Note de la release actuelle¶

13.0.1-26¶

The new use_oslo_cache option has been added to the auth_token middleware and the external_oauth2_token middleware. When this option is set to True (it defaults to False), token cache data is stored to the cacke bachend managed by the oslo.cache library.

The following options have been deprecated.
- [keystone_authtoken] memcache_security_strategy, in favor of [keystone_authtoken] cache_security_strategy.
- [keystone_authtoken] memcache_secret_key, in favor of [keystone_authtoken] cache_secret_key.
- [ext_oauth2_auth] memcache_security_strategy, in favor of [ext_oauth2_auth] cache_security_strategy.
- [ext_oauth2_auth] memcache_secret_key, in favor of [ext_oauth2_auth] cache_secret_key.

[bug 2162748] auth_token middleware no longer treats the mere presence of an X-Service-Token header as sufficient to skip application credential access_rules checks or token binding (enforce_token_bind, including Kerberos). Both paths now require the service token to also be valid (service_token_valid). Previously an arbitrary X-Service-Token value could bypass access_rules and, when delay_auth_decision was enabled, skip Kerberos (or other) binding so a stolen bound user token would be marked Confirmed without a Negotiate session.

When encountering a corrupted token from the cache, the previous behavior was to log the event as an error. However, this situation is expected and correctly handled in some scenarios. This commit changes the log level to “info” to keep operators aware without treating it as an environment error that affects production.

Using [keystone_authtoken] memcache_use_advanced_pool = False has been formally undeprecated, because eventlet is being removed from OpenStack globally.