Pluggable auth provider: Can't write a custom plugin due to hardcoded check

Yes, we do need a check similar to that to manage backwards compatibility between token_format vs [token] provider, but it certainly blocks alternative implementations of either UUID or PKI, as is!

As Dolph mentioned, this check is for ensuring backward compatibility with token_format. 'token_format' is not being used anymore. You can do this hack to get around this check.

1) in keystone.conf, set token_format to something else

[signing]
token_format = WHO_THE_FLIP_CARES

2) set token provider to your provider

[token]
provider = mypackage.MyUUIDProvider

Ofcourse I can do that, but that will break most of the tests, since many tests rely on the format string. (ie). Also in future if you make decisions based on that string, it will break.

Better approach would be ( just a suggestion)

Add a method get_provider_name() and let it return "UUID" for UUID provider and "PKI" for PKI_PROVIDER. Then the code will become

if CONF.signing.token_format != configured_provider.get_provider_name()
  raise exception

I am working on it.

Fix proposed to branch: master
Review: https://review.openstack.org/47938

Reviewed: https://review.openstack.org/47938
Committed: http://github.com/openstack/keystone/commit/dc62539d6f170a8c3901aceb052bb5a69d17812c
Submitter: Jenkins
Branch: master

commit dc62539d6f170a8c3901aceb052bb5a69d17812c
Author: guang-yee <email address hidden>
Date: Mon Sep 23 14:41:12 2013 -0700

    Check token_format for default token providers only.

    Ignore token_format check if the configured token provider is not one of
    Keystone default token providers.

    Fixed bug 1227980

    Change-Id: Id318177f186d1f68b0f3e5cba1bfaa98a4b2db24