Fernet tokens can fail with LDAP identity backends
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Identity (keystone) |
Fix Released
|
High
|
Lance Bragstad | ||
Kilo |
Fix Released
|
High
|
Dolph Mathews |
Bug Description
It is possible for Keystone to fail to issue tokens when using an external identity backend, like LDAP, if the user IDs of a different format than UUID. This is because the Fernet token formatter attempts to convert the UUID to bytes before packing the payload. This is done to save space and results in a shorter token.
When using an LDAP backend that doesn't use UUID format for the user IDs, we get a ValueError because UUID can't convert whenever the ID is to UUID.bytes [0]. We have to do something similar with the default domain in the case that it's not a uuid, same with federated user IDs [1], which we should probably do in this case.
Related stacktrace [2].
[0] https:/
[1] https:/
[2] http://
tags: | added: fernet |
Changed in keystone: | |
importance: | Undecided → Medium |
Changed in keystone: | |
milestone: | none → liberty-1 |
Changed in keystone: | |
status: | Fix Committed → Fix Released |
tags: | removed: kilo-backport-potential |
Changed in keystone: | |
milestone: | liberty-1 → 8.0.0 |
Fix proposed to branch: master /review. openstack. org/186120
Review: https:/