** Changed in: keystone/kilo Status: Fix Released => Fix Committed
** Changed in: keystone/kilo Milestone: 2015.1.2 => 2015.1.3 -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1475762 Title: v3 tokens with references outside the default domain can be validated on v2 Status in OpenStack Identity (keystone): Fix Released Status in OpenStack Identity (keystone) kilo series: Fix Committed Bug description: v2 has no knowledge of multiple domains, so all ID references it sees must exist inside the default domain. So, a v3 token being validated on v2 must have a project-scope in the default domain, a user identity in the default domain, and obviously must not be a domain-scoped token. The current implementation of Fernet blindly returns tokens to the v2 API with (at least) project references that exist outside the default domain (I have not tested user references). The consequence is that v2 clients may end up with naming collisions (due to lack of domain namespacing). To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1475762/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp