<div dir="ltr"><div><div>Thanks John for providing the pointer to the fix and also thank all contributors for providing the quick fix.<br><br></div>Thanks and Regards,<br></div>Asha Seshagiri<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, May 15, 2015 at 3:30 PM, John Vrbanac <span dir="ltr"><<a href="mailto:john.vrbanac@rackspace.com" target="_blank">john.vrbanac@rackspace.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Asha,<br>
We landed the fix in: <a href="https://review.openstack.org/#/c/183391/" target="_blank">https://review.openstack.org/#/c/183391/</a><br>
Hopefully, that should address the problem you've been seeing.<br>
<br>
Thanks!<br>
<span class="HOEnZb"><font color="#888888"><br>
John Vrbanac<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
On Thu, 2015-05-14 at 18:14 -0500, Douglas Mendizábal wrote:<br>
> Hi Asha,<br>
><br>
> The reason we support an Unauthenticated Context in Barbican is purely<br>
> for development purposes. We recommend that all production Barbican<br>
> deployments use Keystone or an alternative AuthN/AuthZ service in<br>
> front of Barbican.<br>
><br>
> Setting up a working Keystone environment just to hack on Barbican is<br>
> a steep requirement, which is why we need the Unauthenticated Context<br>
> to work.<br>
><br>
> - Douglas Mendizabal<br>
><br>
> On 5/14/15 6:07 PM, Asha Seshagiri wrote:<br>
> > Thanks a lot John for your response. But would like to know why do<br>
> > would we have to fix the issue for creating the secret for<br>
> > unauthenticated context for Barbican since it would be good to have<br>
> > access control mechanism enforced to access secrets , orders and<br>
> > other entities from Barbican.<br>
> ><br>
> > This should be the expected behavior from security perspective .And<br>
> > also we are able to access secrets by providing the right token<br>
> > from the Identity service (Keystone ). Looking forward for your<br>
> > response.<br>
> ><br>
> > Thanks and Regards, Asha Seshagiri<br>
> ><br>
> > On Thu, May 14, 2015 at 4:43 PM, John Vrbanac<br>
> > <<a href="mailto:john.vrbanac@rackspace.com">john.vrbanac@rackspace.com</a> <mailto:<a href="mailto:john.vrbanac@rackspace.com">john.vrbanac@rackspace.com</a>>><br>
> > wrote:<br>
> ><br>
> > __ Asha, I spent some time looking into this, It looks to be a<br>
> > regression that occurred a few days ago when a CR was merged that<br>
> > moved us over to oslo_context. I have reported the issue here:<br>
> > <a href="https://bugs.launchpad.net/barbican/+bug/1455247" target="_blank">https://bugs.launchpad.net/barbican/+bug/1455247</a><br>
> ><br>
> > I have a couple ideas on how to fix it, so keep your eyes out for<br>
> > a CR to resolve the issue.<br>
> ><br>
> > John Vrbanac<br>
> ><br>
> ><br>
> ><br>
> > On Thu, 2015-05-14 at 12:26 -0500, Asha Seshagiri wrote:<br>
> >> Hi all ,<br>
> >><br>
> >><br>
> >> We are able to execute the curl commands on new barbican code<br>
> >> provided we integrated it with keystone . I ran into this issue<br>
> >> because I was trying to configure localhost to actual IP on a<br>
> >> plain barbican server so that I would get the response and<br>
> >> request objects with the actual IP rather than the local host .<br>
> >> This configuration was required for seting up HA proxy for<br>
> >> Barbican.<br>
> >><br>
> >> And then I thought of integrating with the keystone and<br>
> >> configure Babrican server to https.<br>
> >><br>
> >> *Its a good learning to know that the latest code drop of<br>
> >> Barbican enforces the authentication mechanism with the keystone<br>
> >> which would not allow us to execute the curl command without<br>
> >> providing the token of Identity service (Keystone ) in the<br>
> >> request unlike the previous Barbican versions*<br>
> >><br>
> >> Please find the curl command request and responses for<br>
> >> uploading/reteriving the secets on Barbican Server<br>
> >><br>
> >> root@Clientfor-HAProxy barbican]# curl -X POST -H<br>
> >> 'content-type:application/json' -H 'X-Project-Id:12345' \<br>
> >>> -H "X-Auth-Token:c9ac81784e1e4e089fccbca19f862be2" -d<br>
> >> '{"payload": "my-secret-here","payload_content_type":<br>
> >> "text/plain"}' \<br>
> >>> -k <a href="https://localhost:9311/v1/secrets" target="_blank">https://localhost:9311/v1/secrets</a><br>
> >> {"secret_ref":<br>
> >> "<a href="https://localhost:9311/v1/secrets/02336016-623b-4deb-bca5-caedc0bf0e" target="_blank">https://localhost:9311/v1/secrets/02336016-623b-4deb-bca5-caedc0bf0e</a><br>
> 35"}[root@Clientfor-HAProxy<br>
> >><br>
> >><br>
> barbican]#<br>
> >><br>
> >> [root@Clientfor-HAProxy barbican]# curl -H 'Accept:<br>
> >> application/json' -H 'X-Project-Id:12345' \<br>
> >>> -H "X-Auth-Token:c9ac81784e1e4e089fccbca19f862be2" -k<br>
> >> <a href="https://localhost:9311/v1/secrets" target="_blank">https://localhost:9311/v1/secrets</a> {"secrets": [{"status":<br>
> >> "ACTIVE", "secret_type": "opaque", "updated":<br>
> >> "2015-05-14T16:35:44.109536", "name": null, "algorithm": null,<br>
> >> "created": "2015-05-14T16:35:44.103982", "secret_ref":<br>
> >> "<a href="https://localhost:9311/v1/secrets/02336016-623b-4deb-bca5-caedc0bf0e" target="_blank">https://localhost:9311/v1/secrets/02336016-623b-4deb-bca5-caedc0bf0e</a><br>
> 35",<br>
> >><br>
> >><br>
> "content_types": {"default": "text/plain"}, "creator_id":<br>
> >> "cedd848a8a9e410196793c601c03b99a", "mode": null, "bit_length":<br>
> >> null, "expiration": null}], "total": 1}[root@Clientfor-HAProxy<br>
> >> barbican]#<br>
> >><br>
> >> Thanks and Regards, Asha Seshagiri<br>
> >><br>
> >> On Wed, May 13, 2015 at 4:26 PM, Asha Seshagiri<br>
> >> <<a href="mailto:asha.seshagiri@gmail.com">asha.seshagiri@gmail.com</a> <mailto:<a href="mailto:asha.seshagiri@gmail.com">asha.seshagiri@gmail.com</a>>><br>
> >> wrote:<br>
> >><br>
> >> Hi all ,<br>
> >><br>
> >><br>
> >><br>
> >> When I started debugging ,we find that default group is not<br>
> >> used instead oslo_policy would be used<br>
> >><br>
> >> Please find the logs below :<br>
> >><br>
> >><br>
> >> *2015-05-13 15:59:<a href="tel:34.393%2013210" value="+13439313210">34.393 13210</a> WARNING oslo_config.cfg [-] Option<br>
> >> "policy_default_rule" from group "DEFAULT" is deprecated. Use<br>
> >> option "policy_default_rule" from group "oslo_policy".*<br>
> >> *2015-05-13 15:59:<a href="tel:34.394%2013210" value="+13439413210">34.394 13210</a> WARNING oslo_config.cfg [-] Option<br>
> >> "policy_file" from group "DEFAULT" is deprecated. Use option<br>
> >> "policy_file" from group "oslo_policy".* 2015-05-13 15:59:34.395<br>
> >> 13210 DEBUG oslo_policy.openstack.common.fileutils<br>
> >> [req-0c6d2db4-bc15-4752-93ca-5203cf742d79 - 12345 - - -]<br>
> >> Reloading cached file /etc/barbican/policy.json read_cached_file<br>
> >> /usr/lib/python2.7/site-packages/oslo_policy/openstack/common/fileuti<br>
> ls.py:64<br>
> >><br>
> >><br>
> 2015-05-13 15:59:34.398 13210 DEBUG oslo_policy.policy<br>
> >> [req-0c6d2db4-bc15-4752-93ca-5203cf742d79 - 12345 - - -] Reloaded<br>
> >> policy file: /etc/barbican/policy.json _load_policy_file<br>
> >> /usr/lib/python2.7/site-packages/oslo_policy/policy.py:424<br>
> >> 2015-05-13 15:59:34.399 13210 ERROR barbican.api.controllers<br>
> >> [req-0c6d2db4-bc15-4752-93ca-5203cf742d79 - 12345 - - -] Secret<br>
> >> creation attempt not allowed - please review your user/project<br>
> >> privileges 2015-05-13 15:59:34.399 13210 TRACE<br>
> >> barbican.api.controllers Traceback (most recent call last):<br>
> >> 2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers File<br>
> >> "/root/barbican/barbican/api/controllers/__init__.py", line 104,<br>
> >> in handler 2015-05-13 15:59:34.399 13210 TRACE<br>
> >> barbican.api.controllers return fn(inst, *args, **kwargs)<br>
> >> 2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers File<br>
> >> "/root/barbican/barbican/api/controllers/__init__.py", line 85,<br>
> >> in enforcer 2015-05-13 15:59:34.399 13210 TRACE<br>
> >> barbican.api.controllers _do_enforce_rbac(inst,<br>
> >> pecan.request, action_name, ctx, **kwargs) 2015-05-13<br>
> >> 15:59:34.399 13210 TRACE barbican.api.controllers File<br>
> >> "/root/barbican/barbican/api/controllers/__init__.py", line 68,<br>
> >> in _do_enforce_rbac 2015-05-13 15:59:34.399 13210 TRACE<br>
> >> barbican.api.controllers credentials, do_raise=True)<br>
> >> 2015-05-13 15:59:34.399 13210 TRACE barbican.api.controllers File<br>
> >> "/usr/lib/python2.7/site-packages/oslo_policy/policy.py", line<br>
> >> 493, in enforce 2015-05-13 15:59:34.399 13210 TRACE<br>
> >> barbican.api.controllers raise PolicyNotAuthorized(rule,<br>
> >> target, creds) 2015-05-13 15:59:34.399 13210 TRACE<br>
> >> barbican.api.controllers PolicyNotAuthorized: secrets:post on<br>
> >> {u'payload': u'my-secret-here', u'payload_content_type':<br>
> >> u'text/plain'} by {'project': '12345', 'user': None, 'roles': []}<br>
> >> disallowed by policy 2015-05-13 15:59:34.399 13210 TRACE<br>
> >> barbican.api.controllers 2015-05-13 15:59:34.400 13210 INFO<br>
> >> barbican.api.middleware.context<br>
> >> [req-0c6d2db4-bc15-4752-93ca-5203cf742d79 - 12345 - - -]<br>
> >> req-556e8733-aea2-4acf-ac8b-30bc671a6f22 | Processed request: 403<br>
> >> Forbidden - POST <a href="http://localhost:9311/v1/secrets" target="_blank">http://localhost:9311/v1/secrets</a> {address space<br>
> >> usage: 364666880 bytes/347MB} {rss usage: 65622016 bytes/62MB}<br>
> >> [pid: 13210|app: 0|req: 1/1] 127.0.0.1 () {30 vars in 358 bytes}<br>
> >> [Wed May 13 15:59:34 2015] POST /v1/secrets => generated 134<br>
> >> bytes in 7 msecs (HTTP/1.1 403) 4 headers in 179 bytes (1<br>
> >> switches on core 0) announcing my loyalty to the Emperor... Wed<br>
> >> May 13 15:59:34 2015 - [emperor] vassal barbican-api.ini is now<br>
> >> loyal<br>
> >><br>
> >><br>
> >> Hence I tried changing policy_default_rule value in the<br>
> >> barbican.conf file to oslo_policy instead of default and then<br>
> >> restarting it .It did not work . Please find the rule below :<br>
> >><br>
> >><br>
> >> *# Rule checked when requested rule is not found (string value)*<br>
> >> *policy_default_rule=oslo_policy*<br>
> >><br>
> >> *[root@Clientfor-HAProxy ~]# curl -X POST -H<br>
> >> 'content-type:application/json' -H 'X-Project-Id:12345' -d<br>
> >> '{"payload": "my-secret-here", "payload_content_type":<br>
> >> "text/plain"}' <a href="http://localhost:9311/v1/secrets*" target="_blank">http://localhost:9311/v1/secrets*</a> *{"code": 403,<br>
> >> "description": "Secret creation attempt not allowed - please<br>
> >> review your user/project privileges", "title": "Forbidden"}*<br>
> >><br>
> >><br>
> >> It would be great if some one could help me out with this.Any<br>
> >> help would be highly appreciated.<br>
> >><br>
> >> Thanks in advance<br>
> >><br>
> >><br>
> >><br>
> >> Thanks and Regards,<br>
> >><br>
> >> Asha Seshagiri<br>
> >><br>
> >><br>
> >><br>
> >> On Tue, May 12, 2015 at 6:31 PM, Asha Seshagiri<br>
> >> <<a href="mailto:asha.seshagiri@gmail.com">asha.seshagiri@gmail.com</a> <mailto:<a href="mailto:asha.seshagiri@gmail.com">asha.seshagiri@gmail.com</a>>><br>
> >> wrote:<br>
> >><br>
> >> Hi All ,<br>
> >><br>
> >><br>
> >> Installed the barbican today taking the source from github and<br>
> >> executed the basic curl commands for retrieving and uploading the<br>
> >> secrets.<br>
> >><br>
> >> Was unable to execute the curl commands for retrieving and<br>
> >> uploading the secrets. Please find the request and response for<br>
> >> the command :<br>
> >><br>
> >> [root@Clientfor-HAProxy ~]# curl -X POST -H<br>
> >> 'content-type:application/json' -H 'X-Project-Id:12345' -d<br>
> >> '{"payload": "my-secret-here", "payload_content_type":<br>
> >> "text/plain"}' <a href="http://localhost:9311/v1/secrets" target="_blank">http://localhost:9311/v1/secrets</a> *{"code": 403,<br>
> >> "description": "Secret creation attempt not allowed - please<br>
> >> review your user/project privileges", "title": "Forbidden"}*<br>
> >> [root@Clientfor-HAProxy ~]# curl -H 'X-Project-Id: 12345'<br>
> >> <a href="http://localhost:9311/v1/secrets" target="_blank">http://localhost:9311/v1/secrets</a> *{"code": 403, "description":<br>
> >> "Secret(s) retrieval attempt not allowed - please review your<br>
> >> user/project privileges", "title": "Forbidden"}*<br>
> >><br>
> >><br>
> >> Would like to know the changes that needs to be done in order to<br>
> >> execute the basic curl commands for Barbican.<br>
> >><br>
> >> Also noticed that admin config files are not loaded and only the<br>
> >> APi file is loaded .Please find the logs below :<br>
> >><br>
> >><br>
> >> *** Operational MODE: single process *** *** uWSGI is running in<br>
> >> multiple interpreter mode *** spawned uWSGI master process (pid:<br>
> >> 9299) Tue May 12 16:23:09 2015 - [emperor] vassal<br>
> >> barbican-api.ini has been spawned spawned uWSGI worker 1 (pid:<br>
> >> 9300, cores: 1) *Loading paste environment:<br>
> >> config:/etc/barbican/barbican-api-paste.ini* 2015-05-12<br>
> >> 16:23:11.036 9300 INFO barbican.model.repositories [-] Setting up<br>
> >> database engine and session factory 2015-05-12 16:23:11.044 9300<br>
> >> DEBUG sqlalchemy.pool.NullPool [-] Created new connection<br>
> >> <sqlite3.Connection object at 0x53d8dc8> __connect<br>
> >> /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:540<br>
> >> 2015-05-12 16:23:11.045 9300 DEBUG sqlalchemy.pool.NullPool [-]<br>
> >> Connection <sqlite3.Connection object at 0x53d8dc8> checked out<br>
> >> from pool checkout<br>
> >> /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:458<br>
> >> 2015-05-12 16:23:11.046 9300 DEBUG sqlalchemy.pool.NullPool [-]<br>
> >> Connection <sqlite3.Connection object at 0x53d8dc8> being<br>
> >> returned to pool _finalize_fairy<br>
> >> /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:562<br>
> >> 2015-05-12 16:23:11.046 9300 DEBUG sqlalchemy.pool.NullPool [-]<br>
> >> Connection <sqlite3.Connection object at 0x53d8dc8><br>
> >> rollback-on-return _reset<br>
> >> /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:698<br>
> >> 2015-05-12 16:23:11.046 9300 DEBUG sqlalchemy.pool.NullPool [-]<br>
> >> Closing connection <sqlite3.Connection object at 0x53d8dc8><br>
> >> _close_connection<br>
> >> /usr/lib64/python2.7/site-packages/sqlalchemy/pool.py:248<br>
> >><br>
> >><br>
> >><br>
> >><br>
> >> *Any help would be highly appreciated since this would impact my<br>
> >> work on setting up HA proxy for Barbican*<br>
> >><br>
> >> Thanks in advance !<br>
> >><br>
> >><br>
> >> --<br>
> >><br>
> >> /Thanks and Regards,/<br>
> >><br>
> >> /Asha Seshagiri/<br>
> >><br>
> >><br>
> >><br>
> >><br>
> >> --<br>
> >><br>
> >> /Thanks and Regards,/<br>
> >><br>
> >> /Asha Seshagiri/<br>
> >><br>
> >><br>
> >><br>
> >><br>
> >> -- /Thanks and Regards,/ /Asha Seshagiri/<br>
> >> _____________________________________________________________________<br>
> _____<br>
> >><br>
> >><br>
> OpenStack Development Mailing List (not for usage questions)<br>
> >> Unsubscribe: <a href="mailto:OpenStack-dev-request@lists.openstack.org">OpenStack-dev-request@lists.openstack.org</a><br>
> >> <mailto:<a href="mailto:OpenStack-dev-request@lists.openstack.org">OpenStack-dev-request@lists.openstack.org</a>>?subject:unsubscrib<br>
> e<br>
> >><br>
> >><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
> ><br>
> > ______________________________________________________________________<br>
> ____<br>
> ><br>
> ><br>
> OpenStack Development Mailing List (not for usage questions)<br>
> > Unsubscribe:<br>
> > <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> > <<a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a>><br>
> ><br>
> ><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
> ><br>
> ><br>
> ><br>
> ><br>
> > -- /Thanks and Regards,/ /Asha Seshagiri/<br>
> ><br>
> ><br>
> > ______________________________________________________________________<br>
> ____<br>
> ><br>
> ><br>
> OpenStack Development Mailing List (not for usage questions)<br>
> > Unsubscribe:<br>
> > <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
> ><br>
</div></div><div class="HOEnZb"><div class="h5">> __________________________________________________________________________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div><em>Thanks and Regards,</em></div>
<div><em>Asha Seshagiri</em></div></div>
</div>