Bug 1289367 - Backport keystone ldap patch from Liberty to Kilo [NEEDINFO]
Backport keystone ldap patch from Liberty to Kilo
Status: CLOSED ERRATA
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-keystone (Show other bugs)
7.0 (Kilo)
Unspecified Unspecified
high Severity medium
: async
: 7.0 (Kilo)
Assigned To: John Dennis
Prasanth Anbalagan
: Triaged, ZStream
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-12-07 18:25 EST by David Hill
Modified: 2017-09-19 11:55 EDT (History)
14 users (show)

See Also:
Fixed In Version: openstack-keystone-2015.1.4-1.el7ost
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-06-14 11:30:42 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
mlopes: needinfo? (jdennis)


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Launchpad 1468000 None None None 2017-02-24 17:04 EST

  None (edit)
Description David Hill 2015-12-07 18:25:32 EST
What problem/issue/behavior are you having trouble with?  What do you expect to see?

When integrating keystone with LDAP, the "openstack user show" command doesn't work when using the username, due to a bug in keystone. 

For example, using the python-openstackclient:
$ openstack user show flastname
Could not find resource flastname

However this user clearly exists:
$ openstack user show verlongldapuuid
+-----------+------------------------------------------------------------------+
| Field     | Value                                                            |
+-----------+------------------------------------------------------------------+
| domain_id | domainidthatisquiteshort                                 |
| email     | flastname@redhat.com                          |
| id        | verlongldapuuid |
| name      | flastname                                                          |
+-----------+------------------------------------------------------------------+

The keystone log shows the following stack. Notice the filterstr passed to LDAP contains a superflous "None" which breaks the query:


2015-12-07 16:59:51.831 14954 DEBUG keystone.common.ldap.core [-] LDAP bind: who=uid=admin.openstack,dc=openstack,dc=apps,dc=redhat simple_bind_s /usr/lib/python2.7/site-packages/keystone/common/ldap/core.py:896
2015-12-07 16:59:52.112 14954 DEBUG keystone.common.ldap.core [-] LDAP search: base=dc=internal,dc=users,dc=redhat scope=1 filterstr=(&(&None(uid=jbibeau))(objectClass=inetOrgPerson)) attrs=['cn', 'userPassword', 'enabled', 'mail', 'uid'] attrsonly=0 search_s /usr/lib/python2.7/site-packages/keystone/common/ldap/core.py:931
2015-12-07 16:59:52.112 14954 DEBUG keystone.common.ldap.core [-] LDAP unbind unbind_s /usr/lib/python2.7/site-packages/keystone/common/ldap/core.py:904
2015-12-07 16:59:52.113 14954 ERROR keystone.common.wsgi [-] {'desc': 'Bad search filter'}
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi Traceback (most recent call last):
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/common/wsgi.py", line 239, in __call__
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     result = method(context, **params)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/common/controller.py", line 206, in wrapper
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     return f(self, context, filters, **kwargs)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/identity/controllers.py", line 223, in list_users
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     hints=hints)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/common/manager.py", line 52, in wrapper
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/identity/core.py", line 342, in wrapper
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/identity/core.py", line 353, in wrapper
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/identity/core.py", line 791, in list_users
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     ref_list = driver.list_users(hints)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/identity/backends/ldap.py", line 82, in list_users
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     return self.user.get_all_filtered(hints)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/identity/backends/ldap.py", line 269, in get_all_filtered
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     return [self.filter_attributes(user) for user in self.get_all(query)]
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 1869, in get_all
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     return super(EnabledEmuMixIn, self).get_all(ldap_filter)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 1505, in get_all
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     for x in self._ldap_get_all(ldap_filter)]
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 1467, in _ldap_get_all
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     attrs)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 944, in search_s
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     attrlist_utf8, attrsonly)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 541, in search_s
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     attrlist, attrsonly)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 552, in search_s
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 545, in search_ext_s
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     msgid = self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientctrls,timeout,sizelimit)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 541, in search_ext
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     timeout,sizelimit,
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi   File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 99, in _ldap_call
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi     result = func(*args,**kwargs)
2015-12-07 16:59:52.113 14954 TRACE keystone.common.wsgi FILTER_ERROR: {'desc': 'Bad search filter'}


This appears to have been fixed in keystone for Liberty - can we get this fix backported to Kilo? It looks really simple (one line change...)

https://review.openstack.org/#/c/184824/

We need a hotfix if possible for this in order to avoid manually patching the code at each deployment.
Comment 17 Rodrigo Duarte 2017-06-13 13:41:14 EDT
verified for openstack-keystone-2015.1.4-1.el7ost.noarch

See the commands below:

[stack@undercloud-0 ~]$ openstack user show ospadmin
+----------+--------------------------------+
| Field    | Value                          |
+----------+--------------------------------+
| email    | ospadmin@qa.lab.tlv.redhat.com |
| enabled  | True                           |
| id       | ospadmin                       |
| name     | ospadmin                       |
| username | ospadmin                       |
+----------+--------------------------------+

[stack@undercloud-0 ~]$ openstack user show ospmember
+----------+---------------------------------+
| Field    | Value                           |
+----------+---------------------------------+
| email    | ospmember@qa.lab.tlv.redhat.com |
| enabled  | True                            |
| id       | ospmember                       |
| name     | ospmember                       |
| username | ospmember                       |
+----------+---------------------------------+
Comment 19 errata-xmlrpc 2017-06-14 11:30:42 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1452

Note You need to log in before you can comment on or make changes to this bug.