Attachment 618258 Details for Bug 861180 – CVE-2012-4457-keystone-988920.patch

[patch] CVE-2012-4457-keystone-988920.patch

CVE-2012-4457-keystone-988920.patch (text/plain), 3.71 KB, created by Kurt Seifried on 2012-09-27 19:21:35 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2012-09-27 19:21:35 UTC

Size: 3.71 KB

patch

obsolete

>commit 5373601bbdda10f879c08af1698852142b75f8d5
>Author: Dolph Mathews <dolph.mathews@gmail.com>
>Date:   Mon Jul 16 16:08:32 2012 -0500
>
>    Raise unauthorized if tenant disabled (bug 988920)
>    
>    If the client attempts to explicitly authenticate against a disabled
>    tenant, keystone should return HTTP 401 Unauthorized.
>    
>    Change-Id: I49fe56b6ef8d9f2fc6b9357472dae8964bb9cb9c
>
>diff --git a/keystone/service.py b/keystone/service.py
>index ebdea50..830849e 100644
>--- a/keystone/service.py
>+++ b/keystone/service.py
>@@ -280,6 +280,11 @@ class TokenController(wsgi.Application):
>                 if not user_ref.get('enabled', True):
>                     LOG.warning('User %s is disabled' % user_id)
>                     raise exception.Unauthorized()
>+
>+                # If the tenant is disabled don't allow them to authenticate
>+                if tenant_ref and not tenant_ref.get('enabled', True):
>+                    LOG.warning('Tenant %s is disabled' % tenant_id)
>+                    raise exception.Unauthorized()
>             except AssertionError as e:
>                 raise exception.Unauthorized(e.message)
> 
>@@ -333,6 +338,12 @@ class TokenController(wsgi.Application):
> 
>             tenant_ref = self.identity_api.get_tenant(context=context,
>                                                       tenant_id=tenant_id)
>+
>+            # If the tenant is disabled don't allow them to authenticate
>+            if tenant_ref and not tenant_ref.get('enabled', True):
>+                LOG.warning('Tenant %s is disabled' % tenant_id)
>+                raise exception.Unauthorized()
>+
>             if tenant_ref:
>                 metadata_ref = self.identity_api.get_metadata(
>                         context=context,
>diff --git a/tests/test_keystoneclient.py b/tests/test_keystoneclient.py
>index 5705024..0f6f628 100644
>--- a/tests/test_keystoneclient.py
>+++ b/tests/test_keystoneclient.py
>@@ -176,6 +176,53 @@ class KeystoneClientTests(object):
>                           self.get_client,
>                           user_ref)
> 
>+    def test_authenticate_disabled_tenant(self):
>+        from keystoneclient import exceptions as client_exceptions
>+
>+        admin_client = self.get_client(admin=True)
>+
>+        tenant = {
>+            'name': uuid.uuid4().hex,
>+            'description': uuid.uuid4().hex,
>+            'enabled': False,
>+        }
>+        tenant_ref = admin_client.tenants.create(
>+            tenant_name=tenant['name'],
>+            description=tenant['description'],
>+            enabled=tenant['enabled'])
>+        tenant['id'] = tenant_ref.id
>+
>+        user = {
>+            'name': uuid.uuid4().hex,
>+            'password': uuid.uuid4().hex,
>+            'email': uuid.uuid4().hex,
>+            'tenant_id': tenant['id'],
>+        }
>+        user_ref = admin_client.users.create(
>+            name=user['name'],
>+            password=user['password'],
>+            email=user['email'],
>+            tenant_id=user['tenant_id'])
>+        user['id'] = user_ref.id
>+
>+        # password authentication
>+        self.assertRaises(
>+            client_exceptions.Unauthorized,
>+            self._client,
>+            username=user['name'],
>+            password=user['password'],
>+            tenant_id=tenant['id'])
>+
>+        # token authentication
>+        client = self._client(
>+            username=user['name'],
>+            password=user['password'])
>+        self.assertRaises(
>+            client_exceptions.Unauthorized,
>+            self._client,
>+            token=client.auth_token,
>+            tenant_id=tenant['id'])
>+
>     # FIXME(ja): this test should require the "keystone:admin" roled
>     #            (probably the role set via --keystone_admin_role flag)
>     # FIXME(ja): add a test that admin endpoint is only sent to admin user

Actions: View | Diff

Attachments on bug 861180: 618258