the domain name is case insensitive with keystone v3

[hill]

I found the domain name is case insensitive when i use keystone /v3/auth/tokens which means

i can use the "default", "deFault" as domain name to get the valid token.

When i checked the code , i found the keystone uses database query to get the domain by name , if my database

is mysql with default configuration then it is case insensitive, but the postgres is case sensitive by default.

This is not a consistent API behavior. I would like to get the same output no matter what kind of db in backend.

I propose to use case sensitive due to security reason.

[Dolph Mathews (dolph)]

I restored some old tests that illustrate keystone's intent to be case sensitive. On the MySQL side, you can certainly configure it to be case sensitive (e.g. using utf8_bin, although I'm not sure that the best solution?), so perhaps this is something we can address via migrations.

[Dolph Mathews (dolph)]

https://review.openstack.org/#/c/25713/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/25713
Committed: http://github.com/openstack/keystone/commit/e33e6dbeb07f14a9c551da012be71d870f838834
Submitter: Jenkins
Branch: master

commit e33e6dbeb07f14a9c551da012be71d870f838834
Author: Dolph Mathews <email address hidden>
Date: Fri Mar 29 09:30:35 2013 -0500

    Test for backend case sensitivity

    Partial-Bug: 1229093
    Change-Id: I912f05de52842fa0e564764c440dd9621e05fcbc

[Kurt Seifried (kseifried)]

Does this need a CVE?

[Dolph Mathews (dolph)]

Automatically unassigning due to inactivity.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/236103

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/236103
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=33860b31fcbf7dc8a6ffdcbc1c0e131e652cdcff
Submitter: Jenkins
Branch: master

commit 33860b31fcbf7dc8a6ffdcbc1c0e131e652cdcff
Author: henriquetruta <email address hidden>
Date: Fri Oct 16 18:02:10 2015 -0300

    Improves domain name case sensitivity tests

    The old domain name case sensitivity test only tested if we were able to
    create a domain, but did not test the get_domain_by_name resource_api
    call case sensitivity

    Change-Id: I2df8611d4e4f983ad91b32c41168ffe2e082e532
    Closes-Bug: 1229093

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/keystone 9.0.0.0b3 development milestone.