change NoAuth to actually use a tenant and user

4 files changed, 67 insertions, 37 deletions

diff --git a/etc/nova/api-paste.ini b/etc/nova/api-paste.ini
index a9ae0abf6..dafdef877 100644
--- a/etc/nova/api-paste.ini
+++ b/etc/nova/api-paste.ini
@@ -19,7 +19,7 @@ use = egg:Paste#urlmap
 /1.0: ec2metadata
 
 [pipeline:ec2cloud]
-pipeline = logrequest admincontext cloudrequest authorizer ec2executor
+pipeline = logrequest ec2noauth cloudrequest authorizer ec2executor
 # NOTE(vish): use the following pipeline for deprecated auth
 #pipeline = logrequest authenticate cloudrequest authorizer ec2executor
 # NOTE(vish): use the following pipeline for keystone
@@ -43,6 +43,9 @@ paste.filter_factory = nova.api.ec2:Lockout.factory
 [filter:totoken]
 paste.filter_factory = nova.api.ec2:ToToken.factory
 
+[filter:ec2noauth]
+paste.filter_factory = nova.api.ec2:NoAuth.factory
+
 [filter:authenticate]
 paste.filter_factory = nova.api.ec2:Authenticate.factory
 
@@ -77,14 +80,14 @@ use = egg:Paste#urlmap
 /v1.1: openstackapi11
 
 [pipeline:openstackapi10]
-pipeline = faultwrap noauth admincontext ratelimit osapiapp10
+pipeline = faultwrap noauth ratelimit osapiapp10
 # NOTE(vish): use the following pipeline for deprecated auth
 # pipeline = faultwrap auth ratelimit osapiapp10
 # NOTE(vish): use the following pipeline for keystone
 #pipeline = faultwrap authtoken keystonecontext ratelimit osapiapp10
 
 [pipeline:openstackapi11]
-pipeline = faultwrap noauth admincontext ratelimit extensions osapiapp11
+pipeline = faultwrap noauth ratelimit extensions osapiapp11
 # NOTE(vish): use the following pipeline for deprecated auth
 # pipeline = faultwrap auth ratelimit extensions osapiapp11
 # NOTE(vish): use the following pipeline for keystone
@@ -121,9 +124,6 @@ paste.app_factory = nova.api.openstack.versions:Versions.factory
 # Shared #
 ##########
 
-[filter:admincontext]
-paste.filter_factory = nova.api.auth:AdminContext.factory
-
 [filter:keystonecontext]
 paste.filter_factory = nova.api.auth:KeystoneContext.factory
 
diff --git a/nova/api/auth.py b/nova/api/auth.py
index 050216fd7..cd0d38b3f 100644
--- a/nova/api/auth.py
+++ b/nova/api/auth.py
@@ -45,24 +45,6 @@ class InjectContext(wsgi.Middleware):
         return self.application
 
 
-class AdminContext(wsgi.Middleware):
-    """Return an admin context no matter what"""
-
-    @webob.dec.wsgify(RequestClass=wsgi.Request)
-    def __call__(self, req):
-        # Build a context, including the auth_token...
-        remote_address = req.remote_addr
-        if FLAGS.use_forwarded_for:
-            remote_address = req.headers.get('X-Forwarded-For', remote_address)
-        ctx = context.RequestContext('admin',
-                                     'admin',
-                                     is_admin=True,
-                                     remote_address=remote_address)
-
-        req.environ['nova.context'] = ctx
-        return self.application
-
-
 class KeystoneContext(wsgi.Middleware):
     """Make a request context from keystone headers"""
 
@@ -80,6 +62,7 @@ class KeystoneContext(wsgi.Middleware):
                                      req.headers.get('X_STORAGE_TOKEN'))
 
         # Build a context, including the auth_token...
+        remote_address = getattr(req, 'remote_address', '127.0.0.1')
         remote_address = req.remote_addr
         if FLAGS.use_forwarded_for:
             remote_address = req.headers.get('X-Forwarded-For', remote_address)
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 17969099d..5430f443d 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -183,6 +183,27 @@ class ToToken(wsgi.Middleware):
         return self.application
 
 
+class NoAuth(wsgi.Middleware):
+    """Add user:project as 'nova.context' to WSGI environ."""
+
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        if 'AWSAccessKeyId' not in req.params:
+            raise webob.exc.HTTPBadRequest()
+        user_id, _sep, project_id = req.params['AWSAccessKeyId'].partition(':')
+        project_id = project_id or user_id
+        remote_address = getattr(req, 'remote_address', '127.0.0.1')
+        if FLAGS.use_forwarded_for:
+            remote_address = req.headers.get('X-Forwarded-For', remote_address)
+        ctx = context.RequestContext(user_id,
+                                     project_id,
+                                     is_admin=True,
+                                     remote_address=remote_address)
+
+        req.environ['nova.context'] = ctx
+        return self.application
+
+
 class Authenticate(wsgi.Middleware):
     """Authenticate an EC2 request and add 'nova.context' to WSGI environ."""
 
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index 0d9c7562a..f2dc89094 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -33,6 +33,7 @@ from nova.api.openstack import faults
 
 LOG = logging.getLogger('nova.api.openstack')
 FLAGS = flags.FLAGS
+flags.DECLARE('use_forwarded_for', 'nova.api.auth')
 
 
 class NoAuthMiddleware(wsgi.Middleware):
@@ -40,17 +41,36 @@ class NoAuthMiddleware(wsgi.Middleware):
 
     @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
-        if 'X-Auth-Token' in req.headers:
+        if 'X-Auth-Token' not in req.headers:
+            os_url = req.url
+            version = common.get_version_from_href(os_url)
+            user_id = req.headers.get('X-Auth-User', 'admin')
+            project_id = req.headers.get('X-Auth-Project-Id', 'admin')
+            if version == '1.1':
+                os_url += '/' + project_id
+            res = webob.Response()
+            res.headers['X-Auth-Token'] = '%s:%s' % (user_id, project_id)
+            res.headers['X-Server-Management-Url'] = os_url
+            res.headers['X-Storage-Url'] = ''
+            res.headers['X-CDN-Management-Url'] = ''
+            res.content_type = 'text/plain'
+            res.status = '204'
+            return res
+        else:
+            token = req.headers['X-Auth-Token']
+            user_id, _sep, project_id = token.partition(':')
+            project_id = project_id or user_id
+            remote_address = getattr(req, 'remote_address', '127.0.0.1')
+            if FLAGS.use_forwarded_for:
+                remote_address = req.headers.get('X-Forwarded-For',
+                                                 remote_address)
+            ctx = context.RequestContext(user_id,
+                                         project_id,
+                                         is_admin=True,
+                                         remote_address=remote_address)
+
+            req.environ['nova.context'] = ctx
             return self.application
-        logging.debug("Got no auth token, returning fake info.")
-        res = webob.Response()
-        res.headers['X-Auth-Token'] = 'fake'
-        res.headers['X-Server-Management-Url'] = req.url
-        res.headers['X-Storage-Url'] = ''
-        res.headers['X-CDN-Management-Url'] = ''
-        res.content_type = 'text/plain'
-        res.status = '204'
-        return res
 
 
 class AuthMiddleware(wsgi.Middleware):
@@ -103,9 +123,15 @@ class AuthMiddleware(wsgi.Middleware):
                 project_id = projects[0].id
 
         is_admin = self.auth.is_admin(user_id)
-        req.environ['nova.context'] = context.RequestContext(user_id,
-                                                             project_id,
-                                                             is_admin)
+        remote_address = getattr(req, 'remote_address', '127.0.0.1')
+        if FLAGS.use_forwarded_for:
+            remote_address = req.headers.get('X-Forwarded-For', remote_address)
+        ctx = context.RequestContext(user_id,
+                                     project_id,
+                                     is_admin=is_admin,
+                                     remote_address=remote_address)
+        req.environ['nova.context'] = ctx
+
         if not is_admin and not self.auth.is_project_member(user_id,
                                                             project_id):
             msg = _("%(user_id)s must be an admin or a "