CVE-2013-0282

@@ -161,6 +161,9 @@ def authenticate(self, context, credentials=None, ec2Credentials=None):
             user_id=user_ref['id'],
             tenant_id=tenant_ref['id'])
 
+        # Validate that the auth info is valid and nothing is disabled
+        token.validate_auth_info(self, context, user_ref, tenant_ref)
+
         # TODO(termie): optimize this call at some point and put it into the
         #               the return for metadata
         # fill out the roles in the metadata

@@ -86,43 +86,10 @@ def authenticate(self, context, auth=None):
                                                     metadata_ref,
                                                     expiry)
 
-        # If the user is disabled don't allow them to authenticate
-        if not user_ref.get('enabled', True):
-            msg = 'User is disabled: %s' % user_ref['id']
-            LOG.warning(msg)
-            raise exception.Unauthorized(msg)
-
-        # If the user's domain is disabled don't allow them to authenticate
-        # TODO(dolph): remove this check after default-domain migration
-        if user_ref.get('domain_id') is not None:
-            user_domain_ref = self.identity_api.get_domain(
-                context,
-                user_ref['domain_id'])
-            if user_domain_ref and not user_domain_ref.get('enabled', True):
-                msg = 'Domain is disabled: %s' % user_domain_ref['id']
-                LOG.warning(msg)
-                raise exception.Unauthorized(msg)
+        # FIXME(dolph): domains will not be validated, as we just removed them
+        core.validate_auth_info(self, context, user_ref, tenant_ref)
 
         if tenant_ref:
-            # If the project is disabled don't allow them to authenticate
-            if not tenant_ref.get('enabled', True):
-                msg = 'Tenant is disabled: %s' % tenant_ref['id']
-                LOG.warning(msg)
-                raise exception.Unauthorized(msg)
-
-            # If the project's domain is disabled don't allow them to
-            # authenticate
-            # TODO(dolph): remove this check after default-domain migration
-            if tenant_ref.get('domain_id') is not None:
-                project_domain_ref = self.identity_api.get_domain(
-                    context,
-                    tenant_ref['domain_id'])
-                if (project_domain_ref and
-                        not project_domain_ref.get('enabled', True)):
-                    msg = 'Domain is disabled: %s' % project_domain_ref['id']
-                    LOG.warning(msg)
-                    raise exception.Unauthorized(msg)
-
             catalog_ref = self.catalog_api.get_catalog(
                 context=context,
                 user_id=user_ref['id'],

@@ -20,6 +20,7 @@
 
 from keystone.common import cms
 from keystone.common import dependency
+from keystone.common import logging
 from keystone.common import manager
 from keystone import config
 from keystone import exception
@@ -28,6 +29,7 @@
 
 CONF = config.CONF
 config.register_int('expiration', group='token', default=86400)
+LOG = logging.getLogger(__name__)
 
 
 def unique_id(token_id):
@@ -55,6 +57,58 @@ def default_expire_time():
     return timeutils.utcnow() + expire_delta
 
 
+def validate_auth_info(self, context, user_ref, tenant_ref):
+    """Validate user and tenant auth info.
+
+    Validate the user and tenant auth into in order to ensure that user and
+    tenant information is valid and not disabled.
+
+    Consolidate the checks here to ensure consistency between token auth and
+    ec2 auth.
+
+    :params context: keystone's request context
+    :params user_ref: the authenticating user
+    :params tenant_ref: the scope of authorization, if any
+    :raises Unauthorized: if any of the user, user's domain, tenant or
+            tenant's domain are either disabled or otherwise invalid
+    """
+    # If the user is disabled don't allow them to authenticate
+    if not user_ref.get('enabled', True):
+        msg = 'User is disabled: %s' % user_ref['id']
+        LOG.warning(msg)
+        raise exception.Unauthorized(msg)
+
+    # If the user's domain is disabled don't allow them to authenticate
+    # TODO(dolph): remove this check after default-domain migration
+    if user_ref.get('domain_id') is not None:
+        user_domain_ref = self.identity_api.get_domain(
+            context,
+            user_ref['domain_id'])
+        if user_domain_ref and not user_domain_ref.get('enabled', True):
+            msg = 'Domain is disabled: %s' % user_domain_ref['id']
+            LOG.warning(msg)
+            raise exception.Unauthorized(msg)
+
+    if tenant_ref:
+        # If the project is disabled don't allow them to authenticate
+        if not tenant_ref.get('enabled', True):
+            msg = 'Tenant is disabled: %s' % tenant_ref['id']
+            LOG.warning(msg)
+            raise exception.Unauthorized(msg)
+
+        # If the project's domain is disabled don't allow them to authenticate
+        # TODO(dolph): remove this check after default-domain migration
+        if tenant_ref.get('domain_id') is not None:
+            project_domain_ref = self.identity_api.get_domain(
+                context,
+                tenant_ref['domain_id'])
+            if (project_domain_ref and
+                    not project_domain_ref.get('enabled', True)):
+                msg = 'Domain is disabled: %s' % project_domain_ref['id']
+                LOG.warning(msg)
+                raise exception.Unauthorized(msg)
+
+
 @dependency.provider('token_api')
 class Manager(manager.Manager):
     """Default pivot point for the Token backend.

@@ -75,6 +75,7 @@ Maru Newby <mnewby@internap.com>
 Michael Basnight <mbasnight@gmail.com>
 Michael Still <mikal@stillhq.com>
 Monty Taylor <mordred@inaugust.com>
+Nathanael Burton <nathanael.i.burton.work@gmail.com>
 Pádraig Brady <P@draigBrady.com>
 Paul Voccio <paul@substation9.com>
 Peng Yong <ppyy@pubyun.com>

@@ -43,12 +43,14 @@
 from keystone import policy
 from keystone import service
 from keystone import token
+from keystone.common import logging
 from keystone.common import manager
 from keystone.common import utils
 from keystone.common import wsgi
 
 
 CONF = config.CONF
+LOG = logging.getLogger(__name__)
 
 
 class Manager(manager.Manager):
@@ -112,9 +114,9 @@ def check_signature(self, creds_ref, credentials):
             credentials['host'] = hostname
             signature = signer.generate(credentials)
             if not utils.auth_str_equal(credentials.signature, signature):
-                raise exception.Unauthorized(message='Invalid EC2 signature.')
+                raise exception.Unauthorized()
         else:
-            raise exception.Unauthorized(message='EC2 signature not supplied.')
+            raise exception.Unauthorized()
 
     def authenticate(self, context, credentials=None,
                          ec2Credentials=None):
@@ -145,7 +147,7 @@ def authenticate(self, context, credentials=None,
             credentials = ec2Credentials
 
         if not 'access' in credentials:
-            raise exception.Unauthorized(message='EC2 signature not supplied.')
+            raise exception.Unauthorized()
 
         creds_ref = self._get_credentials(context,
                                           credentials['access'])
@@ -157,9 +159,19 @@ def authenticate(self, context, credentials=None,
         tenant_ref = self.identity_api.get_tenant(
                 context=context,
                 tenant_id=creds_ref['tenant_id'])
+        # If the tenant is disabled don't allow them to authenticate
+        if tenant_ref and not tenant_ref.get('enabled', True):
+            msg = 'Tenant %s is disabled' % tenant_ref['id']
+            LOG.warning(msg)
+            raise exception.Unauthorized()
         user_ref = self.identity_api.get_user(
                 context=context,
                 user_id=creds_ref['user_id'])
+        # If the user is disabled don't allow them to authenticate
+        if not user_ref.get('enabled', True):
+            msg = 'User %s is disabled' % user_ref['id']
+            LOG.warning(msg)
+            raise exception.Unauthorized()
         metadata_ref = self.identity_api.get_metadata(
             context=context,
             user_id=user_ref['id'],
@@ -170,7 +182,7 @@ def authenticate(self, context, credentials=None,
         # fill out the roles in the metadata
         roles = metadata_ref.get('roles', [])
         if not roles:
-            raise exception.Unauthorized(message='User not valid for tenant.')
+            raise exception.Unauthorized()
         roles_ref = [self.identity_api.get_role(context, role_id)
                      for role_id in roles]
 
@@ -275,7 +287,7 @@ def _get_credentials(self, context, credential_id):
         creds = self.ec2_api.get_credential(context,
                                             credential_id)
         if not creds:
-            raise exception.Unauthorized(message='EC2 access key not found.')
+            raise exception.Unauthorized()
         return creds
 
     def _assert_identity(self, context, user_id):

@@ -37,6 +37,7 @@
 import uuid
 
 from keystone import catalog
+from keystone.common import logging
 from keystone.common import manager
 from keystone.common import utils
 from keystone.common import wsgi
@@ -49,6 +50,7 @@
 
 
 CONF = config.CONF
+LOG = logging.getLogger(__name__)
 
 
 class Manager(manager.Manager):
@@ -117,9 +119,9 @@ def check_signature(self, creds_ref, credentials):
             credentials['host'] = hostname
             signature = signer.generate(credentials)
             if not utils.auth_str_equal(credentials.signature, signature):
-                raise exception.Unauthorized(message='Invalid EC2 signature.')
+                raise exception.Unauthorized()
         else:
-            raise exception.Unauthorized(message='EC2 signature not supplied.')
+            raise exception.Unauthorized()
 
     def authenticate(self, context, credentials=None, ec2Credentials=None):
         """Validate a signed EC2 request and provide a token.
@@ -149,7 +151,7 @@ def authenticate(self, context, credentials=None, ec2Credentials=None):
             credentials = ec2Credentials
 
         if not 'access' in credentials:
-            raise exception.Unauthorized(message='EC2 signature not supplied.')
+            raise exception.Unauthorized()
 
         creds_ref = self._get_credentials(context,
                                           credentials['access'])
@@ -161,9 +163,19 @@ def authenticate(self, context, credentials=None, ec2Credentials=None):
         tenant_ref = self.identity_api.get_tenant(
             context=context,
             tenant_id=creds_ref['tenant_id'])
+        # If the tenant is disabled don't allow them to authenticate
+        if tenant_ref and not tenant_ref.get('enabled', True):
+            msg = 'Tenant %s is disabled' % tenant_ref['id']
+            LOG.warning(msg)
+            raise exception.Unauthorized()
         user_ref = self.identity_api.get_user(
             context=context,
             user_id=creds_ref['user_id'])
+        # If the user is disabled don't allow them to authenticate
+        if not user_ref.get('enabled', True):
+            msg = 'User %s is disabled' % user_ref['id']
+            LOG.warning(msg)
+            raise exception.Unauthorized()
         metadata_ref = self.identity_api.get_metadata(
             context=context,
             user_id=user_ref['id'],
@@ -174,7 +186,7 @@ def authenticate(self, context, credentials=None, ec2Credentials=None):
         # fill out the roles in the metadata
         roles = metadata_ref.get('roles', [])
         if not roles:
-            raise exception.Unauthorized(message='User not valid for tenant.')
+            raise exception.Unauthorized()
         roles_ref = [self.identity_api.get_role(context, role_id)
                      for role_id in roles]
 
@@ -279,7 +291,7 @@ def _get_credentials(self, context, credential_id):
         creds = self.ec2_api.get_credential(context,
                                             credential_id)
         if not creds:
-            raise exception.Unauthorized(message='EC2 access key not found.')
+            raise exception.Unauthorized()
         return creds
 
     def _assert_identity(self, context, user_id):