Public bug reported:
In service table only "ID" is primary not type.
(i.e) I can create two service of type "compute". Assume if I do so,
then horizon and other services clients will throw exception since
they don't know which service to pick it up.
Best to way to avoid this, is to not allow
Ali (haneef)
Status: New
** Changed in: keystone
Assignee: (unassigned) => Haneef Ali (haneef)
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1402757
Title:
Log mess
Public bug reported:
Eventhough dogpile caching is disabled, most of the calls generate the
following three lines
2015-02-03 15:17:13.041 30043 DEBUG dogpile.core.dogpile [-]
NeedRegenerationException _enter
/opt/stack/venvs/openstack/lib/python2.7/site-packages/dogpile/core/dogpile.py:94
2015
Public bug reported:
If you validate fernet token, the token response has 2 methods. Since
the token is obtained using the "password" method, the response should
only have "password" method
ex - token response
"expires_at": "2015-03-14T03:06:39Z",
"extras": {},
"issued_at":
Public bug reported:
root@4d4627c10662:/etc/keystone# curl -k -H "X-Auth-Token:ADMIN" -H
"X-Subject-Token:$d" http://localhost:35357/v3/auth/tokens | python -mjson.tool
% Total% Received % Xferd Average Speed TimeTime Time Current
Dload Upload
Public bug reported:
Revoke a project scoped token
You see 3 entries in revocation_event table
1) (id, user_id, project_id, role_id, issued_before)
2) (id, user_id,, issued_before)
3) (id, user_id,, issued_before)
2 & 3 are redundant. Definitely 3) is redundant as it is same as 2)
BTW, this
Public bug reported:
In v2 policy.json owner is defined as
"owner" : "user_id:%(user_id)s",
It should be
"owner" : "user_id:%(user_id)s or user_id:%(target.token.user_id)s",
Affected APIs,
Using default v2 policy file a user can't delete his own token due to this
defect
** Affects:
Public bug reported:
Keystone middleware calls GET /v2.0/revoked every 10 sec which
generates a query simar to
SELECT token.id AS token_id, token.expires AS token_expires, token.extra
AS token_extra, token.valid AS token_valid, token.user_id AS
token_user_id, token.trust_id AS token_trust_id FR
Public bug reported:
By default keystone gets the id from first field of DN. It doesn't use
user_id_attibute mapping from keystone.conf
In the following code, "id" attribute is always 1 element in DN
---Relevent code---
@staticmethod
def _dn_to_id(dn):
return utf8_decode(ldap.dn.s
Public bug reported:
This is a wish list
We need certificates API to get the PKI certficates in the services. If
we depreicate v2.0 api, it will be odd, if the services rely on v2.0 api
to fetch certificates.
** Affects: keystone
Importance: Undecided
Status: New
--
You received
Public bug reported:
Keystone should bootstrap CONF.member_role_name. As of now , it is
created on first create_user call . In case of LDAP backend there is
no create_user call, so we will be missing this role. Horizon will not
work without this role.
Just like "default" domain, we should al
Public bug reported:
UserDomainGrant and GroupDomainGrant has foriegn key relation with
domains. So we can't delete a domain unless we remove the grants.
On deletedomain we need to
-- Delete users
-- Delete groups
-- Delete projects
which should take care of removal of foreign key rel
Public bug reported:
Actually this is a wishlist.
We have caching in assignment and token. It will be really helpful if
we have caching in catalog as this is mostly static data. This will
greatly improve create token performance.
** Affects: keystone
Importance: Undecided
Status:
Public bug reported:
This api is in the doc, but not in code
** Affects: keystone
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1284895
Public bug reported:
Keystone version discovery is broken if you configure admin_endpoint
and public_endpoint in conf file. Version discovery is supposed to
return the configured endpoint, but it will always return "admin"
endpoint. This bug is in Juno/Kilo/master. This is only applicable for
Public bug reported:
CADF payload doesn't have initiator for any of the v2 calls.
e.g
1) v2 update user
2) This internally calls identity_driver.update_user without imitator
argument which is a default argument initialized to None
3) If we call v3 update user, then we pass initiator.
Public bug reported:
TypeError: token must be bytes.
(keystone.common.wsgi): 2015-03-13 03:04:16,968 ERROR token must be bytes.
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/keystone/common/wsgi.py", line
238, in __call__
result = method(context, **params)
Public bug reported:
Relevant line in the code
https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py#L158
Relevant logs
keystone.contrib.federation.utils): 2015-03-25 02:40:06,920 DEBUG utils process
rules: [{u'remote': [{u'type': u'openstack_user', u'any_one
The exception doesn't haappen with new mapping
** Changed in: keystone
Status: New => Invalid
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1436141
Title:
Federation get unsco
Public bug reported:
Now the recommended way to install keystone is via apache. But
httpd/keystone.py is not included when we do python setup.py install
in keystone. It should be included
** Affects: keystone
Importance: Undecided
Status: New
--
You received this bug notificatio
Public bug reported:
Why do we need CA key? In a real deployment I were to get a cert for
my server from Verisign, then verisign won't provide its key.
Basically the code should work without CA key.
I believe it is not required for ssl setup and signing.
[ssl]
#enable = True
#certfile = /et
Public bug reported:
This is a feature request
We should alow user supplied domain_id/user_id. There are some policy
defintions in policy.v2.cloudadmin.json which relies on user being on
particular domain. We really don't want to have UUID in policy files
to identify the domain_id. One way to
Public bug reported:
Disable domain only revokes project scope token. It doesn't revoke
domain scoped tokens
** Affects: keystone
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Key
Public bug reported:
If you disable a domain, the users in the domain are not disabled.
** Affects: keystone
Importance: Undecided
Status: New
** Summary changed:
- disable domain
+ Disable domain doesn't disable users in the domain
--
You received this bug notification because
Public bug reported:
Revoke token intermittently dumps stack trace. I don't see "remove"
method in RevokeTree object. May be I'm missing something
(keystone.common.wsgi): 2014-03-20 03:17:55,054 ERROR 'RevokeTree' object has
no attribute 'remove'
Traceback (most recent call last):
File "/usr
Looks like this is fixed now in upstream on 3/8 by Morgan
** Changed in: keystone
Status: New => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1295212
Title:
Revok
Public bug reported:
V3 list_user filter by email throws excpetion. There is no such
attribute email.
keystone.common.wsgi): 2014-04-11 23:09:00,422 ERROR type object 'User' has no
attribute 'email'
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/keystone/common/wsgi.
Public bug reported:
This is applicable for UUID and PKI tokens.
Token table has extra column where we store role information. It is a
blob with 64K limit
Basically we can do the following
Say user is U, and Project is P
for i =1 to 1000 ( or any large number)
role x =
Public bug reported:
(keystone.common.wsgi): 2015-12-01 21:53:58,603 INFO wsgi __call__ GET
http://192.168.245.9:35357/v3/groups/42b6bb3bb70f487cbf9633bf55eb9ddc/users?name=admin
(keystone.common.wsgi): 2015-12-01 21:53:58,610 ERROR wsgi __call__ Entity
'' has no property
'name'
Traceback (most
Public bug reported:
This is a wish list.
Since we are moving to v3, it is better to add v3 endpoint in
sample_data.sh. We still have only v2.0 endpoint.I don't think
keystoenclient will be affected since it doesn't use the endpoint from
catalog, but relies on version discovery
** Affects: keys
Public bug reported:
Keystone is moving towards v3. Identity operations are supposed to use
domain scoped token and all the services are supposed to use tenant
scoped token. The concept of domain_admin will work only if you use
domain scoped token.
Most of l the keystone unit tests use v3 token
Public bug reported:
issued_at field is only in v3, but v2 token response has issued_at. This
is not a major issue. But the format of the date is inconsistent
"token": {
"expires": "2014-10-08T00:51:35Z",
"id": "a94eec3993a74bf4b26f91bd485f3b6d",
"issued_at"
Public bug reported:
Keystone uses same topic for both normal notificaiton and audit.
Ideally both should be in different topic. Both has different
security/persistence requirement
** Affects: keystone
Importance: Undecided
Status: New
--
You received this bug notification becau
Public bug reported:
There are 2 events in the path
# curl -k -H "X-Auth-Token:SomeToken"
http://localhost:35357/v3/OS-REVOKE/events | python -mjson.tool
% Total% Received % Xferd Average Speed TimeTime Time Current
Dload Upload Total S
Public bug reported:
If you enable "messaging" keystone creates a queue "notificaiton.info"
and sends a message with the routing key "notification.info" to the
queue.
As per rabbitmq, producer sends a message to an "Exchange" and
Consumer creates a queue and attaches to the exchange to receve t
Public bug reported:
Steps to reproduce
1) Enable domain specifc dirvers for identity
domain_specific_drivers_enabled = True
2) Add domain specific configuration files
3) Either get a token which as admin priveillage or ADMIN token
configured in keystone.conf
4) Use the token to go GET
Public bug reported:
This bug is only for fernet token. Configure keystone to use fernet
token. Call any operation without passing a X-Auth-Token. It reports 500
error. It should throw 401
e.g curl -X DELEETE $OS_AUTH_URL/v3/projects/ Haneef Ali (haneef)
--
You received this bug notification
Public bug reported:
{
" region" : {}
}
This is a valid request in kilo. But this no longer works in liberty.
Liberty is throwing "index_out_of_range" error which is re thrown as
schema validation error.
https://github.com/openstack/keystone/blob/master/keystone/common/validation/__init__.py#
Public bug reported:
Some of the endpoints include tenant information and if we use domain
scoped token there is no tenant information. So the catalog doesn't
have any entry for those services for domain scoped token which looks
odd
Since domain scoped token is used only by identity, the better
39 matches
Mail list logo