Open Stack

We are amped to announce the release of:

keystone 14.2.0: OpenStack Identity

This release is part of the rocky stable release series.

The source is available from:

    https://opendev.org/openstack/keystone

Download the package from:

    https://tarballs.openstack.org/keystone/

Please report issues through:

    https://bugs.launchpad.net/keystone/+bugs

For more details, please see below.

14.2.0
^^^^^^

Bug Fixes

* [bug 1773967 (https://bugs.launchpad.net/keystone/+bug/1773967)]
  Fixes an issue where users who had role assignments only via a group
  membership and not via direct assignment could create but not use
  application credentials. It is important to note that federated
  users who only have role assignments via a mapped group membership
  still cannot create application credentials.

* [bug 1782922 (https://bugs.launchpad.net/keystone/+bug/1782922)]
  Fixed the problem where Keystone indiscriminately return the first
  RDN as the user ID, regardless whether it matches the configured
  'user_id_attribute' or not. This will break deployments where
  'group_members_are_ids' are set to False and 'user_id_attribute' is
  not in the DN. This patch will perform a lookup by DN if the first
  RND does not match the configured 'user_id_attribute'.

* [bug 1801873 (https://bugs.launchpad.net/keystone/+bug/1801873)]
  This fixes an issue where an LDAP-backed domain could not be deleted
  due to the existence of shadow users in the SQL database.

* [bug 1840291 (https://bugs.launchpad.net/keystone/+bug/1840291)]
  Adds retries for "delete_credential_for_user" method to avoid
  DBDeadlocks when deleting large number of credentials concurrently.

* [*bug 1843609 <https://bugs.launchpad.net/keystone/+bug/1843609>*]
  Fixed an issue where system-scoped tokens couldn't be used to list
  users and groups (e.g., GET /v3/users or GET /v3/groups) if
  "keystone.conf [identity] domain_specific_drivers_enabled=True" and
  the API would return an "HTTP 401 Unauthorized". These APIs now
  recognize system-scoped tokens when using domain-specific drivers.

* [bug 1856881 (https://bugs.launchpad.net/keystone/+bug/1856881)]
  "keystone-manage bootstrap" can be run in upgrade scenarios where
  pre-existing domain-specific roles exist named "admin", "member",
  and "reader".

* [Bug 1856904 (https://bugs.launchpad.net/keystone/+bug/1856904)]
  The initiator object for CADF notifications now will always contain
  the username for the user who initated the action. Previously, the
  initator object only contained the user_id, which lead to issues
  mapping to users when using LDAP-backed identity providers. This
  also helps the initiator object better conform to the OpenStack
  standard for CADF.

* [bug 1858012 (https://bugs.launchpad.net/keystone/+bug/1858012)]
  Fixes a bug in the /v3/role_assignments filtering where the
  *role.id* query parameter didn't properly filter role assignments by
  role in cases where there were multiple system role assignments.

Changes in keystone 14.1.0..14.2.0
----------------------------------

dbc64b48b Tell reno to ignore the kilo branch
a50a8973d Fix role_assignments role.id filter
46bfb91a0 Add the missing packages when install keystone
b33f71e21 Always have username in CADF initiator
2e4055e49 Ensure bootstrap handles multiple roles with the same name
417d2c0e6 Make system tokens work with domain-specific drivers
1403a9645 Add test case for expanding implied roles in system tokens
cf83fc105 Allows to use application credentials through group membership
2f7155065 Import LDAP job into project
a972b3a70 Fixing 404 URLs for Rocky
11b2665ef Update broken links to dogpile.cache docs
09547696f Add retry for DBDeadlock in credential delete
ada328786 Remove experimental openSUSE 42.3 job
d70f2a8b3 Updating mapping rule link
e0507d7ec Fix python3 compatibility on LDAP search DN from id
7b84e9fcf Fixing dn_to_id function for cases were id is not in the DN
c220cc450 Revert "Blacklist bandit 1.6.0"
00242bd19 Blacklist bandit 1.6.0
328d20077 OpenDev Migration Patch
b5af5c900 Delete shadow users when domain is deleted
1c013444f Remove message about circular role inferences
8a3b48ce7 Replace openstack.org git:// URLs with https://


Diffstat (except docs and test files)
-------------------------------------

.gitignore                                         |  2 +
.gitreview                                         |  2 +-
.zuul.yaml                                         | 33 +++++-----
keystone/assignment/core.py                        | 15 ++---
keystone/cmd/bootstrap.py                          |  8 +++
keystone/common/authorization.py                   |  4 +-
keystone/common/controller.py                      |  2 +
keystone/common/policies/base.py                   |  5 +-
.../097_drop_user_name_domainid_constraint.py      |  2 +-
.../104_drop_user_name_domainid_constraint.py      |  2 +-
keystone/credential/backends/sql.py                |  3 +
keystone/identity/backends/ldap/common.py          | 34 ++++++++++-
keystone/identity/backends/ldap/core.py            |  7 ++-
keystone/identity/backends/sql_model.py            |  2 +-
keystone/identity/core.py                          | 13 ++--
keystone/identity/shadow_backends/sql.py           | 12 ++++
keystone/models/token_model.py                     | 16 ++---
keystone/notifications.py                          | 20 +++++-
keystone/oauth1/core.py                            |  4 +-
.../keystone-dsvm-functional-v3-only/run.yaml      |  8 +--
playbooks/legacy/keystone-dsvm-functional/run.yaml |  6 +-
.../keystone-dsvm-grenade-multinode/run.yaml       | 10 +--
.../keystone-dsvm-py35-functional-v3-only/run.yaml |  8 +--
.../notes/bug-1773967-b59517a09e0e6141.yaml        |  9 +++
.../notes/bug-1782922-db822fda486ac773.yaml        | 10 +++
.../notes/bug-1801873-0eb9a5ec3e801190.yaml        |  6 ++
.../notes/bug-1840291-35af1ac7ba06e166.yaml        |  6 ++
.../notes/bug-1843609-8498b132222596b7.yaml        |  9 +++
.../notes/bug-1856881-277103af343187f1.yaml        |  7 +++
.../notes/bug-1856904-101af15bb48eb3ca.yaml        |  9 +++
.../notes/bug-1858012-584267ada7e33f2c.yaml        |  7 +++
reno.yaml                                          |  4 ++
tox.ini                                            |  4 +-
46 files changed, 478 insertions(+), 94 deletions(-)