Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rgw: Keystone PKI token expiration is not enforced #4884

Merged
1 commit merged into from Jul 8, 2015
Merged

rgw: Keystone PKI token expiration is not enforced #4884

1 commit merged into from Jul 8, 2015

Commits on Jun 7, 2015

  1. rgw: always check if token is expired 

    Fixes: ceph#11367

Currently token expiration is only checked by the token cache. With PKI
tokens no expiration check is done after decoding the token. This causes
PKI tokens to be valid indefinitely. UUID tokens are validated by
keystone after cache miss so they are not affected by this bug.

This commit adds explicit token expiration check to
RGWSwift::validate_keystone_token()

Signed-off-by: Anton Aksola <anton.aksola@nebula.fi>
Reported-by: Riku Lehto <riku.lehto@nexetic.com>
(cherry picked from commit 2df0693)
    @theanalyst
    Anton Aksola authored and theanalyst committed Jun 7, 2015
    Copy the full SHA
    9dfef60 View commit details
    Browse the repository at this point in the history