Trust execution fails when trustor is in LDAP

Bug #1367952 reported by Adam Young
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Fix Released
Medium
Adam Young

Bug Description

the token provider code is checking the enabled attribute on the when excuting a trust. However, in many LDAP deployments, this value is unset, and

For the auth plugins, the enabled logic is calculated in identity/core.py. THe token provider should use this code as well.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.openstack.org/120592

Changed in keystone:
assignee: nobody → Adam Young (ayoung)
status: New → In Progress
tags: added: juno-rc-potential
Changed in keystone:
importance: Undecided → Medium
tags: added: ldap
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (master)

Reviewed: https://review.openstack.org/120592
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=948d51025fb7759d2f1267e0c25edd8832495b1c
Submitter: Jenkins
Branch: master

commit 948d51025fb7759d2f1267e0c25edd8832495b1c
Author: Adam Young <email address hidden>
Date: Wed Sep 10 21:37:27 2014 +0000

    Safer check for enabled in trusts

    For some LDAP backends, the enable attribute is not
    directly set. Since we have a wrapper function in identity/core,
    we can use that instead.

    Adds tests that disabling trustor or trustee prevents
    trust execution.

    Closes-Bug: 1367952

    Change-Id: I6d3c26e0e6e6c0d27ea7b910340fae5792eaceda

Changed in keystone:
status: In Progress → Fix Committed
Dolph Mathews (dolph)
Changed in keystone:
milestone: none → juno-rc1
Thierry Carrez (ttx)
Changed in keystone:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in keystone:
milestone: juno-rc1 → 2014.2
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.