Bug 1220651 - Tuskar service defaults to no auth required
Summary: Tuskar service defaults to no auth required
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tuskar
Version: 7.0 (Kilo)
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: ga
: Director
Assignee: Jay Dobies
QA Contact: Udi Kalifon
URL:
Whiteboard:
: 1235193 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-05-12 05:54 UTC by Udi Kalifon
Modified: 2023-02-22 23:02 UTC (History)
8 users (show)

Fixed In Version: openstack-tuskar-0.4.18-3.el7ost openstack-tripleo-image-elements-0.9.6-3.el7ost
Doc Type: Bug Fix
Doc Text:
The tuskar service configuration parameter auth_strategy defaulted to "noauth". This allowed unrestricted access to the tuskar management plan and roles, including templates and any set sensitive parameters like passwords. This fix sets the default to keystone authentication. Now non-authenticated http requests to the tuskar service will return a HTTP 401 Unauthorized error. Use the following command to verify from the Undercloud: $ curl -v localhost:8585/v2/plans
Clone Of:
Environment:
Last Closed: 2015-08-05 13:51:22 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2015:1549 0 normal SHIPPED_LIVE Red Hat Enterprise Linux OpenStack Platform director Release 2015-08-05 17:49:10 UTC

Description Udi Kalifon 2015-05-12 05:54:36 UTC 
Description of problem:
You can call Tuskar REST API without passing a token in the header. It doesn't require any authentication by default.


Version-Release number of selected component (if applicable):
openstack-tuskar-2013.2-dev1.el7.centos.noarch


How reproducible:
100%


Steps to Reproduce:
1. For example: curl http://localhost:8585/v2/plans/7c796d61-cc8e-4c33-ae78-cb84b92a2a6f | python -m json.tool


Actual results:
Result is returned even though the query contained no authentication of any kind.


Expected results:
You'd expect this API call to be rejected.
Comment 1 Marios Andreou 2015-05-12 06:30:01 UTC 
jdob has an upstream fix for this (was just not enabled) @ https://review.openstack.org/#/c/182027/
Comment 5 Mike Burns 2015-06-19 17:51:00 UTC 
Garth,  Can you review this?
Comment 8 Jan Provaznik 2015-06-24 10:09:16 UTC 
*** Bug 1235193 has been marked as a duplicate of this bug. ***
Comment 9 Mike Burns 2015-06-24 15:03:37 UTC 
Marking Modified for now since we pulled these from the latest build.
Comment 11 Udi Kalifon 2015-06-28 10:59:35 UTC 
Verified in openstack-tuskar-0.4.18-3.el7ost.noarch
Comment 13 errata-xmlrpc 2015-08-05 13:51:22 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2015:1549
Note You need to log in before you can comment on or make changes to this bug.