Keystone doesn't use http_proxy_to_wsgi middleware

Bug #1885772 reported by s10
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
New
Undecided
Unassigned

Bug Description

Keystone since migration to flask doesn't import nor use http_proxy_to_wsgi middleware.

How to reproduce:
1. Start Keystone with uwsgi as http application
2. Set [oslo_middleware] option enable_proxy_headers_parsing=true in keystone.conf
3. Setup SSL terminating reverse proxy, add headers X-Forwarded-Proto https
4. curl Keystone API version endpoint:
curl https://identity.example.com/

What is expected:
{
  "versions": {
    "values": [
      {
        "id": "v3.13",
        "status": "stable",
        "updated": "2019-07-19T00:00:00Z",
        "links": [
          {
            "rel": "self",
            "href": "https://identity.example.com/v3/"
          }
        ],
        "media-types": [
          {
            "base": "application/json",
            "type": "application/vnd.openstack.identity-v3+json"
          }
        ]
      }
    ]
  }
}

What is an actual result:
{
  "versions": {
    "values": [
      {
        "id": "v3.13",
        "status": "stable",
        "updated": "2019-07-19T00:00:00Z",
        "links": [
          {
            "rel": "self",
            "href": "http://identity.example.com/v3/"
          }
        ],
        "media-types": [
          {
            "base": "application/json",
            "type": "application/vnd.openstack.identity-v3+json"
          }
        ]
      }
    ]
  }
}

If we look at the code, Keystone flask application doesn't use oslo_middleware and application_url from the request, it only gets PATH_INFO from the environment, which can't be set in the reverse proxy:
https://github.com/openstack/keystone/blob/master/keystone/server/flask/common.py#L673

s10 (vlad-esten)
description: updated
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.