yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

** Changed in: keystone
       Status: Fix Committed => Fix Released

** Changed in: keystone
    Milestone: None => juno-1

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1299012

Title:
  V3 api authentication method chaining

Status in OpenStack Identity (Keystone):
  Fix Released
Status in OpenStack Security Advisories:
  Invalid

Bug description:
  When using authentication method chaining for token creation (POST)
  in Keystone V3 api , it is possible to use authentication credentials
  for two different users . For example, if i have an existing token for
  a Demo user, say 6bb934a0120f097a32b5d3cc71f83beb ( created earlier
  for demo tenant) and i have a user say 'test131' in admin tenant

  Now i can make an authentication call using auth method chaining

  {
     "auth":{
        "identity":{
           "methods":[
              "password",
              "token" 
           ],
          "token":{
              "id":"6bb934a0120f097a32b5d3cc71f83beb"
           },
          "password":{
              "user":{
                 "domain":{
                    "id":"default"
                 },
                 "name":"test131",
                 "password":"test131"
              }
           }
        }
     }
  }

  The call will succeed even though two different users authentication
  credentials are used.  The generated token will get properties of
  test131 user although the expirary date is set by demo user token.  If
  we change the methods sequence, the generated token will get all
  properties from demo users token.

  
  This is an undesired security behaviour - token should not  be allowed to generate using credentials from two different users.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1299012/+subscriptions