<div dir="ltr">Thanks a lot John for your response.<br>
But would like to know why do would we have to fix the issue for
creating the secret for unauthenticated context for Barbican since it
would be good to have access control mechanism enforced to access
secrets , orders and other entities from Barbican.<br>
<br>
This should be the expected behavior from security perspective .And also
we are able to access secrets by providing the right token from the
Identity service (Keystone ).<br>
Looking forward for your response. <br>
<br>
Thanks and Regards,<br>
Asha Seshagiri</div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, May 14, 2015 at 4:43 PM, John Vrbanac <span dir="ltr"><<a href="mailto:john.vrbanac@rackspace.com" target="_blank">john.vrbanac@rackspace.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><u></u>
<div>
Asha,<br>
I spent some time looking into this, It looks to be a regression that occurred a few days ago when a CR was merged that moved us over to oslo_context.
<br>
I have reported the issue here: <a href="https://bugs.launchpad.net/barbican/+bug/1455247" target="_blank">
https://bugs.launchpad.net/barbican/+bug/1455247</a><br>
<br>
I have a couple ideas on how to fix it, so keep your eyes out for a CR to resolve the issue.<br>
<br>
John Vrbanac<div><div class="h5"><br>
<br>
<br>
On Thu, 2015-05-14 at 12:26 -0500, Asha Seshagiri wrote:
<blockquote type="CITE">Hi all ,<br>
<br>
<br>
</blockquote>
<blockquote type="CITE"> <font size="2"><font color="#000000">We are able to execute the curl commands on new barbican code provided we integrated it with keystone .</font></font><br>
<font size="2"><font color="#000000">I ran into this issue because I was trying to configure localhost to actual IP on a plain barbican server so that I would get the response and request objects with the actual IP rather than the local host .</font></font><br>
<font size="2"><font color="#000000">This configuration was required for seting up HA proxy for Barbican.</font></font><br>
<br>
<font size="2"><font color="#000000">And then I thought of integrating with the keystone and configure Babrican server to https.</font></font><br>
<br>
<b><font size="2"><font color="#ff0000">Its a good learning to know that the latest code drop of Barbican enforces the authentication mechanism with the keystone which would not allow us to execute the curl command without providing the token of Identity service
(Keystone ) in the request unlike the previous Barbican versions</font></font></b><br>
<br>
<font size="2"><font color="#000000">Please find the curl command request and responses for uploading/reteriving the secets on Barbican Server
</font></font><br>
<br>
<font size="2"><font color="#000000">root@Clientfor-HAProxy barbican]# curl -X POST -H 'content-type:application/json' -H 'X-Project-Id:12345' \</font></font><br>
<font size="2"><font color="#000000">> -H "X-Auth-Token:c9ac81784e1e4e089fccbca19f862be2" -d '{"payload": "my-secret-here","payload_content_type": "text/plain"}' \</font></font><br>
<font size="2"><font color="#000000">> -k <a href="https://localhost:9311/v1/secrets" target="_blank">
https://localhost:9311/v1/secrets</a></font></font><br>
<font size="2"><font color="#000000">{"secret_ref": "<a href="https://localhost:9311/v1/secrets/02336016-623b-4deb-bca5-caedc0bf0e35" target="_blank">https://localhost:9311/v1/secrets/02336016-623b-4deb-bca5-caedc0bf0e35</a>"}[root@Clientfor-HAProxy barbican]#</font></font><br>
<br>
<font size="2"><font color="#000000">[root@Clientfor-HAProxy barbican]# curl -H 'Accept: application/json' -H 'X-Project-Id:12345' \</font></font><br>
<font size="2"><font color="#000000">> -H "X-Auth-Token:c9ac81784e1e4e089fccbca19f862be2" -k
<a href="https://localhost:9311/v1/secrets" target="_blank">https://localhost:9311/v1/secrets</a></font></font><br>
<font size="2"><font color="#000000">{"secrets": [{"status": "ACTIVE", "secret_type": "opaque", "updated": "2015-05-14T16:35:44.109536", "name": null, "algorithm": null, "created": "2015-05-14T16:35:44.103982", "secret_ref": "<a href="https://localhost:9311/v1/secrets/02336016-623b-4deb-bca5-caedc0bf0e35" target="_blank">https://localhost:9311/v1/secrets/02336016-623b-4deb-bca5-caedc0bf0e35</a>",
"content_types": {"default": "text/plain"}, "creator_id": "cedd848a8a9e410196793c601c03b99a", "mode": null, "bit_length": null, "expiration": null}], "total": 1}[root@Clientfor-HAProxy barbican]#</font></font><br>
<br>
<font size="2"><font color="#000000">Thanks and Regards,</font></font><br>
<font size="2"><font color="#000000">Asha Seshagiri</font></font> </blockquote>
<blockquote type="CITE"><br>
</blockquote>
<blockquote type="CITE">On Wed, May 13, 2015 at 4:26 PM, Asha Seshagiri <<a href="mailto:asha.seshagiri@gmail.com" target="_blank">asha.seshagiri@gmail.com</a>> wrote:
</blockquote>
<blockquote type="CITE">
<blockquote>Hi all ,<br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote><br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>When I started debugging ,we find that default group is not used instead oslo_policy would be used<br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>Please find the logs below : <br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote><br>
<b>2015-05-13 15:59:34.393 13210 WARNING oslo_config.cfg [-] Option "policy_default_rule" from group "DEFAULT" is deprecated. Use option "policy_default_rule" from group "oslo_policy".</b><br>
<b>2015-05-13 15:59:34.394 13210 WARNING oslo_config.cfg [-] Option "policy_file" from group "DEFAULT" is deprecated. Use option "policy_file" from group "oslo_policy".</b><br>
2015-05-13 15:59:34.395 13210 DEBUG oslo_policy.openstack.common.fileutils [req-0c6d2db4-bc15-4752-93ca-5203cf742d79 - 12345 - - -] Reloading cached file /etc/barbican/policy.json read_cached_file /usr/lib/python2.7/site-packages/oslo_policy/openstack/common/fileutils.py:64<br>
2015-05-13 15:59:34.398 13210 DEBUG oslo_policy.policy [req-0c6d2db4-bc15-4752-93ca-5203cf742d79 - 12345 - - -] Reloaded policy file: /etc/barbican/policy.json _load_policy_file /usr/lib/python2.7/site-packages/oslo_policy/policy.py:424<br>
2015-05-13 15:59:34.399 13210 ERROR barbican.api.controllers [req-0c6d2db4-bc15-4752-93ca-5203cf742d79 - 12345 - - -] Secret creation attempt not allowed - please review your user/project privileges<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers Traceback (most recent call last):<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers File "/root/barbican/barbican/api/controllers/__init__.py", line 104, in handler<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers return fn(inst, *args, **kwargs)<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers File "/root/barbican/barbican/api/controllers/__init__.py", line 85, in enforcer<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers _do_enforce_rbac(inst, pecan.request, action_name, ctx, **kwargs)<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers File "/root/barbican/barbican/api/controllers/__init__.py", line 68, in _do_enforce_rbac<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers credentials, do_raise=True)<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers File "/usr/lib/python2.7/site-packages/oslo_policy/policy.py", line 493, in enforce<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers raise PolicyNotAuthorized(rule, target, creds)<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers PolicyNotAuthorized: secrets:post on {u'payload': u'my-secret-here', u'payload_content_type': u'text/plain'} by {'project': '12345', 'user': None, 'roles': []} disallowed by policy<br>
2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers<br>
2015-05-13 15:59:34.400 13210 INFO barbican.api.middleware.context [req-0c6d2db4-bc15-4752-93ca-5203cf742d79 - 12345 - - -] req-556e8733-aea2-4acf-ac8b-30bc671a6f22 | Processed request: 403 Forbidden - POST
<a href="http://localhost:9311/v1/secrets" target="_blank">http://localhost:9311/v1/secrets</a><br>
{address space usage: 364666880 bytes/347MB} {rss usage: 65622016 bytes/62MB} [pid: 13210|app: 0|req: 1/1] 127.0.0.1 () {30 vars in 358 bytes} [Wed May 13 15:59:34 2015] POST /v1/secrets => generated 134 bytes in 7 msecs (HTTP/1.1 403) 4 headers in 179 bytes
(1 switches on core 0)<br>
announcing my loyalty to the Emperor...<br>
Wed May 13 15:59:34 2015 - [emperor] vassal barbican-api.ini is now loyal<br>
<br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>Hence I tried changing policy_default_rule value in the barbican.conf file to oslo_policy instead of default and then restarting it .It did not work . Please find the rule below :<br>
<br>
<br>
<b># Rule checked when requested rule is not found (string value)</b><br>
<b>policy_default_rule=oslo_policy</b><br>
<br>
<b>[root@Clientfor-HAProxy ~]# curl -X POST -H 'content-type:application/json' -H 'X-Project-Id:12345' -d '{"payload": "my-secret-here", "payload_content_type": "text/plain"}'
<a href="http://localhost:9311/v1/secrets" target="_blank">http://localhost:9311/v1/secrets</a></b><br>
<b>{"code": 403, "description": "Secret creation attempt not allowed - please review your user/project privileges", "title": "Forbidden"}</b><br>
<br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>It would be great if some one could help me out with this.Any help would be highly appreciated.<br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>Thanks in advance <br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote><br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>Thanks and Regards,<br>
<br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>Asha Seshagiri </blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote><br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote><br>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>On Tue, May 12, 2015 at 6:31 PM, Asha Seshagiri <<a href="mailto:asha.seshagiri@gmail.com" target="_blank">asha.seshagiri@gmail.com</a>> wrote:
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote>Hi All ,<br>
<br>
<br>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote>Installed the barbican today taking the source from github and executed the basic curl commands for retrieving and uploading the secrets.<br>
<br>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote>Was unable to execute the curl commands for retrieving and uploading the secrets.
<br>
Please find the request and response for the command :<br>
<br>
[root@Clientfor-HAProxy ~]# curl -X POST -H 'content-type:application/json' -H 'X-Project-Id:12345' -d '{"payload": "my-secret-here", "payload_content_type": "text/plain"}'
<a href="http://localhost:9311/v1/secrets" target="_blank">http://localhost:9311/v1/secrets</a><br>
<b>{"code": 403, "description": "Secret creation attempt not allowed - please review your user/project privileges", "title": "Forbidden"}</b><br>
[root@Clientfor-HAProxy ~]# curl -H 'X-Project-Id: 12345' <a href="http://localhost:9311/v1/secrets" target="_blank">
http://localhost:9311/v1/secrets</a><br>
<b>{"code": 403, "description": "Secret(s) retrieval attempt not allowed - please review your user/project privileges", "title": "Forbidden"}</b><br>
<br>
<br>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote>Would like to know the changes that needs to be done in order to execute the basic curl commands for Barbican.<br>
<br>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote>Also noticed that admin config files are not loaded and only the APi file is loaded .Please find the logs below :<br>
<br>
<br>
*** Operational MODE: single process ***<br>
*** uWSGI is running in multiple interpreter mode ***<br>
spawned uWSGI master process (pid: 9299)<br>
Tue May 12 16:23:09 2015 - [emperor] vassal barbican-api.ini has been spawned<br>
spawned uWSGI worker 1 (pid: 9300, cores: 1)<br>
<b>Loading paste environment: config:/etc/barbican/barbican-api-paste.ini</b><br>
2015-05-12 16:23:11.036 9300 INFO barbican.model.repositories [-] Setting up database engine and session factory<br>
2015-05-12 16:23:11.044 9300 DEBUG sqlalchemy.pool.NullPool [-] Created new connection <sqlite3.Connection object at 0x53d8dc8> __connect /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:540<br>
2015-05-12 16:23:11.045 9300 DEBUG sqlalchemy.pool.NullPool [-] Connection <sqlite3.Connection object at 0x53d8dc8> checked out from pool checkout /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:458<br>
2015-05-12 16:23:11.046 9300 DEBUG sqlalchemy.pool.NullPool [-] Connection <sqlite3.Connection object at 0x53d8dc8> being returned to pool _finalize_fairy /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:562<br>
2015-05-12 16:23:11.046 9300 DEBUG sqlalchemy.pool.NullPool [-] Connection <sqlite3.Connection object at 0x53d8dc8> rollback-on-return _reset /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:698<br>
2015-05-12 16:23:11.046 9300 DEBUG sqlalchemy.pool.NullPool [-] Closing connection <sqlite3.Connection object at 0x53d8dc8> _close_connection /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:248<br>
<br>
<br>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote><br>
<br>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote><b>Any help would be highly appreciated since this would impact my work on setting up HA proxy for Barbican</b><br>
<br>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote>Thanks in advance ! </blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote><br>
<font color="#888888">-- </font></blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote><i><font color="#888888">Thanks and Regards,</font></i> </blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote>
<blockquote><i><font color="#888888">Asha Seshagiri</font></i> </blockquote>
</blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote><br>
<br>
<br>
-- </blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote><i>Thanks and Regards,</i> </blockquote>
</blockquote>
<blockquote type="CITE">
<blockquote><i>Asha Seshagiri</i> </blockquote>
</blockquote>
<blockquote type="CITE"><br>
<br>
<br>
-- </blockquote>
<blockquote type="CITE"><i>Thanks and Regards,</i> </blockquote>
<blockquote type="CITE"><i>Asha Seshagiri</i> </blockquote>
</div></div><blockquote type="CITE">
<pre>__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: <a href="mailto:OpenStack-dev-request@lists.openstack.org" target="_blank">OpenStack-dev-request@lists.openstack.org</a>?subject:unsubscribe
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</pre>
</blockquote>
</div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div><em>Thanks and Regards,</em></div>
<div><em>Asha Seshagiri</em></div></div>
</div>