Bug #64094: keystone admin token is not invalidated on http 401 response - rgw - Ceph

Actions

Copy link

Bug #64094

open

keystone admin token is not invalidated on http 401 response

Added by Tobias Urdin 3 months ago. Updated 2 months ago.

Status:

Pending Backport

Priority:

Normal

Assignee:

Tobias Urdin

Target version:

% Done:

Source:

Tags:

keystone backport_processed

Backport:

quincy reef squid

Regression:

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

Pull request ID:

55236

Crash signature (v1):

Crash signature (v2):

Description

when a client uses the Swift API and send us a keystone token we need to validate it, if it's not in our cache we
get a admin token that we can use to validet the client token with by doing a API call to keystone

if keystone responds with a http 401 it means our admin token is invalid but we never invalidate it so
we can end up in a state where all client requests is rejected due to an invalid admin token.

this can happen when for example changing the password on the keystone user, any token already issued would
go invalid but rgw would still try to use it since it's cached and not expired yet.

Related issues 3 (2 open — 1 closed)

Actions

Copy link

Updated by Tobias Urdin 3 months ago

simple keystone reproduce

#!/bin/bash

# issue admin token that radosgw would use and save it
echo "issue admin token" 
source ~/radosgwrc
admin_token=$(openstack token issue -c id -f value)

# then issue a token for a client
echo "issue customer token" 
source ~/customerrc
customer_token=$(openstack token issue -c id -f value)

# now emulate what radosgw would call to keystone to validate a customer token with it own admin token for auth
echo "test that it works" 
curl -H "X-Auth-Token: $admin_token" -H "X-Subject-Token: $customer_token" http://localhost:5000/v3/auth/tokens
echo

# now lets force a password change on the radosgw user and see if the admin token gets invalidated
# the password "secret" that we change to here here is the same as the current password
echo "change password for radosgw user" 
source ~/openrc
openstack user set --password secret radosgw

# now test again and admin token is invalid and we get status code 401
echo "test and it will fail with 401" 
curl -H "X-Auth-Token: $admin_token" -H "X-Subject-Token: $customer_token" http://localhost:5000/v3/auth/tokens
echo

Actions

Copy link