Validation of paramaters during Create User

[Rohit Karajgi]

Affected version 2012.1 (essex/stable)

In addition to the fixes made by https://bugs.launchpad.net/keystone/+bug/987121, for Folsom,
the following validations should also be made while user creation. Currently there are no checks or
error responses returned for the following scenarios.

1. User with an empty name should not be created.
2. User with an empty password should not be created
3. Email format should be validated while creating a user (currently email addresses such as '12345' are accepted by the API)
4. User having password exceeding max length should not be created - There needs to be a password length limit defined.
The password belongs to a TEXT type field and can be injected with huge number of characters (atleast 64K).
I could create a user with a password of 256 characters.

The fixes made to https://bugs.launchpad.net/keystone/+bug/987121 should also get backported to stable/essex

[Joseph Heck (heckj)]

Rohit - as this is describing new functionality that will take more than a single commit to make, I suggest you create a blueprint in Keystone to cover this work.

[Rohit Karajgi (rohitk)]

Hi Joe,

Blueprint created here: https://blueprints.launchpad.net/keystone/+spec/create-user-validation

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/10235

[Sean Dague (sdague)]

I'm not really convinced this should be stuck in tempest, we need to start moving these kinds of functional tests back to the projects where it's closer to the source.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/27593

[Dolph Mathews (dolph)]

Passwords are optional and should not be validated.

[ls_andy (hw-ls000)]

There is a similar problem,when create a project(tenant),the paramater "enabled" should be validated.This paramater can be assigned a int value( like "5"),rather than a bool value. But,if we assign "5" to "enabled", the API "List Tenant"(cls command "keystone tenant-list",REST request "List tenants") will be unavailable.

[Dolph Mathews (dolph)]

ls_andy: that's actually by design (bool is a subclass of int in python), however I agree that it's unexpected behavior from the JSON / HTTP API perspective. Feel free to open a new bug if you'd like to see that behavior changed!

[Dolph Mathews (dolph)]

Unassigning due to inactivity.

[Lance Bragstad (lbragstad)]

We might be able to leverage:

https://review.openstack.org/#/c/86483/

to close this once the JSON schema validator is applied to the Identity API.

https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:validator,n,z

[Ajaya Agrawal (ajayaa)]

https://review.openstack.org/#/c/114997/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/132122

[Adam Young (ayoung)]

The problem is that the password and userid fields are truncating, which is a backend issue, not a schema issue.

MySQL should have an option to not truncate if the string is too long, and instead throw an exception. Or the SqlAlchemy layer should allow for querying the schema in a RDBMS agnostic way.

I suspect that, at least for the user table, we should be setting

 STRICT_TRANS_TABLES

although

 STRICT_ALL_TABLES.

Will ensure this is settled across all of the tables, and maybe what we want.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/132122
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=f2103ffdcd2523662f791c01aaf94709cec06cf3
Submitter: Jenkins
Branch: master

commit f2103ffdcd2523662f791c01aaf94709cec06cf3
Author: Lance Bragstad <email address hidden>
Date: Thu Oct 30 21:58:29 2014 +0000

    Implement validation on the Identity V3 API

    Use JSONSchema to validate CRUD operations on the V3 Identity resources.
    This includes wrapping the create and update methods for Users and
    Groups.

    Co-Authored-By: Lin Hua Cheng <email address hidden>

    Change-Id: Ia260838c85f897c52740217d8d222bb86edc11c6
    bp: identity-api-validation
    Closes-Bug: #999084
    Closes-Bug: #1387605