++ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
22 |
keystone/trust/controllers.py | 9 +++ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
23 |
5 files changed, 216 insertions(+), 1 deletion(-) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
24 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
25 |
diff --git a/keystone/common/controller.py b/keystone/common/controller.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
26 |
index faadc09..d6c33df 100644 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
27 |
--- a/keystone/common/controller.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
28 |
+++ b/keystone/common/controller.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
29 |
@@ -44,7 +44,7 @@ def _build_policy_check_credentials(self, action, context, kwargs): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
30 |
# it would otherwise need to reload the token_ref from backing store. |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
31 |
wsgi.validate_token_bind(context, token_ref) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
32 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
33 |
- creds = {} |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
34 |
+ creds = {'is_delegated_auth': False} |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
35 |
if 'token_data' in token_ref and 'token' in token_ref['token_data']: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
36 |
#V3 Tokens |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
37 |
token_data = token_ref['token_data']['token'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
38 |
@@ -66,9 +66,32 @@ def _build_policy_check_credentials(self, action, context, kwargs): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
39 |
creds['roles'] = [] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
40 |
for role in token_data['roles']: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
41 |
creds['roles'].append(role['name']) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
42 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
43 |
+ trust = token_data.get('OS-TRUST:trust') |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
44 |
+ if trust is None: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
45 |
+ creds['trust_id'] = None |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
46 |
+ creds['trustor_id'] = None |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
47 |
+ creds['trustee_id'] = None |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
48 |
+ else: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
49 |
+ creds['trust_id'] = trust['id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
50 |
+ creds['trustor_id'] = trust['trustor_user']['id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
51 |
+ creds['trustee_id'] = trust['trustee_user']['id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
52 |
+ creds['is_delegated_auth'] = True |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
53 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
54 |
+ oauth1 = token_data.get('OS-OAUTH1') |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
55 |
+ if oauth1 is None: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
56 |
+ creds['consumer_id'] = None |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
57 |
+ creds['access_token_id'] = None |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
58 |
+ else: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
59 |
+ creds['consumer_id'] = oauth1['consumer_id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
60 |
+ creds['access_token_id'] = oauth1['access_token_id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
61 |
+ creds['is_delegated_auth'] = True |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
62 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
63 |
else: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
64 |
#v2 Tokens |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
65 |
creds = token_ref.get('metadata', {}).copy() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
66 |
+ creds['is_delegated_auth'] = False |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
67 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
68 |
try: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
69 |
creds['user_id'] = token_ref['user'].get('id') |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
70 |
except AttributeError: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
71 |
@@ -81,6 +104,16 @@ def _build_policy_check_credentials(self, action, context, kwargs): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
72 |
# NOTE(vish): this is pretty inefficient |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
73 |
creds['roles'] = [self.identity_api.get_role(role)['name'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
74 |
for role in creds.get('roles', [])] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
75 |
+ trust = token_ref.get('trust') |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
76 |
+ if trust is None: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
77 |
+ creds['trust_id'] = None |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
78 |
+ creds['trustor_id'] = None |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
79 |
+ creds['trustee_id'] = None |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
80 |
+ else: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
81 |
+ creds['trust_id'] = trust.get('id') |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
82 |
+ creds['trustor_id'] = trust.get('trustor_id') |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
83 |
+ creds['trustee_id'] = trust.get('trustee_id') |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
84 |
+ creds['is_delegated_auth'] = True |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
85 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
86 |
return creds |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
87 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
88 |
@@ -155,6 +188,7 @@ def protected(callback=None): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
89 |
policy_dict.update(kwargs) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
90 |
self.policy_api.enforce(creds, action, flatten(policy_dict)) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
91 |
LOG.debug(_('RBAC: Authorization granted')) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
92 |
+ context['environment'] = {'KEYSTONE_AUTH_CONTEXT': creds} |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
93 |
return f(self, context, *args, **kwargs) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
94 |
return inner |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
95 |
return wrapper |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
96 |
diff --git a/keystone/contrib/oauth1/controllers.py b/keystone/contrib/oauth1/controllers.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
97 |
index b8c2441..d4024df 100644 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
98 |
--- a/keystone/contrib/oauth1/controllers.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
99 |
+++ b/keystone/contrib/oauth1/controllers.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
100 |
@@ -86,6 +86,12 @@ class AccessTokenCrudV3(controller.V3Controller): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
101 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
102 |
@controller.protected() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
103 |
def list_access_tokens(self, context, user_id): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
104 |
+ auth_context = context.get('environment', |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
105 |
+ {}).get('KEYSTONE_AUTH_CONTEXT', {}) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
106 |
+ if auth_context.get('is_delegated_auth'): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
107 |
+ raise exception.Forbidden( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
108 |
+ _('Cannot list request tokens' |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
109 |
+ ' with a token issued via delegation.')) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
110 |
refs = self.oauth_api.list_access_tokens(user_id) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
111 |
formatted_refs = ([self._format_token_entity(x) for x in refs]) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
112 |
return AccessTokenCrudV3.wrap_collection(context, formatted_refs) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
113 |
@@ -314,6 +320,12 @@ class OAuthControllerV3(controller.V3Controller): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
114 |
there is not another easy way to make sure the user knows which roles |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
115 |
are being requested before authorizing. |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
116 |
""" |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
117 |
+ auth_context = context.get('environment', |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
118 |
+ {}).get('KEYSTONE_AUTH_CONTEXT', {}) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
119 |
+ if auth_context.get('is_delegated_auth'): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
120 |
+ raise exception.Forbidden( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
121 |
+ _('Cannot authorize a request token' |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
122 |
+ ' with a token issued via delegation.')) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
123 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
124 |
req_token = self.oauth_api.get_request_token(request_token_id) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
125 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
126 |
diff --git a/keystone/tests/test_v3_auth.py b/keystone/tests/test_v3_auth.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
127 |
index e89e29f..f3e3ace 100644 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
128 |
--- a/keystone/tests/test_v3_auth.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
129 |
+++ b/keystone/tests/test_v3_auth.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
130 |
@@ -2150,6 +2150,68 @@ class TestTrustAuth(TestAuthInfo): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
131 |
self.assertEqual(r.result['token']['project']['name'], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
132 |
self.project['name']) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
133 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
134 |
+ def test_impersonation_token_cannot_create_new_trust(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
135 |
+ ref = self.new_trust_ref( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
136 |
+ trustor_user_id=self.user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
137 |
+ trustee_user_id=self.trustee_user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
138 |
+ project_id=self.project_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
139 |
+ impersonation=True, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
140 |
+ expires=dict(minutes=1), |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
141 |
+ role_ids=[self.role_id]) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
142 |
+ del ref['id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
143 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
144 |
+ r = self.post('/OS-TRUST/trusts', body={'trust': ref}) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
145 |
+ trust = self.assertValidTrustResponse(r) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
146 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
147 |
+ auth_data = self.build_authentication_request( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
148 |
+ user_id=self.trustee_user['id'], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
149 |
+ password=self.trustee_user['password'], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
150 |
+ trust_id=trust['id']) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
151 |
+ r = self.post('/auth/tokens', body=auth_data) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
152 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
153 |
+ trust_token = r.headers['X-Subject-Token'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
154 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
155 |
+ # Build second trust |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
156 |
+ ref = self.new_trust_ref( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
157 |
+ trustor_user_id=self.user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
158 |
+ trustee_user_id=self.trustee_user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
159 |
+ project_id=self.project_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
160 |
+ impersonation=True, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
161 |
+ expires=dict(minutes=1), |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
162 |
+ role_ids=[self.role_id]) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
163 |
+ del ref['id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
164 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
165 |
+ self.post('/OS-TRUST/trusts', |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
166 |
+ body={'trust': ref}, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
167 |
+ token=trust_token, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
168 |
+ expected_status=403) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
169 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
170 |
+ def test_delete_trust_revokes_tokens(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
171 |
+ ref = self.new_trust_ref( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
172 |
+ trustor_user_id=self.user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
173 |
+ trustee_user_id=self.trustee_user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
174 |
+ project_id=self.project_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
175 |
+ impersonation=False, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
176 |
+ expires=dict(minutes=1), |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
177 |
+ role_ids=[self.role_id]) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
178 |
+ del ref['id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
179 |
+ r = self.post('/OS-TRUST/trusts', body={'trust': ref}) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
180 |
+ trust = self.assertValidTrustResponse(r) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
181 |
+ trust_id = trust['id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
182 |
+ auth_data = self.build_authentication_request( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
183 |
+ user_id=self.trustee_user['id'], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
184 |
+ password=self.trustee_user['password'], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
185 |
+ trust_id=trust_id) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
186 |
+ r = self.post('/auth/tokens', body=auth_data) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
187 |
+ self.assertValidProjectTrustScopedTokenResponse( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
188 |
+ r, self.trustee_user) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
189 |
+ trust_token = r.headers['X-Subject-Token'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
190 |
+ self.delete('/OS-TRUST/trusts/%(trust_id)s' % { |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
191 |
+ 'trust_id': trust_id}, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
192 |
+ expected_status=204) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
193 |
+ headers = {'X-Subject-Token': trust_token} |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
194 |
+ self.head('/auth/tokens', headers=headers, expected_status=404) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
195 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
196 |
def test_delete_trust(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
197 |
ref = self.new_trust_ref( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
198 |
trustor_user_id=self.user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
199 |
diff --git a/keystone/tests/test_v3_oauth1.py b/keystone/tests/test_v3_oauth1.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
200 |
index 73a34d7..a83c86e 100644 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
201 |
--- a/keystone/tests/test_v3_oauth1.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
202 |
+++ b/keystone/tests/test_v3_oauth1.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
203 |
@@ -16,6 +16,7 @@ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
204 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
205 |
import copy |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
206 |
import os |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
207 |
+import tempfile |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
208 |
import urlparse |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
209 |
import uuid |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
210 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
211 |
@@ -26,6 +27,8 @@ from keystone import contrib |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
212 |
from keystone.contrib import oauth1 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
213 |
from keystone.contrib.oauth1 import controllers |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
214 |
from keystone.openstack.common import importutils |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
215 |
+from keystone.openstack.common import jsonutils |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
216 |
+from keystone.policy.backends import rules |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
217 |
from keystone.tests import test_v3 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
218 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
219 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
220 |
@@ -447,6 +450,101 @@ class AuthTokenTests(OAuthFlowTests): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
221 |
self.assertTrue(len(tokens) > 0) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
222 |
self.assertTrue(keystone_token_uuid in tokens) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
223 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
224 |
+ def _create_trust_get_token(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
225 |
+ ref = self.new_trust_ref( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
226 |
+ trustor_user_id=self.user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
227 |
+ trustee_user_id=self.user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
228 |
+ project_id=self.project_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
229 |
+ impersonation=True, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
230 |
+ expires=dict(minutes=1), |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
231 |
+ role_ids=[self.role_id]) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
232 |
+ del ref['id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
233 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
234 |
+ r = self.post('/OS-TRUST/trusts', body={'trust': ref}) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
235 |
+ trust = self.assertValidTrustResponse(r) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
236 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
237 |
+ auth_data = self.build_authentication_request( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
238 |
+ user_id=self.user['id'], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
239 |
+ password=self.user['password'], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
240 |
+ trust_id=trust['id']) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
241 |
+ r = self.post('/auth/tokens', body=auth_data) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
242 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
243 |
+ trust_token = r.headers['X-Subject-Token'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
244 |
+ return trust_token |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
245 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
246 |
+ def _approve_request_token_url(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
247 |
+ consumer = self._create_single_consumer() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
248 |
+ consumer_id = consumer.get('id') |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
249 |
+ consumer_secret = consumer.get('secret') |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
250 |
+ self.consumer = oauth1.Consumer(consumer_id, consumer_secret) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
251 |
+ self.assertIsNotNone(self.consumer.key) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
252 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
253 |
+ url, headers = self._create_request_token(self.consumer, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
254 |
+ self.project_id) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
255 |
+ content = self.post(url, headers=headers) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
256 |
+ credentials = urlparse.parse_qs(content.result) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
257 |
+ request_key = credentials.get('oauth_token')[0] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
258 |
+ request_secret = credentials.get('oauth_token_secret')[0] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
259 |
+ self.request_token = oauth1.Token(request_key, request_secret) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
260 |
+ self.assertIsNotNone(self.request_token.key) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
261 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
262 |
+ url = self._authorize_request_token(request_key) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
263 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
264 |
+ return url |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
265 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
266 |
+ def test_oauth_token_cannot_create_new_trust(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
267 |
+ self.test_oauth_flow() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
268 |
+ ref = self.new_trust_ref( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
269 |
+ trustor_user_id=self.user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
270 |
+ trustee_user_id=self.user_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
271 |
+ project_id=self.project_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
272 |
+ impersonation=True, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
273 |
+ expires=dict(minutes=1), |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
274 |
+ role_ids=[self.role_id]) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
275 |
+ del ref['id'] |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
276 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
277 |
+ self.post('/OS-TRUST/trusts', |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
278 |
+ body={'trust': ref}, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
279 |
+ token=self.keystone_token_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
280 |
+ expected_status=403) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
281 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
282 |
+ def test_oauth_token_cannot_authorize_request_token(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
283 |
+ self.test_oauth_flow() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
284 |
+ url = self._approve_request_token_url() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
285 |
+ body = {'roles': [{'id': self.role_id}]} |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
286 |
+ self.put(url, body=body, token=self.keystone_token_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
287 |
+ expected_status=403) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
288 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
289 |
+ def test_oauth_token_cannot_list_request_tokens(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
290 |
+ self._set_policy({"identity:list_access_tokens": [], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
291 |
+ "identity:create_consumer": [], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
292 |
+ "identity:authorize_request_token": []}) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
293 |
+ self.test_oauth_flow() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
294 |
+ url = '/users/%s/OS-OAUTH1/access_tokens' % self.user_id |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
295 |
+ self.get(url, token=self.keystone_token_id, |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
296 |
+ expected_status=403) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
297 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
298 |
+ def _set_policy(self, new_policy): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
299 |
+ _unused, self.tmpfilename = tempfile.mkstemp() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
300 |
+ rules.reset() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
301 |
+ self.opt(policy_file=self.tmpfilename) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
302 |
+ with open(self.tmpfilename, "w") as policyfile: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
303 |
+ policyfile.write(jsonutils.dumps(new_policy)) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
304 |
+ self.addCleanup(os.remove, self.tmpfilename) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
305 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
306 |
+ def test_trust_token_cannot_authorize_request_token(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
307 |
+ trust_token = self._create_trust_get_token() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
308 |
+ url = self._approve_request_token_url() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
309 |
+ body = {'roles': [{'id': self.role_id}]} |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
310 |
+ self.put(url, body=body, token=trust_token, expected_status=403) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
311 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
312 |
+ def test_trust_token_cannot_list_request_tokens(self): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
313 |
+ self._set_policy({"identity:list_access_tokens": [], |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
314 |
+ "identity:create_trust": []}) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
315 |
+ trust_token = self._create_trust_get_token() |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
316 |
+ url = '/users/%s/OS-OAUTH1/access_tokens' % self.user_id |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
317 |
+ self.get(url, token=trust_token, expected_status=403) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
318 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
319 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
320 |
class MaliciousOAuth1Tests(OAuth1Tests): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
321 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
322 |
diff --git a/keystone/trust/controllers.py b/keystone/trust/controllers.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
323 |
index 1d54f51..7fdc8c2 100644 |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
324 |
--- a/keystone/trust/controllers.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
325 |
+++ b/keystone/trust/controllers.py |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
326 |
@@ -144,6 +144,15 @@ class TrustV3(controller.V3Controller): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
327 |
|
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
328 |
# TODO(ayoung): instead of raising ValidationError on the first |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
329 |
# problem, return a collection of all the problems. |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
330 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
331 |
+ # Explicitly prevent a trust token from creating a new trust. |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
332 |
+ auth_context = context.get('environment', |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
333 |
+ {}).get('KEYSTONE_AUTH_CONTEXT', {}) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
334 |
+ if auth_context.get('is_delegated_auth'): |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
335 |
+ raise exception.Forbidden( |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
336 |
+ _('Cannot create a trust' |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
337 |
+ ' with a token issued via delegation.')) |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
338 |
+ |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
339 |
if not trust: |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
340 |
raise exception.ValidationError(attribute='trust', |
77584387a894
PSARC/2014/207 OpenStack Glance Update to Havana
Drew Fisher <drew.fisher@oracle.com>
parents:
diff
changeset
|
341 |
target='request') |