Cannot use trusts with fernet tokens

[Kairat Kushaev]

Master, devstack (installed today).
1. Enable fernet tokens in Keystone
2. Add the following lib to glance/common/ folder:
http://paste.openstack.org/show/481480/
3. Replace upload method in glance/api/v2/image_data.py with the following:
http://paste.openstack.org/show/481489/
NOTE: it is just example of the code to demonstrate that fernet tokens can't work well with trusts.
4. Restart glance
5. Try to upload any image.
You will get the following error when deleting the trust: http://paste.openstack.org/show/481493/
When you try to upload big image that requires more than hour (or reduce token expiration)
you will get the following: http://paste.openstack.org/show/481492/
Apparently, refreshed token rejected by keystone-middleware.

I faced with the issue when implementing trusts for Glance but it seems that Heat and other services have the same troubles.
UUID tokens works as expected.

[Lance Bragstad (lbragstad)]

Kairat,

Are you able to post the output from the keystone server logs (preferably with debug and verbose set to true)?

[Alexander Makarov (amakarov)]

Looks like trustee cannot delete the trust using Fernet token.

[Kairat Kushaev (kkushaev)]

http://paste.openstack.org/show/481505/ - here is "key" screen output
http://paste.openstack.org/show/481506/ - key-access
Please let me know if you need something else.

[Kairat Kushaev (kkushaev)]

Logs when I got 503 error:
http://paste.openstack.org/show/481509/
http://paste.openstack.org/show/481510/

[Kairat Kushaev (kkushaev)]

FYI, looks like Sahara, Murano, Heat is broken with the same error.
If you turn on fernets and execute some long-running operation then 503 error is raised by keystone middleware.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/257478

[Boris Bobrov (bbobrov)]

This happens only when impersonate=True

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/257478
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=c885eeed341fd2ebca8d7c0bec0c51b00df2f28e
Submitter: Jenkins
Branch: master

commit c885eeed341fd2ebca8d7c0bec0c51b00df2f28e
Author: Boris Bobrov <email address hidden>
Date: Mon Dec 14 19:42:43 2015 +0300

    Verify that user is trustee only on issuing token

    get_token_data is used to gather various data for token. One of the
    checks it does is verifying that the authenticated user is a trustee.
    Before Fernet, it was used during token issuing.

    Impersonation in trusts substitutes information about user in token,
    so instead of trustee, trustor is stored in token.

    With Fernet tokens, get_token_data is used during token validation.
    In case of impersonation, user_id, stored in Fernet token, is id of
    the trustor, but the check described needs this id to be id of the
    trustee.

    Move the check to happen only on token issuing.

    Change-Id: I7c02cc6a1dbfe4e28d390960ac85d4574759b1a8
    Closes-Bug: 1524849

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/keystone 9.0.0.0b2 development milestone.