This branch does the final tear out of AuthManager from the main code. The NoAuth middlewares (active by default) allow a user to specify any user and project id through headers (os_api) or access key (ec2_api).

The plan is to leave the auth manager code in but mention that it is deprecated.  There is a sample paste config in ini to still allow old auth.  Immediately after the diablo release we can tear out all of the Auth related code and not support the deprecated auth anymore.

12 files changed, 119 insertions, 166 deletions

diff --git a/bin/nova-manage b/bin/nova-manage
index 1b29d7196..2e0bd0ecb 100755
--- a/bin/nova-manage
+++ b/bin/nova-manage
@@ -134,7 +134,7 @@ class VpnCommands(object):
             help='Project name')
     def list(self, project=None):
         """Print a listing of the VPN data for one or all projects."""
-
+        print "WARNING: This method only works with deprecated auth"
         print "%-12s\t" % 'project',
         print "%-20s\t" % 'ip:port',
         print "%-20s\t" % 'private_ip',
@@ -170,17 +170,22 @@ class VpnCommands(object):
 
     def spawn(self):
         """Run all VPNs."""
+        print "WARNING: This method only works with deprecated auth"
         for p in reversed(self.manager.get_projects()):
             if not self._vpn_for(p.id):
                 print 'spawning %s' % p.id
-                self.pipe.launch_vpn_instance(p.id)
+                self.pipe.launch_vpn_instance(p.id, p.project_manager_id)
                 time.sleep(10)
 
     @args('--project', dest="project_id", metavar='<Project name>',
             help='Project name')
-    def run(self, project_id):
-        """Start the VPN for a given project."""
-        self.pipe.launch_vpn_instance(project_id)
+    @args('--user', dest="user_id", metavar='<user name>', help='User name')
+    def run(self, project_id, user_id):
+        """Start the VPN for a given project and user."""
+        if not user_id:
+            print "WARNING: This method only works with deprecated auth"
+            user_id = self.manager.get_project(project_id).project_manager_id
+        self.pipe.launch_vpn_instance(project_id, user_id)
 
     @args('--project', dest="project_id", metavar='<Project name>',
             help='Project name')
@@ -195,10 +200,6 @@ class VpnCommands(object):
         """
         # TODO(tr3buchet): perhaps this shouldn't update all networks
         # associated with a project in the future
-        project = self.manager.get_project(project_id)
-        if not project:
-            print 'No project %s' % (project_id)
-            return
         admin_context = context.get_admin_context()
         networks = db.project_get_networks(admin_context, project_id)
         for network in networks:
diff --git a/etc/nova/api-paste.ini b/etc/nova/api-paste.ini
index b540509a2..dafdef877 100644
--- a/etc/nova/api-paste.ini
+++ b/etc/nova/api-paste.ini
@@ -19,7 +19,9 @@ use = egg:Paste#urlmap
 /1.0: ec2metadata
 
 [pipeline:ec2cloud]
-pipeline = logrequest authenticate cloudrequest authorizer ec2executor
+pipeline = logrequest ec2noauth cloudrequest authorizer ec2executor
+# NOTE(vish): use the following pipeline for deprecated auth
+#pipeline = logrequest authenticate cloudrequest authorizer ec2executor
 # NOTE(vish): use the following pipeline for keystone
 # pipeline = logrequest totoken authtoken keystonecontext cloudrequest authorizer ec2executor
 
@@ -41,6 +43,9 @@ paste.filter_factory = nova.api.ec2:Lockout.factory
 [filter:totoken]
 paste.filter_factory = nova.api.ec2:ToToken.factory
 
+[filter:ec2noauth]
+paste.filter_factory = nova.api.ec2:NoAuth.factory
+
 [filter:authenticate]
 paste.filter_factory = nova.api.ec2:Authenticate.factory
 
@@ -75,12 +80,16 @@ use = egg:Paste#urlmap
 /v1.1: openstackapi11
 
 [pipeline:openstackapi10]
-pipeline = faultwrap auth ratelimit osapiapp10
+pipeline = faultwrap noauth ratelimit osapiapp10
+# NOTE(vish): use the following pipeline for deprecated auth
+# pipeline = faultwrap auth ratelimit osapiapp10
 # NOTE(vish): use the following pipeline for keystone
 #pipeline = faultwrap authtoken keystonecontext ratelimit osapiapp10
 
 [pipeline:openstackapi11]
-pipeline = faultwrap auth ratelimit extensions osapiapp11
+pipeline = faultwrap noauth ratelimit extensions osapiapp11
+# NOTE(vish): use the following pipeline for deprecated auth
+# pipeline = faultwrap auth ratelimit extensions osapiapp11
 # NOTE(vish): use the following pipeline for keystone
 # pipeline = faultwrap authtoken keystonecontext ratelimit extensions osapiapp11
 
@@ -90,6 +99,9 @@ paste.filter_factory = nova.api.openstack:FaultWrapper.factory
 [filter:auth]
 paste.filter_factory = nova.api.openstack.auth:AuthMiddleware.factory
 
+[filter:noauth]
+paste.filter_factory = nova.api.openstack.auth:NoAuthMiddleware.factory
+
 [filter:ratelimit]
 paste.filter_factory = nova.api.openstack.limits:RateLimitingMiddleware.factory
 
diff --git a/nova/api/auth.py b/nova/api/auth.py
index cd3e3e8a0..cd0d38b3f 100644
--- a/nova/api/auth.py
+++ b/nova/api/auth.py
@@ -62,6 +62,7 @@ class KeystoneContext(wsgi.Middleware):
                                      req.headers.get('X_STORAGE_TOKEN'))
 
         # Build a context, including the auth_token...
+        remote_address = getattr(req, 'remote_address', '127.0.0.1')
         remote_address = req.remote_addr
         if FLAGS.use_forwarded_for:
             remote_address = req.headers.get('X-Forwarded-For', remote_address)
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 17969099d..5430f443d 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -183,6 +183,27 @@ class ToToken(wsgi.Middleware):
         return self.application
 
 
+class NoAuth(wsgi.Middleware):
+    """Add user:project as 'nova.context' to WSGI environ."""
+
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        if 'AWSAccessKeyId' not in req.params:
+            raise webob.exc.HTTPBadRequest()
+        user_id, _sep, project_id = req.params['AWSAccessKeyId'].partition(':')
+        project_id = project_id or user_id
+        remote_address = getattr(req, 'remote_address', '127.0.0.1')
+        if FLAGS.use_forwarded_for:
+            remote_address = req.headers.get('X-Forwarded-For', remote_address)
+        ctx = context.RequestContext(user_id,
+                                     project_id,
+                                     is_admin=True,
+                                     remote_address=remote_address)
+
+        req.environ['nova.context'] = ctx
+        return self.application
+
+
 class Authenticate(wsgi.Middleware):
     """Authenticate an EC2 request and add 'nova.context' to WSGI environ."""
 
diff --git a/nova/api/ec2/admin.py b/nova/api/ec2/admin.py
index df7876b9d..dfbbc0a2b 100644
--- a/nova/api/ec2/admin.py
+++ b/nova/api/ec2/admin.py
@@ -283,8 +283,10 @@ class AdminController(object):
             # NOTE(vish) import delayed because of __init__.py
             from nova.cloudpipe import pipelib
             pipe = pipelib.CloudPipe()
+            proj = manager.AuthManager().get_project(project)
+            user_id = proj.project_manager_id
             try:
-                pipe.launch_vpn_instance(project)
+                pipe.launch_vpn_instance(project, user_id)
             except db.NoMoreNetworks:
                 raise exception.ApiError("Unable to claim IP for VPN instance"
                                          ", ensure it isn't running, and try "
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index b6ff1126b..6754fea27 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -33,6 +33,46 @@ from nova.api.openstack import faults
 
 LOG = logging.getLogger('nova.api.openstack')
 FLAGS = flags.FLAGS
+flags.DECLARE('use_forwarded_for', 'nova.api.auth')
+
+
+class NoAuthMiddleware(wsgi.Middleware):
+    """Return a fake token if one isn't specified."""
+
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        if 'X-Auth-Token' not in req.headers:
+            os_url = req.url
+            version = common.get_version_from_href(os_url)
+            user_id = req.headers.get('X-Auth-User', 'admin')
+            project_id = req.headers.get('X-Auth-Project-Id', 'admin')
+            if version == '1.1':
+                os_url += '/' + project_id
+            res = webob.Response()
+            # NOTE(vish): This is expecting and returning Auth(1.1), whereas
+            #             keystone uses 2.0 auth.  We should probably allow
+            #             2.0 auth here as well.
+            res.headers['X-Auth-Token'] = '%s:%s' % (user_id, project_id)
+            res.headers['X-Server-Management-Url'] = os_url
+            res.headers['X-Storage-Url'] = ''
+            res.headers['X-CDN-Management-Url'] = ''
+            res.content_type = 'text/plain'
+            res.status = '204'
+            return res
+
+        token = req.headers['X-Auth-Token']
+        user_id, _sep, project_id = token.partition(':')
+        project_id = project_id or user_id
+        remote_address = getattr(req, 'remote_address', '127.0.0.1')
+        if FLAGS.use_forwarded_for:
+            remote_address = req.headers.get('X-Forwarded-For', remote_address)
+        ctx = context.RequestContext(user_id,
+                                     project_id,
+                                     is_admin=True,
+                                     remote_address=remote_address)
+
+        req.environ['nova.context'] = ctx
+        return self.application
 
 
 class AuthMiddleware(wsgi.Middleware):
@@ -85,9 +125,15 @@ class AuthMiddleware(wsgi.Middleware):
                 project_id = projects[0].id
 
         is_admin = self.auth.is_admin(user_id)
-        req.environ['nova.context'] = context.RequestContext(user_id,
-                                                             project_id,
-                                                             is_admin)
+        remote_address = getattr(req, 'remote_address', '127.0.0.1')
+        if FLAGS.use_forwarded_for:
+            remote_address = req.headers.get('X-Forwarded-For', remote_address)
+        ctx = context.RequestContext(user_id,
+                                     project_id,
+                                     is_admin=is_admin,
+                                     remote_address=remote_address)
+        req.environ['nova.context'] = ctx
+
         if not is_admin and not self.auth.is_project_member(user_id,
                                                             project_id):
             msg = _("%(user_id)s must be an admin or a "
diff --git a/nova/auth/manager.py b/nova/auth/manager.py
index 6205cfb56..85227bea0 100644
--- a/nova/auth/manager.py
+++ b/nova/auth/manager.py
@@ -17,6 +17,9 @@
 #    under the License.
 
 """
+WARNING: This code is deprecated and will be removed.
+Keystone is the recommended solution for auth management.
+
 Nova authentication management
 """
 
diff --git a/nova/cloudpipe/pipelib.py b/nova/cloudpipe/pipelib.py
index 2c4673f9e..3eb372844 100644
--- a/nova/cloudpipe/pipelib.py
+++ b/nova/cloudpipe/pipelib.py
@@ -34,7 +34,6 @@ from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import utils
-from nova.auth import manager
 # TODO(eday): Eventually changes these to something not ec2-specific
 from nova.api.ec2 import cloud
 
@@ -57,7 +56,6 @@ LOG = logging.getLogger('nova.cloudpipe')
 class CloudPipe(object):
     def __init__(self):
         self.controller = cloud.CloudController()
-        self.manager = manager.AuthManager()
 
     def get_encoded_zip(self, project_id):
         # Make a payload.zip
@@ -93,11 +91,10 @@ class CloudPipe(object):
         zippy.close()
         return encoded
 
-    def launch_vpn_instance(self, project_id):
+    def launch_vpn_instance(self, project_id, user_id):
         LOG.debug(_("Launching VPN for %s") % (project_id))
-        project = self.manager.get_project(project_id)
-        ctxt = context.RequestContext(user=project.project_manager_id,
-                                      project=project.id)
+        ctxt = context.RequestContext(user_id=user_id,
+                                      project_id=project_id)
         key_name = self.setup_key_pair(ctxt)
         group_name = self.setup_security_group(ctxt)
 
diff --git a/nova/tests/api/openstack/test_server_actions.py b/nova/tests/api/openstack/test_server_actions.py
index 90fe2f0b3..bdd6824e7 100644
--- a/nova/tests/api/openstack/test_server_actions.py
+++ b/nova/tests/api/openstack/test_server_actions.py
@@ -1,17 +1,13 @@
 import base64
 import json
-import unittest
-from xml.dom import minidom
 
 import stubout
 import webob
 
 from nova import context
-from nova import db
 from nova import utils
 from nova import flags
 from nova.api.openstack import create_instance_helper
-from nova.compute import instance_types
 from nova.compute import power_state
 import nova.db.api
 from nova import test
@@ -103,8 +99,6 @@ class ServerActionsTest(test.TestCase):
         super(ServerActionsTest, self).setUp()
         self.flags(verbose=True)
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_auth(self.stubs)
         self.stubs.Set(nova.db.api, 'instance_get', return_server_by_id)
         self.stubs.Set(nova.db.api, 'instance_update', instance_update)
@@ -468,8 +462,6 @@ class ServerActionsTestV11(test.TestCase):
         self.maxDiff = None
         super(ServerActionsTestV11, self).setUp()
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_auth(self.stubs)
         self.stubs.Set(nova.db.api, 'instance_get', return_server_by_id)
         self.stubs.Set(nova.db.api, 'instance_update', instance_update)
diff --git a/nova/tests/integrated/integrated_helpers.py b/nova/tests/integrated/integrated_helpers.py
index fb2f88502..343190427 100644
--- a/nova/tests/integrated/integrated_helpers.py
+++ b/nova/tests/integrated/integrated_helpers.py
@@ -22,10 +22,8 @@ Provides common functionality for integrated unit tests
 import random
 import string
 
-from nova import exception
 from nova import service
 from nova import test  # For the flags
-from nova.auth import manager
 import nova.image.glance
 from nova.log import logging
 from nova.tests.integrated.api import client
@@ -58,90 +56,6 @@ def generate_new_element(items, prefix, numeric=False):
         LOG.debug("Random collision on %s" % candidate)
 
 
-class TestUser(object):
-    def __init__(self, name, secret, auth_url):
-        self.name = name
-        self.secret = secret
-        self.auth_url = auth_url
-
-        if not auth_url:
-            raise exception.Error("auth_url is required")
-        self.openstack_api = client.TestOpenStackClient(self.name,
-                                                        self.secret,
-                                                        self.auth_url)
-
-    def get_unused_server_name(self):
-        servers = self.openstack_api.get_servers()
-        server_names = [server['name'] for server in servers]
-        return generate_new_element(server_names, 'server')
-
-    def get_invalid_image(self):
-        images = self.openstack_api.get_images()
-        image_ids = [image['id'] for image in images]
-        return generate_new_element(image_ids, '', numeric=True)
-
-    def get_valid_image(self, create=False):
-        images = self.openstack_api.get_images()
-        if create and not images:
-            # TODO(justinsb): No way currently to create an image through API
-            #created_image = self.openstack_api.post_image(image)
-            #images.append(created_image)
-            raise exception.Error("No way to create an image through API")
-
-        if images:
-            return images[0]
-        return None
-
-
-class IntegratedUnitTestContext(object):
-    def __init__(self, auth_url):
-        self.auth_manager = manager.AuthManager()
-
-        self.auth_url = auth_url
-        self.project_name = None
-
-        self.test_user = None
-
-        self.setup()
-
-    def setup(self):
-        self._create_test_user()
-
-    def _create_test_user(self):
-        self.test_user = self._create_unittest_user()
-
-        # No way to currently pass this through the OpenStack API
-        self.project_name = 'openstack'
-        self._configure_project(self.project_name, self.test_user)
-
-    def cleanup(self):
-        self.test_user = None
-
-    def _create_unittest_user(self):
-        users = self.auth_manager.get_users()
-        user_names = [user.name for user in users]
-        auth_name = generate_new_element(user_names, 'unittest_user_')
-        auth_key = generate_random_alphanumeric(16)
-
-        # Right now there's a bug where auth_name and auth_key are reversed
-        # bug732907
-        auth_key = auth_name
-
-        self.auth_manager.create_user(auth_name, auth_name, auth_key, False)
-        return TestUser(auth_name, auth_key, self.auth_url)
-
-    def _configure_project(self, project_name, user):
-        projects = self.auth_manager.get_projects()
-        project_names = [project.name for project in projects]
-        if not project_name in project_names:
-            project = self.auth_manager.create_project(project_name,
-                                                       user.name,
-                                                       description=None,
-                                                       member_users=None)
-        else:
-            self.auth_manager.add_to_project(user.name, project_name)
-
-
 class _IntegratedTestBase(test.TestCase):
     def setUp(self):
         super(_IntegratedTestBase, self).setUp()
@@ -163,10 +77,7 @@ class _IntegratedTestBase(test.TestCase):
 
         self._start_api_service()
 
-        self.context = IntegratedUnitTestContext(self.auth_url)
-
-        self.user = self.context.test_user
-        self.api = self.user.openstack_api
+        self.api = client.TestOpenStackClient('fake', 'fake', self.auth_url)
 
     def _start_api_service(self):
         osapi = service.WSGIService("osapi")
@@ -174,10 +85,6 @@ class _IntegratedTestBase(test.TestCase):
         self.auth_url = 'http://%s:%s/v1.1' % (osapi.host, osapi.port)
         LOG.warn(self.auth_url)
 
-    def tearDown(self):
-        self.context.cleanup()
-        super(_IntegratedTestBase, self).tearDown()
-
     def _get_flags(self):
         """An opportunity to setup flags, before the services are started."""
         f = {}
@@ -190,10 +97,20 @@ class _IntegratedTestBase(test.TestCase):
         f['fake_network'] = True
         return f
 
+    def get_unused_server_name(self):
+        servers = self.api.get_servers()
+        server_names = [server['name'] for server in servers]
+        return generate_new_element(server_names, 'server')
+
+    def get_invalid_image(self):
+        images = self.api.get_images()
+        image_ids = [image['id'] for image in images]
+        return generate_new_element(image_ids, '', numeric=True)
+
     def _build_minimal_create_server_request(self):
         server = {}
 
-        image = self.user.get_valid_image(create=True)
+        image = self.api.get_images()[0]
         LOG.debug("Image: %s" % image)
 
         if 'imageRef' in image:
@@ -211,7 +128,7 @@ class _IntegratedTestBase(test.TestCase):
         server['flavorRef'] = 'http://fake.server/%s' % flavor['id']
 
         # Set a valid server name
-        server_name = self.user.get_unused_server_name()
+        server_name = self.get_unused_server_name()
         server['name'] = server_name
 
         return server
diff --git a/nova/tests/integrated/test_login.py b/nova/tests/integrated/test_login.py
index 9d1925bc0..3a863d0f9 100644
--- a/nova/tests/integrated/test_login.py
+++ b/nova/tests/integrated/test_login.py
@@ -15,11 +15,9 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import unittest
 
 from nova.log import logging
 from nova.tests.integrated import integrated_helpers
-from nova.tests.integrated.api import client
 
 
 LOG = logging.getLogger('nova.tests.integrated')
@@ -31,40 +29,3 @@ class LoginTest(integrated_helpers._IntegratedTestBase):
         flavors = self.api.get_flavors()
         for flavor in flavors:
             LOG.debug(_("flavor: %s") % flavor)
-
-    def test_bad_login_password(self):
-        """Test that I get a 401 with a bad username."""
-        bad_credentials_api = client.TestOpenStackClient(self.user.name,
-                                                         "notso_password",
-                                                         self.user.auth_url)
-
-        self.assertRaises(client.OpenStackApiAuthenticationException,
-                          bad_credentials_api.get_flavors)
-
-    def test_bad_login_username(self):
-        """Test that I get a 401 with a bad password."""
-        bad_credentials_api = client.TestOpenStackClient("notso_username",
-                                                         self.user.secret,
-                                                         self.user.auth_url)
-
-        self.assertRaises(client.OpenStackApiAuthenticationException,
-                          bad_credentials_api.get_flavors)
-
-    def test_bad_login_both_bad(self):
-        """Test that I get a 401 with both bad username and bad password."""
-        bad_credentials_api = client.TestOpenStackClient("notso_username",
-                                                         "notso_password",
-                                                         self.user.auth_url)
-
-        self.assertRaises(client.OpenStackApiAuthenticationException,
-                          bad_credentials_api.get_flavors)
-
-    def test_good_login_bad_project(self):
-        """Test that I get a 401 with valid user/pass but bad project"""
-        self.api.project_id = 'openstackBAD'
-
-        self.assertRaises(client.OpenStackApiAuthorizationException,
-                          self.api.get_flavors)
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/nova/tests/integrated/test_servers.py b/nova/tests/integrated/test_servers.py
index 725f6d529..c2f800689 100644
--- a/nova/tests/integrated/test_servers.py
+++ b/nova/tests/integrated/test_servers.py
@@ -51,7 +51,7 @@ class ServersTest(integrated_helpers._IntegratedTestBase):
                           self.api.post_server, post)
 
         # With an invalid imageRef, this throws 500.
-        server['imageRef'] = self.user.get_invalid_image()
+        server['imageRef'] = self.get_invalid_image()
         # TODO(justinsb): Check whatever the spec says should be thrown here
         self.assertRaises(client.OpenStackApiException,
                           self.api.post_server, post)