Bug 1220651 - Tuskar service defaults to no auth required
Summary: Tuskar service defaults to no auth required
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tuskar
Version: 7.0 (Kilo)
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: ga
: Director
Assignee: Jay Dobies
QA Contact: Udi
URL:
Whiteboard:
: 1235193 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-05-12 05:54 UTC by Udi
Modified: 2015-08-05 13:51 UTC (History)
9 users (show)

Fixed In Version: openstack-tuskar-0.4.18-3.el7ost openstack-tripleo-image-elements-0.9.6-3.el7ost
Doc Type: Bug Fix
Doc Text:
The tuskar service configuration parameter auth_strategy defaulted to "noauth". This allowed unrestricted access to the tuskar management plan and roles, including templates and any set sensitive parameters like passwords. This fix sets the default to keystone authentication. Now non-authenticated http requests to the tuskar service will return a HTTP 401 Unauthorized error. Use the following command to verify from the Undercloud: $ curl -v localhost:8585/v2/plans
Clone Of:
Environment:
Last Closed: 2015-08-05 13:51:22 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2015:1549 normal SHIPPED_LIVE Red Hat Enterprise Linux OpenStack Platform director Release 2015-08-05 17:49:10 UTC

Description Udi 2015-05-12 05:54:36 UTC
Description of problem:
You can call Tuskar REST API without passing a token in the header. It doesn't require any authentication by default.


Version-Release number of selected component (if applicable):
openstack-tuskar-2013.2-dev1.el7.centos.noarch


How reproducible:
100%


Steps to Reproduce:
1. For example: curl http://localhost:8585/v2/plans/7c796d61-cc8e-4c33-ae78-cb84b92a2a6f | python -m json.tool


Actual results:
Result is returned even though the query contained no authentication of any kind.


Expected results:
You'd expect this API call to be rejected.

Comment 1 Marios Andreou 2015-05-12 06:30:01 UTC
jdob has an upstream fix for this (was just not enabled) @ https://review.openstack.org/#/c/182027/

Comment 5 Mike Burns 2015-06-19 17:51:00 UTC
Garth,  Can you review this?

Comment 8 Jan Provaznik 2015-06-24 10:09:16 UTC
*** Bug 1235193 has been marked as a duplicate of this bug. ***

Comment 9 Mike Burns 2015-06-24 15:03:37 UTC
Marking Modified for now since we pulled these from the latest build.

Comment 11 Udi 2015-06-28 10:59:35 UTC
Verified in openstack-tuskar-0.4.18-3.el7ost.noarch

Comment 13 errata-xmlrpc 2015-08-05 13:51:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2015:1549


Note You need to log in before you can comment on or make changes to this bug.