yahoo-eng-team team mailing list archive

[Adam Gandelman <1355489@xxxxxxxxxxxxxxxxxx>]

** Changed in: keystone/icehouse
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1355489

Title:
  authenticate ldap binary fields fail when converting fields to utf8

Status in OpenStack Identity (Keystone):
  Fix Released
Status in Keystone icehouse series:
  Fix Released

Bug description:
  When attempting to fetch a token with a ldap backed keystone
  authentication, users are never able to authenticate.

  Setup:
    Version: stable/icehouse
    LDAP: Active Directory.  User fields have many binary fields (i.e. thumbnail_image).
    driver=keystone.identity.backends.ldap.Identity

  Observance
    Request: When attempting to fetch a token with known valid creds via: keystone token-get
    Response: The request you have made requires authentication. (HTTP 401)

  Debugging Session:
  During a IRC #openstack-keystone chat 8/11 with ayoung, wwriverrat1, mdorman, it was discovered the method _id_to_dn calls search without limiting the return attributes.  When the internal search is performed, each of the attributes returned from ldap are being converted to utf8 including the binary fields.  This causes the call to raise exception and quietly reject the request. If the code prevents these fields from returning, all is well.

  Source (stable/icehouse): 
  https://github.com/openstack/keystone/blob/stable/icehouse/keystone/common/ldap/core.py#L464-L470

  Adding a search value for attrlist eliminated the error:
  Changed the following line 470
      'objclass': self.object_class})
  to
      'objclass': self.object_class}, attrlist=[self.id_attr])
  resolved the issue.

  This should be a safe fix because the actual return attributes are
  never needed nor returned. NOTE: passing in a empty list did not fix
  the problem.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1355489/+subscriptions