yahoo-eng-team team mailing list archive

[Dolph Mathews <1475762@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

v2 has no knowledge of multiple domains, so all ID references it sees
must exist inside the default domain.

So, a v3 token being validated on v2 must have a project-scope in the
default domain, a user identity in the default domain, and obviously
must not be a domain-scoped token.

The current implementation of Fernet blindly returns tokens to the v2
API with (at least) project references that exist outside the default
domain (I have not tested user references). The consequence is that v2
clients may end up with naming collisions (due to lack of domain
namespacing).

** Affects: keystone
     Importance: Medium
     Assignee: Dolph Mathews (dolph)
         Status: Triaged

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1475762

Title:
  v3 Fernet tokens with references outside the default domain can be
  validated on v2

Status in Keystone:
  Triaged

Bug description:
  v2 has no knowledge of multiple domains, so all ID references it sees
  must exist inside the default domain.

  So, a v3 token being validated on v2 must have a project-scope in the
  default domain, a user identity in the default domain, and obviously
  must not be a domain-scoped token.

  The current implementation of Fernet blindly returns tokens to the v2
  API with (at least) project references that exist outside the default
  domain (I have not tested user references). The consequence is that v2
  clients may end up with naming collisions (due to lack of domain
  namespacing).

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1475762/+subscriptions