Role names should be globally unique and required

[Anthony Young]

Steps to reproduce:

$ keystone --debug --username admin --password secrete --tenant_name admin --auth-url http://127.0.0.1:5000/v2.0/ role-create --name=this
$ keystone --debug --username admin --password secrete --tenant_name admin --auth-url http://127.0.0.1:5000/v2.0/ role-create --name=this

Expected:

Second command should fail

Actual:

Both succeed.

A related issue is that the following yields a role with no name:

$ keystone --debug --username admin --password secrete --tenant_name admin --auth-url http://127.0.0.1:5000/v2.0/ role-create

[Dean Troyer (dtroyer)]

The required --name is fixed in https://review.openstack.org/4375

[Chris Fattarsi (chris-fattarsi)]

It looks like this patch only enforces role name constraints on the keystone client. Is there any enforcement on the server-side as well, where it is probably most important?

Seems like could be a serious vulnerability if people were using role names to key off of.

[Dolph Mathews (dolph)]

I'm still able to reproduce the original issue on master (although the syntax for --auth-url has since changed to --auth_url).

[justinsb (justin-fathomdb)]

I believe this bug is still present, and I think it might well be a release-blocker. Even if we are using keystone now in such a way that we side-step any issues, I think having garbage data in the database will cause serious problems later as the code evolves.

root@privatecloud1:/home/justinsb/openstack-simple-config# keystone role-list
+----------------------------------+----------------------+
| id | name |
+----------------------------------+----------------------+
| 13caa3845c254fc9ade0bdc9b1d6f29a | admin |
| 6cda98de42d34aada583ac71b29eae65 | KeystoneAdmin |
| afe1cd7b0fac469488af1f29b9a3b9ea | KeystoneServiceAdmin |
| bf05b6fe85a041af8d45eac27432b6db | KeystoneServiceAdmin |
| f573295fedc4486b8aa4dda64cb35526 | KeystoneAdmin |
+----------------------------------+----------------------+

[Dolph Mathews (dolph)]

Promoting priority, as I agree with Justin.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/5485

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/5485
Committed: http://github.com/openstack/keystone/commit/d61aedaf868d984f1c317a73b362a2e7a366ef89
Submitter: Jenkins
Branch: master

commit d61aedaf868d984f1c317a73b362a2e7a366ef89
Author: Yong Sheng Gong <email address hidden>
Date: Sun Mar 18 23:56:35 2012 +0800

    unique role name constraint

      For SQL identity backend, add unique constraint with column definition;
    for kvs and ldap backend, use python code to apply this constraint.
    Test cases test_create_duplicate_role_name_fails and test_rename_duplicate_role_name_fails are added to guard it.
    python run_tests.py test_backend_ldap test_backend_kvs test_backend_sql pass.

    bug 932258.

    Change-Id: I990f17a270e84d35c078f215c587a81d6784c192