clear text passwords shown in log file at DEBUG level

[Giulio Fidente]

horizon seems to be printing in the log file the passwords in clear text at the DEBUG level

[Julie Pichon (jpichon)]

Could you specify which loggers are logging in clear text? If it's coming from the keystone client, I suspect this may be a duplicate of bug 1004114. Looking at the patch history, it doesn't look like the keystone client part of the fix was ever merged...

[Giulio Fidente (gfidente)]

confirmed, this is from keystone client:

2014-06-09 08:41:36,538 1748 DEBUG openstack_auth.backend Beginning user authentication for user "admin".
2014-06-09 08:41:36,538 1748 DEBUG keystoneclient.session REQ: curl -i -X POST http://192.168.4.2:5000/v2.0/tokens -H "Content-Type: application/json" -H "Accept: application/json" -H "User-Agent: python-keystoneclient" -d '{"auth": {"passwordCredentials": {"username": "admin", "password": "wrongpass"}}}'

[Julie Pichon (jpichon)]

Thanks for the reply, I will mark this as a duplicate of bug 1004114.