Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1220651 - Tuskar service defaults to no auth required
Tuskar service defaults to no auth required
Status: CLOSED ERRATA
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tuskar (Show other bugs)
7.0 (Kilo)
Unspecified Unspecified
high Severity unspecified
: ga
: Director
Assigned To: Jay Dobies
Udi
: Security, Triaged
: 1235193 (view as bug list)
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2015-05-12 01:54 EDT by Udi
Modified: 2015-08-05 09:51 EDT (History)
9 users (show)

See Also:
Fixed In Version: openstack-tuskar-0.4.18-3.el7ost openstack-tripleo-image-elements-0.9.6-3.el7ost
Doc Type: Bug Fix
Doc Text:
The tuskar service configuration parameter auth_strategy defaulted to "noauth". This allowed unrestricted access to the tuskar management plan and roles, including templates and any set sensitive parameters like passwords. This fix sets the default to keystone authentication. Now non-authenticated http requests to the tuskar service will return a HTTP 401 Unauthorized error. Use the following command to verify from the Undercloud: $ curl -v localhost:8585/v2/plans
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-08-05 09:51:22 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2015:1549 normal SHIPPED_LIVE Red Hat Enterprise Linux OpenStack Platform director Release 2015-08-05 13:49:10 EDT

  None (edit)
Description Udi 2015-05-12 01:54:36 EDT 
Description of problem:
You can call Tuskar REST API without passing a token in the header. It doesn't require any authentication by default.


Version-Release number of selected component (if applicable):
openstack-tuskar-2013.2-dev1.el7.centos.noarch


How reproducible:
100%


Steps to Reproduce:
1. For example: curl http://localhost:8585/v2/plans/7c796d61-cc8e-4c33-ae78-cb84b92a2a6f | python -m json.tool


Actual results:
Result is returned even though the query contained no authentication of any kind.


Expected results:
You'd expect this API call to be rejected.
Comment 1 Marios Andreou 2015-05-12 02:30:01 EDT 
jdob has an upstream fix for this (was just not enabled) @ https://review.openstack.org/#/c/182027/
Comment 5 Mike Burns 2015-06-19 13:51:00 EDT 
Garth,  Can you review this?
Comment 8 Jan Provaznik 2015-06-24 06:09:16 EDT 
*** Bug 1235193 has been marked as a duplicate of this bug. ***
Comment 9 Mike Burns 2015-06-24 11:03:37 EDT 
Marking Modified for now since we pulled these from the latest build.
Comment 11 Udi 2015-06-28 06:59:35 EDT 
Verified in openstack-tuskar-0.4.18-3.el7ost.noarch
Comment 13 errata-xmlrpc 2015-08-05 09:51:22 EDT 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2015:1549
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.