Bug 2027349 - [OSP16.2][keystone] Enough KeystonePasswordRegex complexity can lead to a failed deployment [NEEDINFO]
Summary: [OSP16.2][keystone] Enough KeystonePasswordRegex complexity can lead to a fai...
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: puppet-keystone
Version: 16.2 (Train)
Hardware: x86_64
OS: Linux
unspecified
low
Target Milestone: ---
: ---
Assignee: OSP Team
QA Contact: Jeremy Agee
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-11-29 13:13 UTC by Mauro Oddi
Modified: 2023-08-03 15:46 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-02-24 18:15:23 UTC
Target Upstream Version:
Embargoed:
ifrangs: needinfo? (rhos-maint)


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker OSP-11084 0 None None None 2021-11-29 13:14:40 UTC

Description Mauro Oddi 2021-11-29 13:13:07 UTC
Description of problem:
Secure environments that require passwords with upper, lower, number and special characters for passwords face issues to deploy when this is set in KeystonePasswordRegex. 

Version-Release number of selected component (if applicable):
16.2

How reproducible:
always

Steps to Reproduce:
1. Deploy stack passing:

KeystonePasswordRegex: '^(?=.*?[a-zA-Z])(?=.*?[0-9])(?=.*?[#?!@\\/<>[:;{}`|.,_=~+$%^&*-]).{8,}$'


Actual results:

- Deployment fails at 
2021-11-27 07:38:39.326392 | fa163eee-113c-13d6-a539-0000000082fd |      FATAL | Wait for containers to start for step 3 using paunch | ctl-01 | error={"ansible_job_id": "167488509998.95659", "attempts": 93, "ch

 - Containers are not starting

 - Keystone log shows a CRITICAL issue while running _bootstrap_admin_user()

keystone/keystone.log:2021-11-27 13:36:40.411 61 CRITICAL keystone [req-ac9dceb9-f3d2-447e-a7a9-aef48b870675 - - - - -] Unhandled error: keystone.exception.PasswordRequirementsValidationError: The password does not match the requirements: None.                      

 - Seems like the admin user does not meet the regexp criteria


Expected results:

Deploy should succeed

Additional info:


Note You need to log in before you can comment on or make changes to this bug.