Bug 1335991 - Keystone fails to issue tokens when fernet tokens are enabled, as a result of key repo validation
Summary: Keystone fails to issue tokens when fernet tokens are enabled, as a result of...
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-keystone
Version: 8.0 (Liberty)
Hardware: All
OS: Linux
Target Milestone: beta
: 10.0 (Newton)
Assignee: Adam Young
QA Contact: Rodrigo Duarte
Depends On:
TreeView+ depends on / blocked
Reported: 2016-05-13 18:27 UTC by Ken Savich
Modified: 2016-12-14 15:33 UTC (History)
5 users (show)

Fixed In Version: openstack-keystone-10.0.0-0.20160823153130.a445165.el7ost
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2016-12-14 15:33:35 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2016:2948 0 normal SHIPPED_LIVE Red Hat OpenStack Platform 10 enhancement update 2016-12-14 19:55:27 UTC

Description Ken Savich 2016-05-13 18:27:42 UTC
Description of problem:
Enabling fernet tokens will cause Keystone to fail to issue tokens and break an OSP deployment.

Version-Release number of selected component (if applicable):


How reproducible:

Steps to Reproduce:

From a controller node:
1. create keys for ferent: `sudo keystone-manage fernet_setup --keysteon-user keystone --keystone-group keystone`
2. enable fernet: `sudo crudini --set /etc/keystone/keystone.conf token provider fernet
3.restart keystone: `sudo systemctl restart openstack-keystone`

Actual results:

Keystone will fail and log entries will complain about access to the ferent-keys directory 

Expected results:

Keystone should issue fernet tokens after configured and restarted.

Additional info:

This bug is because of validation check in keystone, stable/liberty, which checks for r/w access to the fernet keys in /etc/keystone/fernet-keys. SELinux will not allow the keystone user write access when that validation is run, and thus breaks Keystone. Note: the keystone only needs read access to those keys to allow Keystone to issue proper tokens. 

This was fixed in Mitaka, and has now been back-ported to Liberty.

Comment 2 Nathan Kinder 2016-05-20 17:44:53 UTC
Fernet is not supported in OSP8.  It is expected to be supported (and the default token provider) in OSP10.

Comment 3 Rodrigo Duarte 2016-06-23 19:06:35 UTC
Removed external bug tracker since it was pointing to a "inkscape" bug.

Comment 5 Rodrigo Duarte 2016-10-07 17:20:30 UTC
verified for openstack-keystone-10.0.0-0.20160928144040.6520523.el7ost.noarch (single controller setup - no HA)

[root@controller-0 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@controller-0 ~]# vi /etc/keystone/keystone.conf # set [token] provider to fernet
[root@controller-0 ~]# systemctl restart httpd

in the undercloud:

[stack@undercloud-0 ~]$ source overcloudrc 
[stack@undercloud-0 ~]$ openstack token issue
| Field      | Value                                                                                                                                                                                   |
| expires    | 2016-10-07 18:18:37+00:00                                                                                                                                                               |
| id         | gAAAAABX99jtDum2H2oRccqN855TZFBnHgQqCiwO9eSrBqEKWw-X6839IZBmN14lJv6Ii1JD0dQ5eszfFIJynnVSegetyIkzdAMjaatiMcea697JPUMklSekhRAOqEMrwmi0dclW6E7Pyk9dttqgATwg3jN9fM65VnQP6DQY2vZWUVUraZ4yC_o |
| project_id | 1301b4f18bef494d971a416bf52de1b5                                                                                                                                                        |
| user_id    | e4bb01b557054eeca41ee0aec32db730                                                                                                                                                        |

Comment 8 errata-xmlrpc 2016-12-14 15:33:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.