Attachment 610929 Details for Bug 855491 – CVE-2012-4413-stable-essex-v4.txt

CVE-2012-4413-stable-essex-v4.txt

CVE-2012-4413-stable-essex-v4.txt (text/plain), 5.59 KB, created by Kurt Seifried on 2012-09-08 04:19:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2012-09-08 04:19:12 UTC

Size: 5.59 KB

patch

obsolete

>diff --git a/keystone/identity/core.py b/keystone/identity/core.py
>index db3ce31..22df815 100644
>--- a/keystone/identity/core.py
>+++ b/keystone/identity/core.py
>@@ -525,6 +525,8 @@ class RoleController(wsgi.Application):
>         self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
>         self.identity_api.add_role_to_user_and_tenant(
>                 context, user_id, tenant_id, role_id)
>+        self.token_api.revoke_tokens(context, user_id)
>+
>         role_ref = self.identity_api.get_role(context, role_id)
>         return {'role': role_ref}
> 
>@@ -555,7 +557,7 @@ class RoleController(wsgi.Application):
>         if not roles:
>             self.identity_api.remove_user_from_tenant(
>                     context, tenant_id, user_id)
>-        return
>+        self.token_api.revoke_tokens(context, user_id)
> 
>     # COMPAT(diablo): CRUD extension
>     def get_role_refs(self, context, user_id):
>@@ -597,6 +599,8 @@ class RoleController(wsgi.Application):
>         self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
>         self.identity_api.add_role_to_user_and_tenant(
>                 context, user_id, tenant_id, role_id)
>+        self.token_api.revoke_tokens(context, user_id)
>+
>         role_ref = self.identity_api.get_role(context, role_id)
>         return {'role': role_ref}
> 
>@@ -624,3 +628,4 @@ class RoleController(wsgi.Application):
>         if not roles:
>             self.identity_api.remove_user_from_tenant(
>                     context, tenant_id, user_id)
>+        self.token_api.revoke_tokens(context, user_id)
>diff --git a/keystone/token/core.py b/keystone/token/core.py
>index 0d1101d..a0c89e2 100644
>--- a/keystone/token/core.py
>+++ b/keystone/token/core.py
>@@ -38,6 +38,10 @@ class Manager(manager.Manager):
>     def __init__(self):
>         super(Manager, self).__init__(CONF.token.driver)
> 
>+    def revoke_tokens(self, context, user_id):
>+        for token_id in self.list_tokens(context, user_id):
>+            self.delete_token(context, token_id)
>+
> 
> class Driver(object):
>     """Interface description for a Token driver."""
>@@ -97,6 +101,13 @@ class Driver(object):
>         """
>         raise exception.NotImplemented()
> 
>+    def revoke_tokens(self, user_id):
>+        """Invalidates all tokens held by a user.
>+
>+        :raises: keystone.exception.UserNotFound
>+        """
>+        raise exception.NotImplemented()
>+
>     def _get_default_expire_time(self):
>         """Determine when a token should expire based on the config.
> 
>diff --git a/tests/test_keystoneclient.py b/tests/test_keystoneclient.py
>index 0f6f628..6e45790 100644
>--- a/tests/test_keystoneclient.py
>+++ b/tests/test_keystoneclient.py
>@@ -769,15 +769,15 @@ class KcMasterTestCase(CompatTestCase, KeystoneClientTests):
>     def test_tenant_add_and_remove_user(self):
>         client = self.get_client(admin=True)
>         client.roles.add_user_role(tenant=self.tenant_baz['id'],
>-                                   user=self.user_foo['id'],
>+                                   user=self.user_two['id'],
>                                    role=self.role_useless['id'])
>         user_refs = client.tenants.list_users(tenant=self.tenant_baz['id'])
>-        self.assert_(self.user_foo['id'] in [x.id for x in user_refs])
>+        self.assert_(self.user_two['id'] in [x.id for x in user_refs])
>         client.roles.remove_user_role(tenant=self.tenant_baz['id'],
>-                                      user=self.user_foo['id'],
>+                                      user=self.user_two['id'],
>                                       role=self.role_useless['id'])
>         user_refs = client.tenants.list_users(tenant=self.tenant_baz['id'])
>-        self.assert_(self.user_foo['id'] not in [x.id for x in user_refs])
>+        self.assert_(self.user_two['id'] not in [x.id for x in user_refs])
> 
>     def test_user_role_add_404(self):
>         from keystoneclient import exceptions as client_exceptions
>@@ -890,16 +890,16 @@ class KcEssex3TestCase(CompatTestCase, KeystoneClientTests):
>     def test_tenant_add_and_remove_user(self):
>         client = self.get_client(admin=True)
>         client.roles.add_user_to_tenant(tenant_id=self.tenant_baz['id'],
>-                                        user_id=self.user_foo['id'],
>+                                        user_id=self.user_two['id'],
>                                         role_id=self.role_useless['id'])
>         role_refs = client.roles.get_user_role_refs(
>-                user_id=self.user_foo['id'])
>+                user_id=self.user_two['id'])
>         self.assert_(self.tenant_baz['id'] in [x.tenantId for x in role_refs])
> 
>         # get the "role_refs" so we get the proper id, this is how the clients
>         # do it
>         roleref_refs = client.roles.get_user_role_refs(
>-                user_id=self.user_foo['id'])
>+                user_id=self.user_two['id'])
>         for roleref_ref in roleref_refs:
>             if (roleref_ref.roleId == self.role_useless['id']
>                 and roleref_ref.tenantId == self.tenant_baz['id']):
>@@ -907,11 +907,11 @@ class KcEssex3TestCase(CompatTestCase, KeystoneClientTests):
>                 break
> 
>         client.roles.remove_user_from_tenant(tenant_id=self.tenant_baz['id'],
>-                                             user_id=self.user_foo['id'],
>+                                             user_id=self.user_two['id'],
>                                              role_id=roleref_ref.id)
> 
>         role_refs = client.roles.get_user_role_refs(
>-                user_id=self.user_foo['id'])
>+                user_id=self.user_two['id'])
>         self.assert_(self.tenant_baz['id'] not in
>                      [x.tenantId for x in role_refs])
> 
>-- 
>1.7.10.4
>

Actions: View

Attachments on bug 855491: 610928 | 610929