ec2 token authentication can't verify an SSL cert

[Steve McLellan]

With keystone is deployed behind SSL, the ec2_authtoken options don't have include the same SSL options that the various clients use so it's not possible to authenticate tokens - the authentication request is:

  requests.post(keystone_ec2_uri, data=creds_json,
                                 headers=headers)

If keystone_ec2_uri is an HTTPS endpoint that requires a CA cert for validation, the request fails, and the instance trying to retrieve metadata via heat-cfn-api will never manage to do so.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/151222

[Jamie Lennox (jamielennox)]

Is it just me or is this just completely broken in keystonemiddleware?

The __init__ function [1] doesn't match the signature of what is being passed by either of the paste factories[2][3] and it looks like the breaking commit[4] seems to be when the package was created.

Would anyone noticed if we simply deleted it?

[1] https://github.com/openstack/keystonemiddleware/blob/3e1bee7100d4214c6745a286601d338137a1cb3b/keystonemiddleware/ec2_token.py#L53
[2] https://github.com/openstack/keystonemiddleware/blob/3e1bee7100d4214c6745a286601d338137a1cb3b/keystonemiddleware/ec2_token.py#L123
[3] https://github.com/openstack/keystonemiddleware/blob/3e1bee7100d4214c6745a286601d338137a1cb3b/keystonemiddleware/ec2_token.py#L130
[4] https://github.com/openstack/keystonemiddleware/commit/ef4e828528b343bc3ea0e3dee25484a4125bc836

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/151222
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=11d04c8d6a7bf3fb5d6de2bd47117cea3c9fe403
Submitter: Jenkins
Branch: master

commit 11d04c8d6a7bf3fb5d6de2bd47117cea3c9fe403
Author: Anant Patil <email address hidden>
Date: Thu Jan 29 13:08:46 2015 +0530

    Enable SSL for EC2Tokens.

    When keystone is deployed behind SSL, the ec2_authtoken options doesn't
    have a way to include the same SSL options that the various clients use,
    so it's not possible to authenticate tokens.

    Capability to handle SSL options is added. ec2token makes use of HTTP
    request object from httplib. Config options to specify CA file, client
    side certificate, key file and "verify server certificate option" will
    be listed under "ec2authtoken" group in conf file.

    Change-Id: Ibede73a17ae951cff00a7d9629a4c08f82208139
    Closes-Bug: #1415223

[Steve Martinelli (stevemar)]

We've had several changes to keystonemiddleware since the original report, marking this as incomplete since this may no longer be an issue