The keystone server auth plugin methods could mismatch user_id in auth_context

[Morgan Fainberg]

The keystone server blindly overwrites the auth_context.user_id in each auth method that is run. This means that the last auth_method that is run for a given authentication request dictates the user_id.

While this is not exploitable externally without misconfiguration of the external plugin methods and supporting services, this is a bad state that could relatively easily result in someone ending up authenticated with the wrong user_id.

The simplest fix will be to have the for loop in the authentication controller (that iterates over the methods) to verify the user_id does not change between auth_methods executed.

https://github.com/openstack/keystone/blob/f8ee249bf08cefd8468aa15c589dab48bd5c4cd8/keystone/auth/controllers.py#L550-L557

This has been marked as public security for hardening purposes, likely a "Class D" https://security.openstack.org/vmt-process.html#incident-report-taxonomy

[Morgan Fainberg (mdrnstm)]

This probably should also be a lower-prio backport if possible. not a huge risk, but good to ensure we aren't in a bad state if auth methods mutate the user-id between method validation.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/419693

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/419694

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/419695

[Morgan Fainberg (mdrnstm)]

Turns out the issue comes from the test suite not using the AuthContext object. A new patch to ensure we are using AuthContext not a dict will be proposed in lieu of the current fix.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Morgan Fainberg (<email address hidden>) on branch: stable/mitaka
Review: https://review.openstack.org/419695

[OpenStack Infra (hudson-openstack)]

Change abandoned by Morgan Fainberg (<email address hidden>) on branch: stable/newton
Review: https://review.openstack.org/419694

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/419693
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=0f3f08c3df0dd6c32e685dae6726e945b01ea8c7
Submitter: Jenkins
Branch: master

commit 0f3f08c3df0dd6c32e685dae6726e945b01ea8c7
Author: Morgan Fainberg <email address hidden>
Date: Thu Jan 12 15:19:48 2017 -0800

    Force use of AuthContext object in .authentcate()

    Force the keystone.auth.controllers.Auth.authenticate method to
    require the use of an AuthContext object instead of something
    duck-typed (dictionary). This is done to ensure the security and
    integrity of IDENTITY_KEYS are covered and values are not changed
    by a plugin due to the security built into AuthContext being
    circumvented since it was not used. This is not pythonic, this
    is being done for hardening purposes.

    Change-Id: I013846af59587d17b15ca4cf546e6372231f576e
    Closes-Bug: #1656076

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 11.0.0.0b3 development milestone.