ldappool

LDAP support broken if UTF8 characters in DN (python2)

Bug #1862606 reported by Rafal Ramocki
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
In Progress
Undecided
Rafal
ldappool
In Progress
Undecided
Rafal

Bug Description

Bug is probably related with this one:

https://bugs.launchpad.net/keystone/+bug/1798184
https://bugs.launchpad.net/keystone/+bug/1820333

On keystone 14.1.0 (Rocky) it trows exception when there are UTF-8 encoded characters on users's DN. We're using openldap. In our schema DN is cn=first_name last_name,ou=employee,ou=users,dc=(...). In Poland names with local, utf encoded leters are very common.

It looks like bug can be fixed by following change:

--- a/keystone/identity/backends/ldap/common.py
+++ b/keystone/identity/backends/ldap/common.py
@@ -177,7 +177,7 @@ def convert_ldap_result(ldap_result):
                 ldap_attrs[kind] = [val2py(x) for x in values]
             except UnicodeDecodeError:
                 LOG.debug('Unable to decode value for attribute %s', kind)
- py_result.append((dn, ldap_attrs))
+ py_result.append((utf8_decode(dn), ldap_attrs))
     if at_least_one_referral:
         LOG.debug('Referrals were returned and ignored. Enable referral '
                   'chasing in keystone.conf via [ldap] chase_referrals')

Revision history for this message
Rafal Ramocki (rafal-ramocki) wrote :
Download full text (8.0 KiB)

And exception:

2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi Traceback (most recent call last):
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/wsgi.py", line 148, in __call__
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi result = method(req, **params)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/auth/controllers.py", line 102, in authenticate_for_token
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi app_cred_id=app_cred_id, parent_audit_id=token_audit_id)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/manager.py", line 116, in wrapped
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi __ret_val = __f(*args, **kwargs)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/token/provider.py", line 252, in issue_token
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi token.mint(token_id, issued_at)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/models/token_model.py", line 533, in mint
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi self._validate_domain_scope()
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/models/token_model.py", line 478, in _validate_domain_scope
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi if self.domain_scoped and not self.roles:
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/models/token_model.py", line 418, in roles
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi roles = self._get_domain_roles()
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/models/token_model.py", line 373, in _get_domain_roles
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi self.user_id, self.domain_id
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/manager.py", line 116, in wrapped
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi __ret_val = __f(*args, **kwargs)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/dogpile/cache/region.py", line 1220, in decorate
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi should_cache_fn)
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/dogpile/cache/region.py", line 825, in get_or_create
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi async_creator) as value:
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/dogpile/lock.py", line 154, in __enter__
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi return self._enter()
2020-02-10 10:39:49.948 18007 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/dogpile/lock.py", line 94, in _enter
2020-02-10 10:39:4...

Read more...

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.opendev.org/706791

Changed in keystone:
assignee: nobody → Rafal (rafal-ramocki-b)
status: New → In Progress
Revision history for this message
Rafal (rafal-ramocki-b) wrote :

During work on keystone it appeared that bug is only releated when use_pool=True in keystone (default). It seams that #1798184 was partial and may not work for pooled connections.

Rafal (rafal-ramocki-b)
Changed in ldappool:
assignee: nobody → Rafal (rafal-ramocki-b)
Revision history for this message
Rafal (rafal-ramocki-b) wrote :

I've proposed a fix to ldappool. Please review it:

https://review.opendev.org/#/c/708699/

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on keystone (master)

Change abandoned by "Gage Hugo <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/keystone/+/706791
Reason: Abandoning since there hasn't been any recent activity, if anyone wants to continue this work, please feel free to restore this or create a new change.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.