Deprecate admin_token in auth_token

Bug #1306981 reported by Brant Knudson
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
python-keystoneclient
Fix Released
Wishlist
Brant Knudson

Bug Description

The admin_token option shouldn't be used in auth_token. It's used to specify a token to be used to perform operations on the identity server, so would typically be set to the admin token. The admin token should only be used to initially set up the Keystone server, and then the admin token functionality should be disabled. If this recommended setup is used then the auth_token middleware shouldn't be using the admin token / auth_token.

In addition to not using it on principle, the auth_token middleware exhibits odd behavior if the identity server responds with a 401 -- it switches to using the admin user & password (see bug 1307252).

In preparing for removal of the admin_token option, let's deprecate it, and print a warning not to use it.

Brant Knudson (blk-u)
Changed in python-keystoneclient:
assignee: nobody → Brant Knudson (blk-u)
importance: Undecided → Wishlist
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to python-keystoneclient (master)

Fix proposed to branch: master
Review: https://review.openstack.org/87091

Changed in python-keystoneclient:
status: New → In Progress
Dolph Mathews (dolph)
description: updated
Revision history for this message
Openstack Gerrit (openstack-gerrit) wrote : Fix merged to python-keystoneclient (master)

Reviewed: https://review.openstack.org/87091
Committed: https://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=d6f9f2a860213352ff233585aa5e05dca4b479aa
Submitter: Jenkins
Branch: master

commit d6f9f2a860213352ff233585aa5e05dca4b479aa
Author: Brant Knudson <email address hidden>
Date: Sat Apr 12 11:41:44 2014 -0500

    Deprecate admin_token option in auth_token

    The admin_token option shouldn't be used with the auth_token
    middleware. It's used to specify a token to be used to perform
    operations on the identity server, so would typically be set
    to the admin token. The admin token should only be used to
    initially set up the Keystone server, and then the admin token
    functionality should be disabled. If this recommended setup is
    used then the auth_token middleware shouldn't be using the
    admin token / auth_token.

    In preparing for removal of the admin_token option, the option
    is now deprecated. A warning will be logged if it's set.

    DocImpact

    Change-Id: I5bc4f4a6ad7984892151c8011ccd92f166aba4c2
    Closes-Bug: #1306981

Changed in python-keystoneclient:
status: In Progress → Fix Committed
Dolph Mathews (dolph)
Changed in python-keystoneclient:
milestone: none → 0.9.0
Dolph Mathews (dolph)
Changed in python-keystoneclient:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.