OpenStack Identity (keystone)

User tokens logged by keystoneclient.middleware.auth_token

Bug #1185905 reported by Matthew Farrellee
This bug report is a duplicate of:  Bug #1004114: Password logging. Edit Remove
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Triaged
Low
Unassigned

Bug Description

At level DEBUG, keystoneclient.middleware.auth_token will log user tokens, both when storing to and retrieving from memcache.

I would expect that credentials are not logged at any level.

Tags: security
Revision history for this message
Matthew Farrellee (mattf) wrote :

Reproduced with,

$ rpm -qa | grep keystone
python-keystone-2013.1-1.el6.noarch
openstack-keystone-2013.1-1.el6.noarch
python-keystoneclient-0.2.3-2.el6.noarch

Revision history for this message
Dolph Mathews (dolph) wrote :

Suggest marking this as public security.

Changed in keystone:
importance: Undecided → Low
status: New → Triaged
Revision history for this message
Jeremy Stanley (fungi) wrote :

I think this is one of the facets of the debug-level credential logging which is being solved several ways in different places? Marking as a duplicate of bug 1004114 but readjust if this is separate.

information type: Private Security → Public
tags: added: security
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.