Current Series Release Notes¶

5.17.0-16¶

Add a Session.close() method to keystoneauth1.session.Session for deterministic release of the underlying requests.Session and its pooled keep-alive connections. The session is only closed if keystoneauth1 created it itself; a requests.Session supplied via the session constructor argument is left untouched, as its ownership belongs to the caller. close() is idempotent and non-fatal: the session remains usable after being closed, establishing new connections as needed, and no re-authentication is required. Errors from the socket layer (OSError) or from requests raised while tearing down idle pooled connections are caught and discarded rather than propagated to the caller.

TOTP get_cache_id() omitted the passcode, so two plugins for the same user with different passcodes could collide in an auth cache and return another caller’s cached token or auth state.

SAML2 ECP could follow ACS Location redirects and POST consumer mismatch faults to URLs from SAML/XML without verifying the target host. A compromised federation endpoint could send federation session cookies to another host or trigger requests to arbitrary URLs.

[bug 2167094] The TOTP auth plugin now includes the passcode in get_cache_id() elements so different passcodes for the same user no longer share a cache key.

[bug 2167316] The SAML2 ECP auth hook now checks outbound URLs against the federation endpoint host. Consumer mismatch SOAP faults are sent only when responseConsumerURL shares the original request netloc, and ACS 302/303 redirects are followed only when Location points to the same host.