Open Stack

Reviewed:  https://review.openstack.org/201328
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=a7037547fecf0998ea09b1139123c3c1ef97472d
Submitter: Jenkins
Branch:    stable/juno

commit a7037547fecf0998ea09b1139123c3c1ef97472d
Author: Brant Knudson <bknudson at us.ibm.com>
Date:   Fri Jun 19 14:40:30 2015 -0500

    Add test showing password logged
    
    There was no test that showed that the password is logged when a
    user is created or admin changes user password.
    
    Conflicts:
    	keystone/tests/unit/test_v3_identity.py
    
    Change-Id: I5ffa04e9ac359355cff47a622731f1bf6a27ea7b
    Partial-Bug: #1465922
    (cherry picked from commit c2c3a0ff86314bee3d62f69d30206ff7584f229f)
    (cherry picked from commit fba2d5c15e298e0936800a0e3d1ff7588235c359)


** Tags added: in-stable-juno

-- 
You received this bug notification because you are a member of OpenStack
Security, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1465922

Title:
  Password visible in clear text in keystone.log when user created and
  keystone debug logging is enabled

Status in OpenStack Identity (keystone):
  Fix Released
Status in OpenStack Identity (keystone) juno series:
  In Progress
Status in OpenStack Identity (keystone) kilo series:
  Fix Released
Status in OpenStack Security Advisory:
  Won't Fix

Bug description:
  grep CLEARTEXTPASSWORD keystone.log

  2015-06-16 06:44:39.770 20986 DEBUG keystone.common.controller [-]
  RBAC: Authorizing identity:create_user(user={u'domain_id': u'default',
  u'password': u'CLEARTEXTPASSWORD', u'enabled': True,
  u'default_project_id': u'0175b43419064ae38c4b74006baaeb8d', u'name':
  u'DermotJ'}) _build_policy_check_credentials /usr/lib/python2.7/site-
  packages/keystone/common/controller.py:57

  Issue code:
  https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L57

      LOG.debug('RBAC: Authorizing %(action)s(%(kwargs)s)', {
          'action': action,
          'kwargs': ', '.join(['%s=%s' % (k, kwargs[k]) for k in kwargs])})

  Shadow the values of sensitive fields like 'password' by some
  meaningless garbled text like "XXXXX" is one way to fix.

  Well, in addition to this, I think we should never pass the 'password'
  with its original value along the code and save it in any persistence,
  instead we should convert it to a strong hash value as early as
  possible. With the help of a good hash system, we never have to need
  the original value of the password, right?

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1465922/+subscriptions