auth_token middleware fails to fetch CA Cert

[Adam Young]

If PKI tokens are enabled, the auth_token middleware never fetches the CA Cert. It will fetch the signing cert.

TO reproduce. Run devstack. Kill Keystone and change the Keystone.conf file, set
[signing]
disable_pki = False

Then rerun Keytstone. keystone token-get will now return a huge token.

run galnce image-list and you will see an error indicating an invalid auth token.

The following change fixes the problem, and indicated the root cause: the test for cert file was specific to one of the two files (the signing cert) and thus was never testing for the CA cert.

[ayoung@ayoung keystone]$ git diff
diff --git a/keystone/middleware/auth_token.py b/keystone/middleware/auth_token.
index c82e5ef..e042dbb 100644
--- a/keystone/middleware/auth_token.py
+++ b/keystone/middleware/auth_token.py
@@ -565,8 +565,8 @@ class AuthProtocol(object):
                             time=self.token_cache_time)

     def cert_file_missing(self, called_proc_err, file_name):
- return (called_proc_err.output.find(self.signing_cert_file_name)
- and not os.path.exists(self.signing_cert_file_name))
+ return (called_proc_err.output.find(file_name)
+ and not os.path.exists(file_name))

     def verify_uuid_token(self, user_token, retry=True):
         """Authenticate user token with keystone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/10536

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/10536
Committed: http://github.com/openstack/keystone/commit/dada197a4836c94c6a02b51ae35aed256cad9ac4
Submitter: Jenkins
Branch: master

commit dada197a4836c94c6a02b51ae35aed256cad9ac4
Author: Adam Young <email address hidden>
Date: Mon Jul 30 11:11:47 2012 -0400

    Test for Cert by name

    Fixes a typo in checking if cert file exists.

    Bug 1030912

    Change-Id: Iea783aaa6bc425a17799d40cd6b378d90ebe6faf