6c73690f77
Without this patch, when an OAuth1 request token is authorized with a limited set of roles, the roles for the access token are ignored when the user uses it to request a keystone token. This means that user of an access token can use it to escallate their role assignments beyond what was authorized by the creator. This patch fixes the issue by ensuring the token model accounts for an OAuth1-scoped token and correctly populating the roles for it. Change-Id: I02f9836fbd4d7e629653977fc341476cfd89859e Closes-bug: #1873290
20 lines
1.1 KiB
YAML
20 lines
1.1 KiB
YAML
---
|
|
security:
|
|
- |
|
|
[`bug 1873290 <https://bugs.launchpad.net/keystone/+bug/1873290>`_]
|
|
[`bug 1872735 <https://bugs.launchpad.net/keystone/+bug/1872735>`_]
|
|
Fixed the token model to respect the roles authorized OAuth1 access tokens.
|
|
Previously, the list of roles authorized for an OAuth1 access token were
|
|
ignored, so when an access token was used to request a keystone token, the
|
|
keystone token would contain every role assignment the creator had for the
|
|
project. This also fixed EC2 credentials to respect those roles as well.
|
|
fixes:
|
|
- |
|
|
[`bug 1873290 <https://bugs.launchpad.net/keystone/+bug/1873290>`_]
|
|
[`bug 1872735 <https://bugs.launchpad.net/keystone/+bug/1872735>`_]
|
|
Fixed the token model to respect the roles authorized OAuth1 access tokens.
|
|
Previously, the list of roles authorized for an OAuth1 access token were
|
|
ignored, so when an access token was used to request a keystone token, the
|
|
keystone token would contain every role assignment the creator had for the
|
|
project. This also fixed EC2 credentials to respect those roles as well.
|