OpenStack Identity (keystone)

Keystone does not accept Ceph STS and IAM auth requests

Bug #1897280 reported by Stuart Grace
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Fix Released
Undecided
Jonathan Rosser

Bug Description

Ceph Object Gateway can use keystone for authenticating user requests to its S3-compatible API, but recent versions also provide two other AWS-compatible APIs for managing user access: Security Token Service (STS) and Identity and Access Management (IAM). These attempt to authenticate requests with Keystone but always receive 403 Access Denied. This is because api/s3tokens.py only accepts "s3" as the service name.

Workaround: https://docs.ceph.com/en/latest/radosgw/STSLite/#limitations-and-workarounds

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.opendev.org/754404

Changed in keystone:
assignee: nobody → Stuart Grace (stuartgrace)
status: New → In Progress
OpenStack Infra (hudson-openstack)
Changed in keystone:
assignee: Stuart Grace (stuartgrace) → Jonathan Rosser (jrosser)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (master)

Reviewed: https://review.opendev.org/c/openstack/keystone/+/754404
Committed: https://opendev.org/openstack/keystone/commit/36d6fc7f8f06b4b4d1af09bd56b3c17fa1a502ca
Submitter: "Zuul (22348)"
Branch: master

commit 36d6fc7f8f06b4b4d1af09bd56b3c17fa1a502ca
Author: Stuart Grace <email address hidden>
Date: Fri Sep 25 15:10:22 2020 +0100

    Accept STS and IAM services from Ceph Obj Gateway

    Ceph Object Gateway can use keystone for authenticating user requests
    to its S3-compatible API, but recent versions also provide two other
    AWS-compatible APIs for managing user access: Security Token Service
    (STS) and Identity and Access Management (IAM). These attempt to
    authenticate requests with Keystone but always receive 403 Access
    Denied because _calculate_signature_v4() in api/s3tokens.py only
    accepts "s3" as the service name. This patch accepts any of "s3" or
    "sts" or "iam" as valid service names.

    Change-Id: I69f16ed55dd9852859307b701a8391ba1e71c042
    Closes-Bug: #1897280

Changed in keystone:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (stable/xena)

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/keystone/+/821512

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (stable/wallaby)

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/keystone/+/821513

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/keystone 21.0.0.0rc1

This issue was fixed in the openstack/keystone 21.0.0.0rc1 release candidate.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on keystone (stable/wallaby)

Change abandoned by "Elod Illes <email address hidden>" on branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/keystone/+/821513
Reason: stable/wallaby branch of openstack/keystone is about to be deleted. To be able to do that, all open patches need to be abandoned. Please cherry pick the patch to unmaintained/wallaby if you want to further work on this patch.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on keystone (stable/xena)

Change abandoned by "Elod Illes <email address hidden>" on branch: stable/xena
Review: https://review.opendev.org/c/openstack/keystone/+/821512
Reason: stable/xena branch of openstack/keystone is about to be deleted. To be able to do that, all open patches need to be abandoned. Please cherry pick the patch to unmaintained/xena if you want to further work on this patch.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.