500 error if OS-TRUST:trust is not a dict when authenticate

[wangxiyuan]

env: master branch

when user try to issue a token with OS-TRUST:trust if OS-TRUST:trust is not a dict, keystone will raise 500 error:
SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi Traceback (most recent call last):
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi   File "/opt/stack/keystone/keystone/common/wsgi.py", line 228, in __call__
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi     LOG.warning(
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi   File "/opt/stack/keystone/keystone/auth/controllers.py", line 114, in authenticate_for_token
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi     auth_info = core.AuthInfo.create(auth=auth)
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi   File "/opt/stack/keystone/keystone/auth/core.py", line 142, in create
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi     auth_info._validate_and_normalize_auth_data(scope_only)
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi   File "/opt/stack/keystone/keystone/auth/core.py", line 295, in _validate_and_normalize_auth_data
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi     self._validate_and_normalize_scope_data()
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi   File "/opt/stack/keystone/keystone/auth/core.py", line 255, in _validate_and_normalize_scope_dat
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi     self.auth['scope']['OS-TRUST:trust'])
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi   File "/opt/stack/keystone/keystone/auth/core.py", line 224, in _lookup_trust
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi     trust_id = trust_info.get('id')
Nov 07 16:46:18 SZX1000339032 <email address hidden>[12272]: ERROR keystone.common.wsgi AttributeError: 'str' object has no attribute 'get'

Keystone should add OS-TRUST:trust into the schema check as well.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/522107

[Lance Bragstad (lbragstad)]

Can you add an example request you used to recreate this?

[Lance Bragstad (lbragstad)]

I was able to recreate this with an API test. I'll push a related patch.

[Lance Bragstad (lbragstad)]

Here is what I did to recreate the issue. We can rebase the current proposal on top of https://review.openstack.org/#/c/522356/ and it should be pretty easy to see that it fails with a 400 Bad Request instead of a 500 Internal Server Error.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/522356
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=cf43e3a756b32d83320075c177c0213d3208d677
Submitter: Zuul
Branch: master

commit cf43e3a756b32d83320075c177c0213d3208d677
Author: Lance Bragstad <email address hidden>
Date: Wed Nov 22 18:46:29 2017 +0000

    Expose a bug when authenticating for a trust-scoped token

    The test added here should pass with a 400 Bad Request, but keystone
    doesn't validate the OS-TRUST:trust key of the authentication request
    is actually a dictionary. As a result, it assumes it is a dictionary
    and attempts to use dictionary methods on. This results in a 500
    Internal Server Error when it should really be a 400 Bad Request.

    A subsequent patch can fix this by enhancing the jsonschema
    definition for token authentication.

    Change-Id: I9ea118945870f27dd73000b45673d966ea05ca53
    Partial-Bug: #1733754

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/522107
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=4c824c8088e359d4fd9434e01d1652a26b905335
Submitter: Zuul
Branch: master

commit 4c824c8088e359d4fd9434e01d1652a26b905335
Author: wangxiyuan <email address hidden>
Date: Wed Nov 22 11:41:35 2017 +0800

    Add schema check for OS-TRUST:trust authentication

    If the OS-TRUST:trust is not a dict when authenticating,
    Keystone will raise 500 error. This patch add the
    related schema check to avoid the error.

    Change-Id: I575440fa507c5274e0c3bc09f4cfcb9b3d91a28c
    Closes-bug: #1733754

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 13.0.0.0b3 development milestone.