From f2eba4634b73c27ec6b5282f0d2fcbd7890f463d Mon Sep 17 00:00:00 2001 From: ZhongShengping Date: Thu, 20 Aug 2020 10:41:27 +0800 Subject: [PATCH] Add service_token_roles for keystone authtoken config Add the ability to configure service_token_roles. Change-Id: I08be47f277fa47498b54c3084a76aefee82eea58 Closes-Bug: #1892284 --- manifests/keystone/authtoken.pp | 12 ++++++++++++ ...-service_token_roles-option-88fd7bdb8d69271d.yaml | 4 ++++ spec/classes/sahara_keystone_authtoken_spec.rb | 3 +++ 3 files changed, 19 insertions(+) create mode 100644 releasenotes/notes/add-service_token_roles-option-88fd7bdb8d69271d.yaml diff --git a/manifests/keystone/authtoken.pp b/manifests/keystone/authtoken.pp index 3fa7215b..712bcff3 100644 --- a/manifests/keystone/authtoken.pp +++ b/manifests/keystone/authtoken.pp @@ -162,6 +162,16 @@ # (in seconds). Set to -1 to disable caching completely. Integer value # Defaults to $::os_service_default. # +# [*service_token_roles*] +# (Optional) A choice of roles that must be present in a service token. +# Service tokens are allowed to request that an expired token +# can be used and so this check should tightly control that +# only actual services should be sending this token. Roles +# here are applied as an ANY check so any role in this list +# must be present. For backwards compatibility reasons this +# currently only affects the allow_expired check. (list value) +# Defaults to $::os_service_default. +# # [*service_token_roles_required*] # (optional) backwards compatibility to ensure that the service tokens are # compared against a list of possible roles for validity @@ -206,6 +216,7 @@ class sahara::keystone::authtoken( $manage_memcache_package = false, $region_name = $::os_service_default, $token_cache_time = $::os_service_default, + $service_token_roles = $::os_service_default, $service_token_roles_required = $::os_service_default, $interface = $::os_service_default, ) { @@ -245,6 +256,7 @@ class sahara::keystone::authtoken( manage_memcache_package => $manage_memcache_package, region_name => $region_name, token_cache_time => $token_cache_time, + service_token_roles => $service_token_roles, service_token_roles_required => $service_token_roles_required, interface => $interface, } diff --git a/releasenotes/notes/add-service_token_roles-option-88fd7bdb8d69271d.yaml b/releasenotes/notes/add-service_token_roles-option-88fd7bdb8d69271d.yaml new file mode 100644 index 00000000..ad0f1614 --- /dev/null +++ b/releasenotes/notes/add-service_token_roles-option-88fd7bdb8d69271d.yaml @@ -0,0 +1,4 @@ +--- +features: + - | + Add support to configure service_token_roles in authtoken middleware. diff --git a/spec/classes/sahara_keystone_authtoken_spec.rb b/spec/classes/sahara_keystone_authtoken_spec.rb index 93c2c5b6..42f28eee 100644 --- a/spec/classes/sahara_keystone_authtoken_spec.rb +++ b/spec/classes/sahara_keystone_authtoken_spec.rb @@ -42,6 +42,7 @@ describe 'sahara::keystone::authtoken' do is_expected.to contain_sahara_config('keystone_authtoken/memcached_servers').with_value('') is_expected.to contain_sahara_config('keystone_authtoken/region_name').with_value('') is_expected.to contain_sahara_config('keystone_authtoken/token_cache_time').with_value('') + is_expected.to contain_sahara_config('keystone_authtoken/service_token_roles').with_value('') is_expected.to contain_sahara_config('keystone_authtoken/service_token_roles_required').with_value('') is_expected.to contain_sahara_config('keystone_authtoken/interface').with_value('') is_expected.to contain_sahara_config('trustee/username').with_value('sahara') @@ -90,6 +91,7 @@ describe 'sahara::keystone::authtoken' do :manage_memcache_package => true, :region_name => 'region2', :token_cache_time => '301', + :service_token_roles => ['service'], :service_token_roles_required => false, :interface => 'internal', }) @@ -127,6 +129,7 @@ describe 'sahara::keystone::authtoken' do is_expected.to contain_sahara_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211') is_expected.to contain_sahara_config('keystone_authtoken/region_name').with_value(params[:region_name]) is_expected.to contain_sahara_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + is_expected.to contain_sahara_config('keystone_authtoken/service_token_roles').with_value(params[:service_token_roles]) is_expected.to contain_sahara_config('keystone_authtoken/service_token_roles_required').with_value(params[:service_token_roles_required]) is_expected.to contain_sahara_config('keystone_authtoken/interface').with_value(params[:interface]) is_expected.to contain_sahara_config('trustee/username').with_value(params[:username])