Bug 1624335

Summary: In Horizon, SSL related options are not configured properly
Product: Red Hat OpenStack Reporter: Keigo Noha <knoha>
Component: openstack-tripleo-heat-templatesAssignee: Radomir Dopieralski <rdopiera>
Status: CLOSED ERRATA QA Contact: Udi Kalifon <ukalifon>
Severity: medium Docs Contact:
Priority: medium    
Version: 13.0 (Queens)CC: hrybacki, jrist, mburns, rdopiera
Target Milestone: z5Keywords: Triaged, ZStream
Target Release: 13.0 (Queens)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-tripleo-heat-templates-8.0.7-32.el7ost.src.rpm Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-03-14 13:54:51 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Keigo Noha 2018-08-31 08:58:11 UTC
Description of problem:
In Horizon, SSL related options are not configure properly

After deployment, some parameters in horizon required for SSL deployment are
not configured properly.

/var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard/local_settings
------
# If Horizon is being served through SSL, then uncomment the following two
# settings to better secure the cookies from security exploits

#CSRF_COOKIE_SECURE = True
#SESSION_COOKIE_SECURE = True
-----

HorizonSecureCookies is set as True in my template file, and I expect that 
these parameters should be configured, but something is wrong.

-----
$ grep HorizonSecureCookies -B 1 templates/enable-tls.yaml
parameter_defaults:
  HorizonSecureCookies: True
------

If the configuration is set by ExtraConfig, it works well
~~~
  ControllerExtraConfig:
    horizon::secure_cookies: True

~~~

Version-Release number of selected component (if applicable):
current openstack-tripleo-heat-templates.

How reproducible:
Everytime

Steps to Reproduce:
1. Add the configuration to the environment file.
~~~
parameter_defaults:
  HorizonSecureCookies: True
~~~
2. Deploy Overcloud.
3. Check local_settings of horizon in Controller nodes.

Actual results:
Expected values are not set to the parameters by 'HorizonSecureCookies: True'

Expected results:
Required parameters are configured.

Additional info:

In puppet/services/horizon.yaml, the parameter is passed to 'horizon::secure_cookies:'.

~~~
    129           horizon::secure_cookies: {get_param: [HorizonSecureCookies]}
~~~

But the way to pass it looks strange. The parameter, HorizonSecureCookies is defined as boolean.
However, it is passed as a list to secure_cookies in the line.
Following modification might resolve the issue.

~~~
    129           horizon::secure_cookies: {get_param: HorizonSecureCookies}
~~~

Comment 1 Radomir Dopieralski 2018-10-18 11:45:00 UTC
I think that the reason for this setting having no effect is that it is being overriden here: https://github.com/openstack/tripleo-heat-templates/blob/master/docker/services/horizon.yaml#L70

Looking at the history, it has been always there, since the file was created.

Comment 2 Keigo Noha 2018-10-23 06:59:15 UTC
Hello Radomir,

Do we have a launchpad or gerrit in upstream for this issue?

Comment 3 Radomir Dopieralski 2018-11-05 12:26:42 UTC
I don't have we do. I will create one: https://storyboard.openstack.org/#!/story/2004254

Comment 4 Keigo Noha 2018-11-20 08:13:21 UTC
Hello Radomir,

Could you ask upstream to look at the story board to move it forward?

Best Regards,
Keigo Noha

Comment 5 Radomir Dopieralski 2018-11-20 12:26:49 UTC
I will ask at today's tripleo meeting.

Comment 6 Radomir Dopieralski 2018-11-21 14:25:48 UTC
We are not sure why this was introduced in the first place, probably to work around some transient problems we had initially at the time. I'm going to remove it and test if everything still works, and then backport it.

Comment 7 Keigo Noha 2018-11-28 00:33:39 UTC
Hello Radomir,

Thank you for your work on this bugzilla.
In the upstream gerrit, the gerrit is bloced by 'Blocked on Workflow Label' status.
Do you need a launchpad for this issue? or could you proceed the gerrit if you can?

Best Regards,
Keigo Noha

Comment 9 Radomir Dopieralski 2018-12-04 10:32:53 UTC
It looks like removing that line makes Horizon stop working in the containerized environment — the CSRF token cookie is no longer created and that makes it impossible to log in. I suspect this is some problem with haproxy configuration, I will investigate this further.

Comment 36 errata-xmlrpc 2019-03-14 13:54:51 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0448