Token validation failing with use of token caching.

Bug #1817769 reported by prashkre
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Expired
Undecided
Unassigned

Bug Description

In stein, with use of token caching, token deserialization is returning list object instead of keystone.models.token_model.TokenModel object causing it to fail in token validation.

2019-02-26 12:59:07.813 12027 WARNING keystone.server.flask.application [req-352b9795-976e-4346-8bca-00692b814ad5 - - - - -] Authorization failed. The request you have made requires authentication. from xx.xx.xx.xx: Unauthorized: The request you have made requires authentication.
2019-02-26 12:59:08.228 12027 ERROR keystone.token.provider [req-16223960-fb19-4879-b4b2-ea409e4929c3 f539d5d1e792c11dd599a0a30e2603027798f38069147c5b5ec6144e7755d849 b4f8a3e36a844d31b9a0e3e7a9336ef7 - d2cfac6ed5cc481ab91bdeeea6af8e83 d2cfac6ed5cc481ab91bdeeea6af8e83] Unexpected error or malformed token determining token expiry: [126, '\xde\x00\x1e\xc4\x07methods\x91\xa8password\xc4\x19application_credential_id\xc0\xc4\x0fparent_audit_id\xc0\xc4\x16_TokenModel__issued_at\xc4\x1b2019-02-26T17:59:07.000000Z\xc4\tdomain_id\xc0\xc4\x08trust_id\xc0\xc4\x1a_TokenModel__trust_project\xc0\xc4\x07user_id\xd9@9db61c6bad18659d2d6f33e566e7cd6d55828c1b4a67365403760e2cae431dca\xc4\x06system\xc0\xc4\x02id\xd9\xf7gAAAAABcdX5raSAPS7bacoMPpETPCL3jXN_ryZXtgvh_I2tVMaL6nh4LJS3XPAbLrUh5xcwKu1PNAb0OUmSQQ5Rc1PK15ReYzz8mjzcMn4UMbpaMARRdSkk7fPK5n21sfhAV2DPJJy2uOUlEl3iInPAiUVHgcRnXLkr0gfr0dGYCJxul5ODNn85ItemuejLreKo25d4GK0xPmraeV5xSr0i30PDTzDVmuKQE_zs5vWQuNV89D1KvnQc\xc4\x13_TokenModel__domain\xc0\xc4\x0faccess_token_id\xc0\xc4\x18_TokenModel__user_domain\x85\xc4\x0bdescription\xd9#Domain for service users and groups\xc4\x07enabled\xc3\xc4\x02id\xd9 d2cfac6ed5cc481ab91bdeeea6af8e83\xc4\x04name\xa7Service\xc4\x04tags\x90\xc4\x1b_TokenModel__project_domain\x85\xc4\x0bdescription\xd9#Domain for service users and groups\xc4\x07enabled\xc3\xc4\x02id\xd9 d2cfac6ed5cc481ab91bdeeea6af8e83\xc4\x04name\xa7Service\xc4\x04tags\x90\xc4\x08audit_id\xb65gQ3yU0RQ5yI-ZDp_-PdNQ\xc4\x14_TokenModel__trustee\xc0\xc4\x14_TokenModel__trustor\xc0\xc4\x19_TokenModel__access_token\xc0\xc4\x17_TokenModel__expires_at\xc4\x1b2019-02-26T23:59:07.000000Z\xc4\x10federated_groups\xc0\xc4\x0euser_domain_id\xd9 d2cfac6ed5cc481ab91bdeeea6af8e83\xc4\x0bprotocol_id\xc0\xc4\x12_TokenModel__trust\xc0\xc4#_TokenModel__application_credential\xc0\xc4\x0cis_federated\xc2\xc4\nproject_id\xd9 b4f8a3e36a844d31b9a0e3e7a9336ef7\xc4!_TokenModel__trust_project_domain\xc0\xc4\x14identity_provider_id\xc0\xc4\x11_TokenModel__user\x87\xc4\x13password_expires_at\xc0\xabdescription\xa9nova user\xc4\x07enabled\xc3\xc4\tdomain_id\xd9 d2cfac6ed5cc481ab91bdeeea6af8e83\xc4\x07options\x80\xc4\x02id\xd9@9db61c6bad18659d2d6f33e566e7cd6d55828c1b4a67365403760e2cae431dca\xc4\x04name\xa4nova\xc4\x14_TokenModel__project\x88\xc4\tis_domain\xc2\xc4\x0bdescription\xd9/IBM Service Tenant for service users and groups\xc4\x04tags\x90\xc4\x07enabled\xc3\xc4\x02id\xd9 b4f8a3e36a844d31b9a0e3e7a9336ef7\xc4\tparent_id\xd9 d2cfac6ed5cc481ab91bdeeea6af8e83\xc4\tdomain_id\xd9 d2cfac6ed5cc481ab91bdeeea6af8e83\xc4\x04name\xa7service']: AttributeError: 'list' object has no attribute 'expires_at'
2019-02-26 12:59:08.228 12027 ERROR keystone.token.provider Traceback (most recent call last):
2019-02-26 12:59:08.228 12027 ERROR keystone.token.provider File "/usr/lib/python2.7/site-packages/keystone/token/provider.py", line 184, in _is_valid_token
2019-02-26 12:59:08.228 12027 ERROR keystone.token.provider expiry = timeutils.parse_isotime(token.expires_at)
2019-02-26 12:59:08.228 12027 ERROR keystone.token.provider AttributeError: 'list' object has no attribute 'expires_at'

prashkre (prashkre)
description: updated
Revision history for this message
Lance Bragstad (lbragstad) wrote :

I'm unable to recreate this. I added some additional logging output to help diagnose the problem [0]. I setup caching [1] and I repeatedly validated a token. The logs include additional logging that shows the token being fetched from the cache [2].

Here is a list of the packages I have installed locally, from devstack [3].

Let me know if there is anything else I can do to try and recreate this.

[0] https://pasted.tech/pastes/72583200293c1000d615a3da1f037ced42d90040.raw
[1] https://pasted.tech/pastes/3c0e086ed58d087bd143a21ae8a46c702de830b3
[2] https://pasted.tech/pastes/87356af895af503742ff734343a7eb5c1c9c499b.raw
[3] https://pasted.tech/pastes/ee39698dfd48174ec528836a9208e121079cabc7.raw

Changed in keystone:
status: New → Incomplete
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]

Changed in keystone:
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.