Bug 1220651

Summary:	Tuskar service defaults to no auth required
Product:	Red Hat OpenStack	Reporter:	Udi Kalifon <ukalifon>
Component:	openstack-tuskar	Assignee:	Jay Dobies <jason.dobies>
Status:	CLOSED ERRATA	QA Contact:	Udi Kalifon <ukalifon>
Severity:	unspecified	Docs Contact:
Priority:	high
Version:	7.0 (Kilo)	CC:	calfonso, dmacpher, gmollett, jprovazn, kbasil, mandreou, mburns, rhel-osp-director-maint
Target Milestone:	ga	Keywords:	Security, Triaged
Target Release:	Director
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-tuskar-0.4.18-3.el7ost openstack-tripleo-image-elements-0.9.6-3.el7ost	Doc Type:	Bug Fix
Doc Text:	The tuskar service configuration parameter auth_strategy defaulted to "noauth". This allowed unrestricted access to the tuskar management plan and roles, including templates and any set sensitive parameters like passwords. This fix sets the default to keystone authentication. Now non-authenticated http requests to the tuskar service will return a HTTP 401 Unauthorized error. Use the following command to verify from the Undercloud: $ curl -v localhost:8585/v2/plans	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-05 13:51:22 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Udi Kalifon 2015-05-12 05:54:36 UTC

Description of problem:
You can call Tuskar REST API without passing a token in the header. It doesn't require any authentication by default.


Version-Release number of selected component (if applicable):
openstack-tuskar-2013.2-dev1.el7.centos.noarch


How reproducible:
100%


Steps to Reproduce:
1. For example: curl http://localhost:8585/v2/plans/7c796d61-cc8e-4c33-ae78-cb84b92a2a6f | python -m json.tool


Actual results:
Result is returned even though the query contained no authentication of any kind.


Expected results:
You'd expect this API call to be rejected.

Comment 1 Marios Andreou 2015-05-12 06:30:01 UTC

jdob has an upstream fix for this (was just not enabled) @ https://review.openstack.org/#/c/182027/

Comment 5 Mike Burns 2015-06-19 17:51:00 UTC

Garth,  Can you review this?

Comment 8 Jan Provaznik 2015-06-24 10:09:16 UTC

*** Bug 1235193 has been marked as a duplicate of this bug. ***

Comment 9 Mike Burns 2015-06-24 15:03:37 UTC

Marking Modified for now since we pulled these from the latest build.

Comment 11 Udi Kalifon 2015-06-28 10:59:35 UTC

Verified in openstack-tuskar-0.4.18-3.el7ost.noarch

Comment 13 errata-xmlrpc 2015-08-05 13:51:22 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2015:1549