Keystone2Keystone extension leaks file descriptors

[Marek Denis]

Keystone2Keystone extension uses pysaml2 library.
Currently, one method used in Keystone, sigver.read_cert_from_file (https://github.com/openstack/keystone/blob/1e204483e5feebe489ecca409509ae31bacb0ce2/keystone/contrib/federation/idp.py#L446) doesn't properly close file descriptors (https://github.com/rohe/pysaml2/blob/master/src/saml2/sigver.py#L643)

Proposed fix: File a bug in pysaml2 and propose a fix for pysaml2 library.

[Marek Denis (marek-denis)]

The fix for pysaml2 library was just merged: https://github.com/rohe/pysaml2/pull/139

[Lance Bragstad (lbragstad)]

Marek, do you have the second link available again? The source for pysaml2 seems to have changed after you posted the original description.

[Marek Denis (marek-denis)]

Lance,

Here is the diff that fixes the problem. It's already merged to the master branch.
https://github.com/rohe/pysaml2/commit/58400479eeae275f15676f1a66767c95704809cc

[Morgan Fainberg (mdrnstm)]

This isn't a Keystone bug, it is a pysaml bug and there will be/has been a release to solve it.