LDAP support broken if UTF8 characters in DN (python2)

[Rafal Ramocki]

Bug is probably related with this one:

https://bugs.launchpad.net/keystone/+bug/1798184
https://bugs.launchpad.net/keystone/+bug/1820333

On keystone 14.1.0 (Rocky) it trows exception when there are UTF-8 encoded characters on users's DN. We're using openldap. In our schema DN is cn=first_name last_name,ou=employee,ou=users,dc=(...). In Poland names with local, utf encoded leters are very common.

It looks like bug can be fixed by following change:

--- a/keystone/identity/backends/ldap/common.py
+++ b/keystone/identity/backends/ldap/common.py
@@ -177,7 +177,7 @@ def convert_ldap_result(ldap_result):
                 ldap_attrs[kind] = [val2py(x) for x in values]
             except UnicodeDecodeError:
                 LOG.debug('Unable to decode value for attribute %s', kind)
- py_result.append((dn, ldap_attrs))
+ py_result.append((utf8_decode(dn), ldap_attrs))
     if at_least_one_referral:
         LOG.debug('Referrals were returned and ignored. Enable referral '
                   'chasing in keystone.conf via [ldap] chase_referrals')

[Rafal Ramocki (rafal-ramocki)]

And exception:

2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi Traceback (most recent call last):
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/wsgi.py", line 148, in __call__
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi result = method(req, **params)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/auth/controllers.py", line 102, in authenticate_for_token
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi app_cred_id=app_cred_id, parent_audit_id=token_audit_id)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/manager.py", line 116, in wrapped
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi __ret_val = __f(*args, **kwargs)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/token/provider.py", line 252, in issue_token
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi token.mint(token_id, issued_at)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/models/token_model.py", line 533, in mint
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi self._validate_domain_scope()
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/models/token_model.py", line 478, in _validate_domain_scope
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi if self.domain_scoped and not self.roles:
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/models/token_model.py", line 418, in roles
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi roles = self._get_domain_roles()
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/models/token_model.py", line 373, in _get_domain_roles
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi self.user_id, self.domain_id
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/manager.py", line 116, in wrapped
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi __ret_val = __f(*args, **kwargs)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/dogpile/cache/region.py", line 1220, in decorate
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi should_cache_fn)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/dogpile/cache/region.py", line 825, in get_or_create
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi async_creator) as value:
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/dogpile/lock.py", line 154, in __enter__
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi return self._enter()
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/dogpile/lock.py", line 94, in _enter
2020-02-10 10:39:4...

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/706791

[Rafal (rafal-ramocki-b)]

During work on keystone it appeared that bug is only releated when use_pool=True in keystone (default). It seams that #1798184 was partial and may not work for pooled connections.

[Rafal (rafal-ramocki-b)]

I've proposed a fix to ldappool. Please review it:

https://review.opendev.org/#/c/708699/

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Gage Hugo <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/keystone/+/706791
Reason: Abandoning since there hasn't been any recent activity, if anyone wants to continue this work, please feel free to restore this or create a new change.