belongsTo not implemented for UUID; raises 500 on mismatch w/ PKI

Bug #1081943 reported by anndy
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Fix Released
Medium
Adam Young

Bug Description

1.Response header should not have Content-Type and Content-Length.

curl -v -X HEAD -H "x-auth-token: ADMIN" http://127.0.0.1:35357/v2.0/tokens/1231231231231123131312

> HEAD /v2.0/tokens/1231231231231123131312 HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: 127.0.0.1:35357
> Accept: */*
> x-auth-token: ADMIN
>
< HTTP/1.1 404 Not Found
< Vary: X-Auth-Token
< Content-Type: application/json
< Content-Length: 111
< Date: Thu, 22 Nov 2012 09:09:41 GMT
<

2. 'belongsTo' dose not work with uuid token

curl -v -X HEAD -H "x-auth-token: ADMIN" http://127.0.0.1:35357/v2.0/tokens/286dc33e16a242a88bcb29c2b9035e62?belongsTo=openstack
> HEAD /v2.0/tokens/286dc33e16a242a88bcb29c2b9035e62?belongsTo=openstack HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: 127.0.0.1:35357
> Accept: */*
> x-auth-token: ADMIN
>
< HTTP/1.1 204 No Content
< Vary: X-Auth-Token
< Content-Length: 0
< Date: Thu, 22 Nov 2012 09:20:08 GMT
<

3. I guess PKI token will get "500 Internal Server Error",
    when tenant id in the PKI token and belongsTo is not the same.
    I don't think it's a right response.

anndy (anndymaktub)
description: updated
Joseph Heck (heckj)
Changed in keystone:
status: New → Triaged
importance: Undecided → Medium
anndy (anndymaktub)
description: updated
Revision history for this message
Dolph Mathews (dolph) wrote :

Not sure when, but the first issue described above appears to have been fixed:

$ curl -v -X HEAD -H "x-auth-token: ADMIN" http://127.0.0.1:35357/v2.0/tokens/1dedbe6f49c14a5a82f3cc7765317c2b
* About to connect() to 127.0.0.1 port 35357 (#0)
* Trying 127.0.0.1...
* connected
* Connected to 127.0.0.1 (127.0.0.1) port 35357 (#0)
> HEAD /v2.0/tokens/1dedbe6f49c14a5a82f3cc7765317c2b HTTP/1.1
> User-Agent: curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8r zlib/1.2.5
> Host: 127.0.0.1:35357
> Accept: */*
> x-auth-token: ADMIN
>
< HTTP/1.1 204 No Content
< Vary: X-Auth-Token
< Content-Length: 0
< Date: Wed, 06 Mar 2013 17:17:15 GMT
<
* Connection #0 to host 127.0.0.1 left intact
* Closing connection #0

Dolph Mathews (dolph)
summary: - Token validation using HEAD method has some bugs
+ belongsTo not implemented for UUID; raises 500 on mismatch w/ PKI
Changed in keystone:
assignee: nobody → Adam Young (ayoung)
status: Triaged → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (master)

Reviewed: https://review.openstack.org/23716
Committed: http://github.com/openstack/keystone/commit/f57f5ba1447f854cf8db4334a219a7d1c9168cfb
Submitter: Jenkins
Branch: master

commit f57f5ba1447f854cf8db4334a219a7d1c9168cfb
Author: Adam Young <email address hidden>
Date: Mon Feb 18 21:30:56 2013 -0500

    add belongs_to check

    Bug 1081943

    The belongs_to check was lost as part of the v3 API work.
    It looks like it was broken to begin with. Fixed

    Change-Id: I4e40758fa9136b76b515100b461a36d6c31b578e

Changed in keystone:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in keystone:
milestone: none → grizzly-rc1
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in keystone:
milestone: grizzly-rc1 → 2013.1
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.