Token binding can't work with a Service Token

[Jamie Lennox]

The service token is used in conjunction with the user's token when a service is communicating with another service on behalf of a client.

When auth_token middleware validates token binding it validates both the X-Auth-Token and the X-Service-Token. This is pretty much impossible as there is no realistic configuration where the service has the bind credentials for the user token and it's own service token.

When auth_token recieves a X-Auth-Token AND an X-Service-Token it should only validate the bind of the X-Service-Token as this is where this request has originated.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/304400

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/304400
Committed: https://git.openstack.org/cgit/openstack/keystonemiddleware/commit/?id=5ba835f3e145e7ec3e71beabaf8711244159dc37
Submitter: Jenkins
Branch: master

commit 5ba835f3e145e7ec3e71beabaf8711244159dc37
Author: Colleen Murphy <email address hidden>
Date: Mon Apr 11 19:13:56 2016 -0700

    Only confirm token binding on one token

    When using service tokens and kerberos, the REMOTE_USER will be the
    service user, and hence the token bind confirmation will always fail to
    validate the client user's token, making it impossible to use token
    binding with service tokens. This patch adds a test to expose the issue
    and fixes the problem by only validating the token binding for the
    service token when both tokens are in the request.

    Change-Id: I7ba2283e8e58b89f1e42bc738c7e77284321e3a5
    Closes-bug: #1413433

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/keystonemiddleware 4.5.0 release.