Keystone admin_token_auth middleware deprecation

[Tom Cameron]

Keystone warns of deprecation of the admin_token_auth middleware and notes that it presents a security risk. An example warning from the keystone-apache-error.log file:

2016-05-26 20:16:44.912455 2016-05-26 20:16:44.912 10146 WARNING keystone.middleware.core [req-0a96e99f-7443-475b-b3f0-9226b8351694 - - - - -] The admin_token_auth middleware presents a security risk and should be removed from the [pipeline:api_v3], [pipeline:admin_api], and [pipeline:public_api] sections of your paste ini file.

[Dolph Mathews (dolph)]

Removing the middleware is easy, but that means you can't use keystone.conf [DEFAULT] admin_token anymore, either. Instead, 'keystone-manage bootstrap' provides a means to bootstrap your initial admin user + admin project + admin role.

[Dolph Mathews (dolph)]

Just a partial patch to illustrate what it's talking about: https://review.openstack.org/321854

[OpenStack Infra (hudson-openstack)]

Change abandoned by Dolph Mathews (<email address hidden>) on branch: master
Review: https://review.openstack.org/321854
Reason: Abandoning then, because it'll be another year before this can merge.

[Jean-Philippe Evrard (jean-philippe-evrard)]

Like mentioned in the commit, OSA is barely consuming keystone changes.

OSA will add a release note to state the current known issue.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/330251

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/330251
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible-os_keystone/commit/?id=d27d055dbe2857dde236c8c8e6df5f530cc83efa
Submitter: Jenkins
Branch: master

commit d27d055dbe2857dde236c8c8e6df5f530cc83efa
Author: Jimmy McCrory <email address hidden>
Date: Wed Jun 15 15:24:54 2016 -0700

    Add note on admin_token_auth deprecation

    The admin_token_auth middleware has been deprecated. Include a note
    informing users and providing instructions on removing it from
    keystone's WSGI pipelines.

    Closes-Bug: 1586159
    Change-Id: I4ec9e6f098585ddbfcfb7ee826e582af7a12c734

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/openstack-ansible-os_keystone 14.0.0.0b2 development milestone.