OpenStack Identity (keystone)

Keystone should propagate redirect exceptions from auth plugins

Bug #1854041 reported by Alvaro Lopez
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
In Progress
Undecided
Alvaro Lopez

Bug Description

When a developer is implementing an Authentication plugin [1] they can only return None and setup the relevant information in the auth context or raise an Unauthorized exception. However, in some cases (like an OpenID Connect plugin) it is needed to perform a redirect to the provider to complete the flow. IIRC this was possible in the past (before moving to Flask) by raising an exception with the proper HTTP code set, but with the current implementation this is impossible.

[1]: https://docs.openstack.org/keystone/latest/contributor/auth-plugins.html

Revision history for this message
Colleen Murphy (krinkle) wrote :

It would be great to get more information, like the link to the code for your auth plugin so that someone can reproduce it, and specifics on which versions of keystone this used to work for. If this behavior changed when Flask was introduced, that's definitely a regression we should fix.

Changed in keystone:
status: New → Incomplete
Revision history for this message
Alvaro Lopez (aloga) wrote :

Hi Colleen.

Sorry for my silence.

The code for the plugin (work in progress) is here: https://github.com/IFCA/keystone-oidc-auth-plugin/

Revision history for this message
Colleen Murphy (krinkle) wrote :

Alvaro, can you confirm what version of keystone you were using when this worked for you, and what version you're using now that doesn't work?

Revision history for this message
Alvaro Lopez (aloga) wrote :

Hi Collen.

Unfortunately I do not remember the version, but it was before Flask's migration, IIRC. Currently we are testing with the R, S and T releases.

Best.

Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]

Changed in keystone:
status: Incomplete → Expired
Colleen Murphy (krinkle)
Changed in keystone:
status: Expired → Confirmed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.opendev.org/754694

Changed in keystone:
assignee: nobody → Alvaro Lopez (aloga)
status: Confirmed → In Progress
Revision history for this message
Alvaro Lopez (aloga) wrote :

Any chances that this bug (and solution) gets some attention?

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.