We jubilantly announce the release of:
keystone 13.0.3: OpenStack Identity
This release is part of the queens stable release series.
The source is available from:
https://opendev.org/openstack/keystone
Download the package from:
https://tarballs.openstack.org/null/
Please report issues through:
https://bugs.launchpad.net/keystone/+bugs
For more details, please see below.
13.0.3 ^^^^^^
Bug Fixes
* [bug 1780503 (https://bugs.launchpad.net/keystone/+bug/1780503)] The notification wrapper now sets the initiator's id to the given user id. This fixes an issue where identity.authentication event would result in the initiator id being a random default UUID, rather than the user's id when said user would authenticate against keystone.
* [bug 1782922 (https://bugs.launchpad.net/keystone/+bug/1782922)] Fixed the problem where Keystone indiscriminately return the first RDN as the user ID, regardless whether it matches the configured 'user_id_attribute' or not. This will break deployments where 'group_members_are_ids' are set to False and 'user_id_attribute' is not in the DN. This patch will perform a lookup by DN if the first RND does not match the configured 'user_id_attribute'.
* [bug 1801873 (https://bugs.launchpad.net/keystone/+bug/1801873)] This fixes an issue where an LDAP-backed domain could not be deleted due to the existence of shadow users in the SQL database.
* [bug 1840291 (https://bugs.launchpad.net/keystone/+bug/1840291)] Adds retries for "delete_credential_for_user" method to avoid DBDeadlocks when deleting large number of credentials concurrently.
* [*bug 1843609 https://bugs.launchpad.net/keystone/+bug/1843609*] Fixed an issue where system-scoped tokens couldn't be used to list users and groups (e.g., GET /v3/users or GET /v3/groups) if "keystone.conf [identity] domain_specific_drivers_enabled=True" and the API would return an "HTTP 401 Unauthorized". These APIs now recognize system-scoped tokens when using domain-specific drivers.
Changes in keystone 13.0.2..13.0.3 ----------------------------------
65cb669e7 Make system tokens work with domain-specific drivers d57733f4e Add test case for expanding implied roles in system tokens a6a438c9f Import LDAP job into project 686d52930 Add retry for DBDeadlock in credential delete 79ed42ee6 Fix python3 compatibility on LDAP search DN from id 9d9451e13 Fixing dn_to_id function for cases were id is not in the DN 71f45f12c Remove experimental openSUSE 42.3 job a3a2d75ea Cap bandit c2f619b14 Blacklist bandit 1.6.0 e4c01229e OpenDev Migration Patch 86428a6c6 Delete shadow users when domain is deleted bb1b98b65 Replace openstack.org git:// URLs with https:// 0161ffadd Set initiator id as user_id for auth events a6703dff0 Remove publish-loci post job 34185638d Update the RDO installation guide to use port 5000
Diffstat (except docs and test files) -------------------------------------
.gitreview | 2 +- .zuul.yaml | 35 +++++++------- keystone/common/controller.py | 2 + keystone/credential/backends/sql.py | 3 ++ keystone/identity/backends/ldap/common.py | 34 +++++++++++-- keystone/identity/backends/ldap/core.py | 7 ++- keystone/identity/core.py | 13 ++--- keystone/identity/shadow_backends/sql.py | 12 +++++ keystone/notifications.py | 9 ++-- .../keystone-dsvm-functional-v3-only/run.yaml | 8 ++-- playbooks/legacy/keystone-dsvm-functional/run.yaml | 6 +-- .../keystone-dsvm-grenade-multinode/run.yaml | 10 ++-- .../keystone-dsvm-py35-functional-v3-only/run.yaml | 8 ++-- .../notes/bug-1780503-70ca1ba3f428dd41.yaml | 8 ++++ .../notes/bug-1782922-db822fda486ac773.yaml | 10 ++++ .../notes/bug-1801873-0eb9a5ec3e801190.yaml | 6 +++ .../notes/bug-1840291-35af1ac7ba06e166.yaml | 6 +++ .../notes/bug-1843609-8498b132222596b7.yaml | 9 ++++ setup.cfg | 2 +- 26 files changed, 295 insertions(+), 61 deletions(-)