Ceph » rgw

simple keystone reproduce

#!/bin/bash

# issue admin token that radosgw would use and save it
echo "issue admin token" 
source ~/radosgwrc
admin_token=$(openstack token issue -c id -f value)

# then issue a token for a client
echo "issue customer token" 
source ~/customerrc
customer_token=$(openstack token issue -c id -f value)

# now emulate what radosgw would call to keystone to validate a customer token with it own admin token for auth
echo "test that it works" 
curl -H "X-Auth-Token: $admin_token" -H "X-Subject-Token: $customer_token" http://localhost:5000/v3/auth/tokens
echo

# now lets force a password change on the radosgw user and see if the admin token gets invalidated
# the password "secret" that we change to here here is the same as the current password
echo "change password for radosgw user" 
source ~/openrc
openstack user set --password secret radosgw

# now test again and admin token is invalid and we get status code 401
echo "test and it will fail with 401" 
curl -H "X-Auth-Token: $admin_token" -H "X-Subject-Token: $customer_token" http://localhost:5000/v3/auth/tokens
echo

proposed pull request https://github.com/ceph/ceph/pull/55236