openstack
/
keystone
Code Issues Proposed changes
keystone/keystone/tests/unit
History
Colleen Murphy 7653847a04 Ensure OAuth1 authorized roles are respected 
Without this patch, when an OAuth1 request token is authorized with a
limited set of roles, the roles for the access token are ignored when
the user uses it to request a keystone token. This means that user of an
access token can use it to escallate their role assignments beyond what
was authorized by the creator. This patch fixes the issue by ensuring
the token model accounts for an OAuth1-scoped token and correctly
populating the roles for it.

Modified to work with older test helper function:

  keystone/tests/unit/test_v3_oauth1.py

Conflicts:

  keystone/models/token_model.py

  The keystone token model was refactored in the Rocky release. This
  commit only backports the test so that we have test coverage against
  the bug and proves there wasn't a regression in Queens. As such, the
  code changes to token_model.py (where the bug was introduced) are not
  applicable to Pike.

  releasenotes/notes/bug-1873290-ff7f8e4cee15b75a.yaml

  Removed the release note since there isn't anything to signal to
  operators regarding a vulnerability. We're only adding test coverage
  to prove that stable/queens isn't vulnerable.

Change-Id: I02f9836fbd4d7e629653977fc341476cfd89859e
Closes-bug: #1873290
(cherry picked from commit 6c73690f77)
(cherry picked from commit ba89d27793)
(cherry picked from commit 5ff52dbaa2082991d229d8557a8e4b65256d6c53)
(cherry picked from commit 2483a578a80a916d9f5acd672d85830385b236e2)
(cherry picked from commit 10bc689a67)
(cherry picked from commit d590441ce6)
 		2020-05-14 10:27:19 -07:00
..
assignment Handle group NotFound in effective assignment list 2017-05-26 18:09:03 -04:00
auth Check log output rather than emitting in tests 2017-06-19 13:49:04 -04:00
backend Remove stable driver interfaces 2016-09-28 17:18:37 +00:00
catalog Fix multiple uuid warnings with pycadf 2017-02-08 21:16:43 -06:00
common Removed unnecessary setUp() calls from unit tests 2017-08-01 18:24:03 +02:00
config_files Remove LDAP write support 2017-01-21 21:32:07 -05:00
contrib Adds tests showing how mapping locals are handled 2017-01-26 20:42:12 +00:00
credential Remove unused CONF 2017-04-22 15:22:05 +08:00
endpoint_policy Fixes remaining nits in endpoint_policy tests 2016-11-15 20:03:47 +00:00
external Adds interface tests for timeutils 2015-09-23 12:43:37 +00:00
federation Validate mapping exists when creating/updating a protocol 2016-10-20 19:12:04 +00:00
identity Handle ldap size limit exeeded exception 2017-10-25 02:06:08 +00:00
ksfixtures Remove unused CONF 2017-04-22 15:22:05 +08:00
policy Create unit tests for the policy drivers 2016-08-09 11:59:20 -03:00
resource Add a hacking rule for string interpolation at logging 2017-07-18 14:11:28 +08:00
saml2 Add openstack_user_domain to assertion 2015-05-04 14:33:48 -03:00
schema Rename v2 token schema used for validation 2016-03-10 21:41:22 +00:00
tests Adds a skip method to identify useless skips 2016-06-29 19:48:12 +00:00
token Remove keystone.conf if not used 2017-06-05 16:03:05 +08:00
trust Use more specific asserts in tests 2016-08-04 12:48:08 +02:00
__init__.py enable ldap tests for py3 2016-05-18 12:07:23 -04:00
core.py Remove assertRaisesRegexp testing function 2017-06-02 12:40:48 -05:00
default_catalog.templates Move existing tests to unit 2015-02-13 15:54:29 -06:00
default_fixtures.py Fix MFA rule checks for LDAP auth 2017-02-24 00:55:32 -05:00
fakeldap.py Add a hacking rule for string interpolation at logging 2017-07-18 14:11:28 +08:00
federation_fixtures.py Move existing tests to unit 2015-02-13 15:54:29 -06:00
filtering.py Remove LDAP delete logic and associated tests 2017-05-12 18:57:31 +00:00
identity_mapping.py Use the new enginefacade from oslo.db 2016-02-24 08:20:12 -08:00
mapping_fixtures.py Update test case for federation 2017-05-19 10:54:15 +08:00
rest.py Fix multiple uuid warnings with pycadf 2017-02-08 21:16:43 -06:00
test_associate_project_endpoint_extension.py Ensure the endpoint filter API supports HEAD 2017-06-13 14:03:14 +00:00
test_auth.py Removed unnecessary setUp() calls from unit tests 2017-08-01 18:24:03 +02:00
test_auth_plugin.py Cleanup TODO, AuthContext and AuthInfo to auth.core 2017-01-31 16:52:41 +00:00
test_backend_endpoint_policy.py Use new_policy_ref consistently 2015-12-09 10:18:36 -08:00
test_backend_endpoint_policy_sql.py Fixes the SQL model tests 2015-03-08 05:34:48 +00:00
test_backend_federation_sql.py Require domain_id when registering Identity Providers 2017-01-06 16:05:12 +00:00
test_backend_id_mapping_sql.py Do not call `to_dict` outside of a session context 2017-01-25 06:12:20 +00:00
test_backend_ldap.py LDAP attribute names non-case-sensitive 2018-10-02 14:14:38 +00:00
test_backend_ldap_pool.py Code-Defined Resource-specific Options 2017-01-25 16:15:44 -08:00
test_backend_rules.py Split policy backend tests 2016-03-04 15:32:42 -03:00
test_backend_sql.py Add int storage of datetime for password created/expires 2017-08-15 18:34:20 +00:00
test_backend_templated.py Replace tenant with project for keystone catalog 2016-10-16 11:20:12 +08:00
test_catalog.py Fix multiple uuid warnings with pycadf 2017-02-08 21:16:43 -06:00
test_cli.py Merge "Stop using oslotest.mockpatch" 2017-05-04 02:55:21 +00:00
test_config.py Using assertIsNone() instead of assertIs(None) 2016-09-26 15:33:18 +07:00
test_contrib_ec2_core.py Fix ec2tokens validation in v2 after regression in metadata_ref removal 2017-07-28 16:20:53 +02:00
test_contrib_s3_core.py Fix the s3tokens endpoint 2017-02-22 16:16:06 +00:00
test_contrib_simple_cert.py Ensure HEAD is supported with simple cert 2017-06-13 16:03:38 +00:00
test_credential.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_driver_hints.py Use assertTrue/False instead of assertEqual(T/F) 2015-11-02 09:10:38 +00:00
test_entry_points.py remove deprecated items from contrib 2016-09-27 11:55:41 +03:00
test_exception.py Remove log translations in keystone 2017-03-25 18:17:15 +00:00
test_hacking_checks.py Remove duplicated hacking rule 2017-06-28 07:48:03 +00:00
test_ldap_livetest.py Remove releated role_tree_dn test 2017-01-21 23:16:38 +08:00
test_ldap_pool_livetest.py replace assertTrue with assertIs. 2016-12-16 08:15:51 +00:00
test_ldap_tls_livetest.py Replace keystone.common.config with keystone.conf package 2016-06-24 17:02:15 +00:00
test_middleware.py Remove assertRaisesRegexp testing function 2017-06-02 12:40:48 -05:00
test_no_admin_token_auth.py Deprecate keystone.common.kvs 2016-05-12 23:30:15 -07:00
test_policy.py Expose a get_enforcer method for oslo.policy scripts 2018-01-16 17:49:07 +00:00
test_revoke.py Remove unused code in test_revoke 2017-04-06 14:57:30 +00:00
test_shadow_users.py Refactor shadow users tests 2017-01-25 16:11:01 +00:00
test_sql_banned_operations.py Rename protocol cascade delete migration file 2017-02-17 14:04:59 +00:00
test_sql_upgrade.py Add int storage of datetime for password created/expires 2017-08-15 18:34:20 +00:00
test_token_bind.py Change tests to use common name for keystone.tests.unit 2015-09-04 18:21:42 +00:00
test_token_provider.py Remove loading drivers outside of their expected namespaces 2017-05-18 18:08:26 +00:00
test_url_middleware.py Fix D401 PEP8 violation. 2016-04-14 20:08:52 +00:00
test_v2.py Fix-test-of-assertValidRole 2017-04-19 11:13:46 +08:00
test_v2_controller.py Use request.params instead of context['query_string'] 2016-06-29 04:46:57 +10:00
test_v2_validation.py Fix v2 role create schema validation 2017-02-23 23:38:32 -06:00
test_v3.py Remove orphaned AuthTestMixin from test_v3 2017-03-28 21:18:01 +00:00
test_v3_assignment.py Implement HEAD for assignment API 2017-06-26 15:16:51 +00:00
test_v3_auth.py Reduce duplication in federated auth APIs 2018-07-25 15:40:33 +00:00
test_v3_catalog.py Fix multiple uuid warnings with pycadf 2017-02-08 21:16:43 -06:00
test_v3_credential.py Removed unnecessary setUp() calls from unit tests 2017-08-01 18:24:03 +02:00
test_v3_domain_config.py Add HEAD API to domain config 2017-06-12 20:50:49 +00:00
test_v3_endpoint_policy.py Ensure the endpoint policy API supports HEAD 2017-06-20 19:44:43 +00:00
test_v3_federation.py Mapped Groups don't exist breaks WebSSO 2018-09-24 14:50:31 -03:00
test_v3_filters.py Add password expiration queries for PCI-DSS 2017-01-24 09:01:12 -06:00
test_v3_identity.py Removed unnecessary setUp() calls from unit tests 2017-08-01 18:24:03 +02:00
test_v3_oauth1.py Ensure OAuth1 authorized roles are respected 2020-05-14 10:27:19 -07:00
test_v3_os_revoke.py Use https for docs.openstack.org references 2017-01-30 16:05:08 -08:00
test_v3_policy.py Implement HEAD method for all v3 GET actions 2016-03-22 10:27:53 -07:00
test_v3_protection.py listing revoke events should be admin only 2017-01-09 21:12:47 +00:00
test_v3_resource.py Remove CONF.domain_id_immutable 2017-01-03 22:51:15 +00:00
test_v3_trust.py Merge "Ensure the trust API supports HEAD requests" 2017-06-23 05:23:13 +00:00
test_validation.py Fix json schema nullable to add None to ENUM 2018-04-19 13:25:02 +00:00
test_versions.py Remove unused CONF 2017-04-22 15:22:05 +08:00
test_wsgi.py Small fixes for WebOb 1.7 compatibiltity 2017-03-24 20:12:01 +00:00
utils.py Add new functionality to @wip 2016-05-22 16:06:50 +00:00