tsv
d15f8db597
All Barbican resources have a project-id in their URI. This helps to correlate the resource with the specified project when no external authentication mechanism is used. However, most Barbican deployments would use Keystone to authenticate the API requests. With Keystone, the project-id information is already obtained when the X-Auth-Token header from the request is validated. This makes the project-id in the URI redundant. This commit removes project-id from the URI. Tests have been updated as well to not expect project-id in the URI. Patch 3: removed unauthenticated-context from admin pipeline to fix tempest failure. version api doesn't need auth context now Patch 4: refactored based on review comments removed the Noop policy enforcer class Patch 5: rebased and fixed failing tests fixed issue in parsing performance_uri Patch 6: updated functional tests to remove project-id from uri removed rbac check for versions controller expecting X-Project-ID to be present in request for all requests this needs to be fixed in the next pass when the admin paste pipeline is updated Patch 7: fixed failing functional test refactoring based on review comments Patch 8: rebased and fixed failing unit tests Patch 9: fixed merge issue by removing keystone_id from few more lines and files Patch 10: fixed failing functional tests (consumers) Spec: https://review.openstack.org/#/c/100386 Client CR: https://review.openstack.org/#/c/112149 Change-Id: If54911718188eb26b7380331d0b61d70206522a5 Blueprint: https://blueprints.launchpad.net/barbican/+spec/api-remove-uri-tenant-id
62 lines
1.8 KiB
INI
62 lines
1.8 KiB
INI
[composite:main]
|
|
use = egg:Paste#urlmap
|
|
/: barbican_version
|
|
/v1: barbican_api
|
|
|
|
# Use this pipeline for Barbican API - versions no authentication
|
|
[pipeline:barbican_version]
|
|
pipeline = versionapp
|
|
|
|
# Use this pipeline for Barbican API - DEFAULT no authentication
|
|
[pipeline:barbican_api]
|
|
pipeline = unauthenticated-context apiapp
|
|
####pipeline = simple apiapp
|
|
#pipeline = keystone_authtoken context apiapp
|
|
|
|
#Use this pipeline to activate a repoze.profile middleware and HTTP port,
|
|
# to provide profiling information for the REST API processing.
|
|
[pipeline:barbican-profile]
|
|
pipeline = unauthenticated-context egg:Paste#cgitb egg:Paste#httpexceptions profile apiapp
|
|
|
|
#Use this pipeline for keystone auth
|
|
[pipeline:barbican-api-keystone]
|
|
pipeline = keystone_authtoken context apiapp
|
|
|
|
[app:apiapp]
|
|
paste.app_factory = barbican.api.app:create_main_app
|
|
|
|
[app:versionapp]
|
|
paste.app_factory = barbican.api.app:create_version_app
|
|
|
|
[filter:simple]
|
|
paste.filter_factory = barbican.api.middleware.simple:SimpleFilter.factory
|
|
|
|
[filter:unauthenticated-context]
|
|
paste.filter_factory = barbican.api.middleware.context:UnauthenticatedContextMiddleware.factory
|
|
|
|
[filter:context]
|
|
paste.filter_factory = barbican.api.middleware.context:ContextMiddleware.factory
|
|
|
|
[filter:keystone_authtoken]
|
|
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
|
|
signing_dir = /tmp/barbican/cache
|
|
auth_host = localhost
|
|
#need ability to re-auth a token, thus admin url
|
|
auth_port = 35357
|
|
auth_protocol = http
|
|
admin_tenant_name = service
|
|
admin_user = barbican
|
|
admin_password = orange
|
|
auth_version = v2.0
|
|
#delay failing perhaps to log the unauthorized request in barbican ..
|
|
#delay_auth_decision = true
|
|
|
|
[filter:profile]
|
|
use = egg:repoze.profile
|
|
log_filename = myapp.profile
|
|
cachegrind_filename = cachegrind.out.myapp
|
|
discard_first_request = true
|
|
path = /__profile__
|
|
flush_at_shutdown = true
|
|
unwind = false
|