swift_auth middleware disallows access to public Swift URLs

[Dan Prince]

When using swift_auth middleware tenants are prevented from accessing URL's from outside there account even if they have been granted access via ACL or the access is public.

This should be a supported use case for using Swift with Keystone.

To reproduce:

Make a swift URL public:

swift post -r ".r:*" foo

And then try to access that URL with a different tenants auth code.

curl -i http://localhost:8080/v1/AUTH_40467cf149ac42339feee283ff9f4300/foo/bar -X HEAD -H "X-Auth-Token: bc4b0123260f4a82a2d79a11125e2477"

Note: The URL above contains the initial tenants ID in the URL (40467cf149ac42339feee283ff9f4300) but uses a different tenants auth token. Since the URL is public Swift should grant access. Swift auth currently prevents this however due to the _reseller_check function.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/9290

[Dan Prince (dan-prince)]

The middleware moved from keystone to swift. I'm going to repost this fix in a minute.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/11147

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/22451

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/22451
Committed: http://github.com/openstack/swift/commit/0f284e04e4f0d6455d9865c5ac03fe7b3f348a52
Submitter: Jenkins
Branch: master

commit 0f284e04e4f0d6455d9865c5ac03fe7b3f348a52
Author: Chmouel Boudjnah <email address hidden>
Date: Wed Feb 20 18:08:58 2013 +0100

    Allow acl with a valid token.

    - When a user as a valid token it would go to authorize but the acl
      check was after the reseller_check and due fail. Check this before
      reseller_check and add a test for it.
    - Fixes bug 1020722.

    Change-Id: Iaff9f35f5ee690e9b729c36d05fb9adf3368dc79