Encrypted passwords are not (always) encoded correctly

[Zane Bitter]

From: https://answers.launchpad.net/heat/+question/233335

Passwords that are being stored encrypted in the database may arrive as unicode, but are always treated as strings after decrypting.

This appears to cause a problem with the RDO package, which uses a different encryption library to upstream Heat. Probably upstream handles the conversion appropriately, but the RDO version does not.

keystone.log reports:
2013-07-31 17:14:35 DEBUG [keystone.common.wsgi] {"auth": {"tenantName": "admin", "passwordCredentials": {"username": "admin", "password": "4\u0000\u0000\u00002\u0000\u0000\u00009\u0000\u0000\u0000f\u0000\u0000\u00003\u0000\u0000\u00002\u0000\u0000\u0000b\u0000\u0000\u00008\u0000\u0000\u00006\u0000\u0000\u00008\u0000\u0000\u0000a\u0000\u0000\u0000d\u0000\u0000\u00004\u0000\u0000\u00002\u0000\u0000\u00009\u0000\u0000\u0000a\u0000\u0000\u0000"}}}

We should ensure that the value is correctly encoded as utf-8 before storing it by modifying user_creds_create() in heat/db/sqlalchemy/api.py at line 209

    user_creds_ref.password = crypt.encrypt(unicode(values['password']).encode('utf-8'))

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/46287

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/46287
Committed: http://github.com/openstack/heat/commit/68c1d8ed88ba6b8fa9dd8b50b985fb9ff033a203
Submitter: Jenkins
Branch: master

commit 68c1d8ed88ba6b8fa9dd8b50b985fb9ff033a203
Author: Steven Hardy <email address hidden>
Date: Thu Sep 12 15:18:10 2013 +0100

    Encode values as utf-8 before encrypting

    Ensure strings are correctly encoded before encrypting

    This is necessary because some encryption libraries don't handle
    the unicode conversion appropriately.

    Change-Id: Iebbf32e57ba21d955c1984ee32360379579366c8
    Closes-Bug: #1207707

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/grizzly
Review: https://review.openstack.org/50589

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/grizzly
Review: https://review.openstack.org/50877

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/50877
Committed: http://github.com/openstack/heat/commit/a4090b7189ba64173827f36208bb2320015c8eaa
Submitter: Jenkins
Branch: stable/grizzly

commit a4090b7189ba64173827f36208bb2320015c8eaa
Author: Steven Hardy <email address hidden>
Date: Thu Sep 12 15:18:10 2013 +0100

    Encode values as utf-8 before encrypting

    Ensure strings are correctly encoded before encrypting

    This is necessary because some encryption libraries don't handle
    the unicode conversion appropriately.

    Also includes "tolerate None values to _encrypt" fix from
    bug #1237596, without which the grizzly unit tests fail

    Conflicts:
        heat/db/sqlalchemy/api.py
        heat/heat/tests/test_sqlalchemy_api.py

    Combination of these Change-Id's,
    Iebbf32e57ba21d955c1984ee32360379579366c8
    I39cd4a1bab39def9ad4c214da768e91f411d7697
    with a partial backport (one test) from
    Ie0fdc5068475db7e84f366d1eb2b9ae56db0b3fc
    to ensure test-coverage of the bugfix.

    Closes-Bug: #1237596
    Closes-Bug: #1207707
    Change-Id: I1efaedc983b60a01944d5ebf88084f52ba909e78