Current Series Release Notes

13.0.1-26

New Features

• The new use_oslo_cache option has been added to the auth_token middleware and the external_oauth2_token middleware. When this option is set to True (it defaults to False), token cache data is stored to the cacke bachend managed by the oslo.cache library.

Deprecation Notes

• The following options have been deprecated.

  • [keystone_authtoken] memcache_security_strategy, in favor of [keystone_authtoken] cache_security_strategy.

  • [keystone_authtoken] memcache_secret_key, in favor of [keystone_authtoken] cache_secret_key.

  • [ext_oauth2_auth] memcache_security_strategy, in favor of [ext_oauth2_auth] cache_security_strategy.

  • [ext_oauth2_auth] memcache_secret_key, in favor of [ext_oauth2_auth] cache_secret_key.

Security Issues

• [bug 2162748] auth_token middleware no longer treats the mere presence of an X-Service-Token header as sufficient to skip application credential access_rules checks or token binding (enforce_token_bind, including Kerberos). Both paths now require the service token to also be valid (service_token_valid). Previously an arbitrary X-Service-Token value could bypass access_rules and, when delay_auth_decision was enabled, skip Kerberos (or other) binding so a stolen bound user token would be marked Confirmed without a Negotiate session.

Bug Fixes

• When encountering a corrupted token from the cache, the previous behavior was to log the event as an error. However, this situation is expected and correctly handled in some scenarios. This commit changes the log level to ‘info’ to keep operators aware without treating it as an environment error that affects production.

Other Notes

• Using [keystone_authtoken] memcache_use_advanced_pool = False has been formally undeprecated, because eventlet is being removed from OpenStack globally.