yahoo-eng-team team mailing list archive

[Doug Hellmann <doug@xxxxxxxxxxxxxxxx>]

** Changed in: keystone
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1521122

Title:
  K2K: 'NoneType' object has no attribute 'check_output'

Status in OpenStack Identity (keystone):
  Fix Released

Bug description:
  When messing with keystone 2 keystone I was getting 500 Errors telling
  me that the signing process was failing when generating ECP
  assertions. When i looked into it i found it was because the
  federation/idp.py was being imported before the code had the chance to
  do a environment.use_stdlib(). This meant that the global subprocess
  variable [1] was being assigned before the environment code had the
  chance to specify which subprocess to use, leaving the value as None.

  After this because of the overly generic exception handler around
  signing [2] this was being reported as a signing failure and a 500
  Error.

  I was using my own wsgi launcher rather than the /usr/local/bin
  /keystone-wsgi-[admin|public] but it wasn't doing anything complex
  [3].

  This should no longer be a problem when we remove eventlet as we can
  remove the environment code for good.

  Fixes: 
  1) You should always use variables from environment as close to the location as possible as these values are late bound.
  2) We should make a more specific error handler for the signing process. It really should only have to catch the output of the subprocess.


  [1] https://github.com/openstack/keystone/blob/8f30e9a0785234a5a9cf4daaa95207c9adb10835/keystone/federation/idp.py#L40
  [2] https://github.com/openstack/keystone/blob/8f30e9a0785234a5a9cf4daaa95207c9adb10835/keystone/federation/idp.py#L440
  [3] http://paste.openstack.org/show/480338/

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1521122/+subscriptions