** Also affects: keystone/icehouse
Importance: Undecided
Status: New
** Changed in: keystone/icehouse
Status: New => In Progress
** Changed in: keystone/icehouse
Importance: Undecided => Medium
** Changed in: keystone/icehouse
Assignee: (unassigned) => Nathan Kinder (nkinder)
** Tags removed: icehouse-backport-potential
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1355489
Title:
authenticate ldap binary fields fail when converting fields to utf8
Status in OpenStack Identity (Keystone):
In Progress
Status in Keystone icehouse series:
In Progress
Bug description:
When attempting to fetch a token with a ldap backed keystone
authentication, users are never able to authenticate.
Setup:
Version: stable/icehouse
LDAP: Active Directory. User fields have many binary fields (i.e.
thumbnail_image).
driver=keystone.identity.backends.ldap.Identity
Observance
Request: When attempting to fetch a token with known valid creds via:
keystone token-get
Response: The request you have made requires authentication. (HTTP 401)
Debugging Session:
During a IRC #openstack-keystone chat 8/11 with ayoung, wwriverrat1, mdorman,
it was discovered the method _id_to_dn calls search without limiting the return
attributes. When the internal search is performed, each of the attributes
returned from ldap are being converted to utf8 including the binary fields.
This causes the call to raise exception and quietly reject the request. If the
code prevents these fields from returning, all is well.
Source (stable/icehouse):
https://github.com/openstack/keystone/blob/stable/icehouse/keystone/common/ldap/core.py#L464-L470
Adding a search value for attrlist eliminated the error:
Changed the following line 470
'objclass': self.object_class})
to
'objclass': self.object_class}, attrlist=[self.id_attr])
resolved the issue.
This should be a safe fix because the actual return attributes are
never needed nor returned. NOTE: passing in a empty list did not fix
the problem.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1355489/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
