yahoo-eng-team team mailing list archive

[OpenStack Infra <1532345@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://review.openstack.org/265462
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=0cb49925e48238ccab662f1aa4042562625861bf
Submitter: Jenkins
Branch:    master

commit 0cb49925e48238ccab662f1aa4042562625861bf
Author: Brant Knudson <bknudson@xxxxxxxxxx>
Date:   Fri Jan 8 16:38:08 2016 -0600

    Test enabled emulation with special user_tree_dn
    
    When the enabled emulation is enabled and the user_tree_dn contains
    a special filter character such as ")", the filter that gets built
    is invalid. A test is added that shows the behavior is incorrect.
    
    Change-Id: I161d244a55083b27f9b228b29c6668aa43d4bfc9
    Partial-Bug: 1532345


** Changed in: keystone
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1532345

Title:
  enabled emulation query must filter tree dn

Status in OpenStack Identity (keystone):
  Fix Released

Bug description:
  
  If the user_tree_dn is set to something like cn=foo)bar and enabled emulation is enabled, the filter that's used to find the user in the enabled emulation entry is invalid. The filter will be like "(member=cn=user_id,cn=foo)bar)", which is invalid since the ) in foo)bar terminates the () in the filter. The ) needs to be escaped when used in a filter.

  I assume an exception would be raised so user operations (like getting
  a token) would result in a 500.

  While it's unlikely that anybody would actually configure their system
  this way, might as well fix it.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1532345/+subscriptions