From ffa5ce49a00ee1fc0d901ca6ffb1727fe1de4358 Mon Sep 17 00:00:00 2001 From: Alfredo Moralejo Date: Fri, 7 Jul 2017 09:18:03 +0000 Subject: [PATCH] Revert "Use recommended function to setup auth middleware in devstack" It's breaking introspection in tripleo jobs. This reverts commit fe922eacdbeb6032ab6038def56a1d02c2a64c3a. Change-Id: I502e92ed1dcd8f9dd293b768f5d0d93026960463 --- devstack/plugin.sh | 15 +++---- devstack/settings | 1 - mistral/services/security.py | 3 +- mistral/utils/openstack/keystone.py | 63 ++++++++++++++--------------- 4 files changed, 40 insertions(+), 42 deletions(-) diff --git a/devstack/plugin.sh b/devstack/plugin.sh index 2fd75c9e6..09f654089 100755 --- a/devstack/plugin.sh +++ b/devstack/plugin.sh @@ -59,11 +59,6 @@ function mkdir_chown_stack { # configure_mistral - Set config files, create data dirs, etc function configure_mistral { - - # create and clean up auth cache dir - mkdir_chown_stack "$MISTRAL_AUTH_CACHE_DIR" - rm -f "$MISTRAL_AUTH_CACHE_DIR"/* - mkdir_chown_stack "$MISTRAL_CONF_DIR" # Generate Mistral configuration file and configure common parameters. @@ -80,8 +75,14 @@ function configure_mistral { #------------------------- # Setup keystone_authtoken section - configure_auth_token_middleware $MISTRAL_CONF_FILE mistral $MISTRAL_AUTH_CACHE_DIR + iniset $MISTRAL_CONF_FILE keystone_authtoken auth_host $KEYSTONE_AUTH_HOST + iniset $MISTRAL_CONF_FILE keystone_authtoken auth_port $KEYSTONE_AUTH_PORT + iniset $MISTRAL_CONF_FILE keystone_authtoken auth_protocol $KEYSTONE_AUTH_PROTOCOL + iniset $MISTRAL_CONF_FILE keystone_authtoken admin_tenant_name $SERVICE_TENANT_NAME + iniset $MISTRAL_CONF_FILE keystone_authtoken admin_user $MISTRAL_ADMIN_USER + iniset $MISTRAL_CONF_FILE keystone_authtoken admin_password $SERVICE_PASSWORD iniset $MISTRAL_CONF_FILE keystone_authtoken auth_uri $KEYSTONE_AUTH_URI_V3 + iniset $MISTRAL_CONF_FILE keystone_authtoken identity_uri $KEYSTONE_AUTH_URI # Setup RabbitMQ credentials iniset $MISTRAL_CONF_FILE oslo_messaging_rabbit rabbit_userid $RABBIT_USERID @@ -249,8 +250,8 @@ if is_service_enabled mistral; then install_mistral_pythonclient elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then echo_summary "Configuring mistral" - create_mistral_accounts configure_mistral + create_mistral_accounts elif [[ "$1" == "stack" && "$2" == "extra" ]]; then echo_summary "Initializing mistral" init_mistral diff --git a/devstack/settings b/devstack/settings index b120d0f9f..9cddc9e33 100644 --- a/devstack/settings +++ b/devstack/settings @@ -29,7 +29,6 @@ MISTRAL_DASHBOARD_DIR=$DEST/mistral-dashboard MISTRAL_CONF_DIR=${MISTRAL_CONF_DIR:-/etc/mistral} MISTRAL_CONF_FILE=${MISTRAL_CONF_DIR}/mistral.conf MISTRAL_DEBUG=${MISTRAL_DEBUG:-True} -MISTRAL_AUTH_CACHE_DIR=${MISTRAL_AUTH_CACHE_DIR:-/var/cache/mistral} MISTRAL_SERVICE_HOST=${MISTRAL_SERVICE_HOST:-$SERVICE_HOST} MISTRAL_SERVICE_PORT=${MISTRAL_SERVICE_PORT:-8989} diff --git a/mistral/services/security.py b/mistral/services/security.py index 30e018b8c..497e638bb 100644 --- a/mistral/services/security.py +++ b/mistral/services/security.py @@ -42,7 +42,8 @@ def create_trust(): ctx = auth_ctx.ctx() - trustee_id = keystone.client_for_admin().session.get_user_id() + trustee_id = keystone.client_for_admin( + CONF.keystone_authtoken.admin_tenant_name).user_id return client.trusts.create( trustor_user=client.user_id, diff --git a/mistral/utils/openstack/keystone.py b/mistral/utils/openstack/keystone.py index e54907a07..cdb3a5cae 100644 --- a/mistral/utils/openstack/keystone.py +++ b/mistral/utils/openstack/keystone.py @@ -13,7 +13,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -from keystoneauth1 import loading +import keystoneauth1.identity.generic as auth_plugins from keystoneauth1 import session as ks_session from keystoneauth1.token_endpoint import Token from keystoneclient import service_catalog as ks_service_catalog @@ -27,7 +27,6 @@ from mistral import context from mistral import exceptions CONF = cfg.CONF -CONF.register_opt(cfg.IntOpt('timeout'), group='keystone_authtoken') def client(): @@ -93,32 +92,23 @@ def get_session_and_auth(context, **kwargs): def _admin_client(trust_id=None, project_name=None): - kwargs = {} + auth_url = CONF.keystone_authtoken.auth_uri - if trust_id: - # Remove project_name and project_id, since we need a trust scoped - # auth object - kwargs['project_name'] = None - kwargs['project_domain_name'] = None - kwargs['project_id'] = None - kwargs['trust_id'] = trust_id - - auth = loading.load_auth_from_conf_options( - CONF, - 'keystone_authtoken', - **kwargs - ) - sess = loading.load_session_from_conf_options( - CONF, - 'keystone_authtoken', - auth=auth + cl = ks_client.Client( + username=CONF.keystone_authtoken.admin_user, + password=CONF.keystone_authtoken.admin_password, + project_name=project_name, + auth_url=auth_url, + trust_id=trust_id ) - return ks_client.Client(session=sess) + cl.management_url = auth_url + + return cl -def client_for_admin(): - return _admin_client() +def client_for_admin(project_name): + return _admin_client(project_name=project_name) def client_for_trusts(trust_id): @@ -240,21 +230,28 @@ def format_url(url_template, values): def is_token_trust_scoped(auth_token): - return 'OS-TRUST:trust' in client_for_admin().tokens.validate(auth_token) + admin_project_name = CONF.keystone_authtoken.admin_tenant_name + keystone_client = _admin_client(project_name=admin_project_name) + + token_info = keystone_client.tokens.validate(auth_token) + + return 'OS-TRUST:trust' in token_info def get_admin_session(): """Returns a keystone session from Mistral's service credentials.""" - auth = loading.load_auth_from_conf_options( - CONF, - 'keystone_authtoken' - ) - return loading.load_session_from_conf_options( - CONF, - 'keystone_authtoken', - auth=auth - ) + auth = auth_plugins.Password( + CONF.keystone_authtoken.auth_uri, + username=CONF.keystone_authtoken.admin_user, + password=CONF.keystone_authtoken.admin_password, + project_name=CONF.keystone_authtoken.admin_tenant_name, + # NOTE(jaosorior): Once mistral supports keystone v3 properly, we can + # fetch the following values from the configuration. + user_domain_name='Default', + project_domain_name='Default') + + return ks_session.Session(auth=auth) def will_expire_soon(expires_at):