| 2014-11-26 20:21:32 |
Steve Martinelli |
description |
In the case where the [ldap] user_id_attribute = uid
Lets say a user attempts to authenticate with stevemar@example.com, and the UID returned is 01234567.
The following log entries show that the leading 0 is dropped:
keystone.common.ldap.core [-] LDAP search: base=o=example.com scope=2 filterstr=(&(emailAddress=stevemar@example.com)(objectClass=person)) attrs=['emailAddress', 'userPassword', 'enabled', 'uid'] attrsonly=0 search_s /opt/stack/keystone/keystone/common/ldap/core.py:926
keystone.common.ldap.core [-] LDAP unbind unbind_s /opt/stack/keystone/keystone/common/ldap/core.py:899
keystone.identity.core [-] ID Mapping - Domain ID: default, Default Driver: True, Domains: False, UUIDs: False, Compatible IDs: True _set_domain_id_and_mapping /opt/stack/keystone/keystone/identity/core.py:321
keystone.identity.core [-] Local ID: 11918649 _set_domain_id_and_mapping_for_single_ref /opt/stack/keystone/keystone/identity/core.py:339
keystone.common.ldap.core [-] LDAP init: use_tls=False tls_cacertfile=None tls_cacertdir=None tls_req_cert=2 tls_avail=1 _common_ldap_initialization /opt/stack/keystone/keystone/common/ldap/core.py:575
** here is where the leading 0 is dropped **
keystone.common.ldap.core [-] LDAP search: base=o=example.com scope=2 filterstr=(&(uid=1234567)(objectClass=person)) attrs=['emailAddress', 'userPassword', 'enabled', 'uid'] attrsonly=0 search_s /opt/stack/keystone/keystone/common/ldap/core.py:926
keystone.common.ldap.core [-] LDAP unbind unbind_s /opt/stack/keystone/keystone/common/ldap/core.py:899
keystone.common.wsgi [-] Authorization failed. Invalid username or password (Disable debug mode to suppress these details.)
The main code in question is the following in keystone.common.ldap.core.py
https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L110-L128
try:
return LDAP_VALUES[val]
except KeyError:
pass
try:
return int(val)
except ValueError:
pass
return utf8_decode(val)
Where we attempt to convert all fields to int, and if it fails proceed to string.
On a semi-related note: the PyCADF library explicitly expects user_ids to be strings, so I had to add str() to user_id in the _get_request_audit_info function, in notifications.py:
initiator = resource.Resource(typeURI=taxonomy.ACCOUNT_USER, name=user_id, host=host)
to
initiator = resource.Resource(typeURI=taxonomy.ACCOUNT_USER, name=str(user_id), host=host) |
In the case where the [ldap] user_id_attribute = uid
Lets say a user attempts to authenticate with stevemar@example.com, and the UID returned is 01234567.
The following log entries show that the leading 0 is dropped:
keystone.common.ldap.core [-] LDAP search: base=o=example.com scope=2 filterstr=(&(emailAddress=stevemar@example.com)(objectClass=person)) attrs=['emailAddress', 'userPassword', 'enabled', 'uid'] attrsonly=0 search_s /opt/stack/keystone/keystone/common/ldap/core.py:926
keystone.common.ldap.core [-] LDAP unbind unbind_s /opt/stack/keystone/keystone/common/ldap/core.py:899
keystone.identity.core [-] ID Mapping - Domain ID: default, Default Driver: True, Domains: False, UUIDs: False, Compatible IDs: True _set_domain_id_and_mapping /opt/stack/keystone/keystone/identity/core.py:321
keystone.identity.core [-] Local ID: 1234567 _set_domain_id_and_mapping_for_single_ref /opt/stack/keystone/keystone/identity/core.py:339
keystone.common.ldap.core [-] LDAP init: use_tls=False tls_cacertfile=None tls_cacertdir=None tls_req_cert=2 tls_avail=1 _common_ldap_initialization /opt/stack/keystone/keystone/common/ldap/core.py:575
** here is where the leading 0 is dropped **
keystone.common.ldap.core [-] LDAP search: base=o=example.com scope=2 filterstr=(&(uid=1234567)(objectClass=person)) attrs=['emailAddress', 'userPassword', 'enabled', 'uid'] attrsonly=0 search_s /opt/stack/keystone/keystone/common/ldap/core.py:926
keystone.common.ldap.core [-] LDAP unbind unbind_s /opt/stack/keystone/keystone/common/ldap/core.py:899
keystone.common.wsgi [-] Authorization failed. Invalid username or password (Disable debug mode to suppress these details.)
The main code in question is the following in keystone.common.ldap.core.py
https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L110-L128
try:
return LDAP_VALUES[val]
except KeyError:
pass
try:
return int(val)
except ValueError:
pass
return utf8_decode(val)
Where we attempt to convert all fields to int, and if it fails proceed to string.
On a semi-related note: the PyCADF library explicitly expects user_ids to be strings, so I had to add str() to user_id in the _get_request_audit_info function, in notifications.py:
initiator = resource.Resource(typeURI=taxonomy.ACCOUNT_USER, name=user_id, host=host)
to
initiator = resource.Resource(typeURI=taxonomy.ACCOUNT_USER, name=str(user_id), host=host) |
|
