swiftkrbauth.git, branch master

Fix unit tests failing in RHEL

2014-01-21T18:07:52+00:00

RHEL 6.4 has Python 2.6 which do not contain certain assert
statements present in python 2.7

Change-Id: Ib3c46e5613c0f8270d280d58b5842ffb0a3ab3e2
Signed-off-by: Prashanth Pai 
Reviewed-on: http://review.gluster.org/6732
Reviewed-by: Chetan Risbud 
Reviewed-by: Luis Pabon 
Tested-by: Luis Pabon

Handle case in passive mode where Kerberos password has expired

2014-01-17T09:28:11+00:00

In RHEL IdM or Windows AD server, the administrator can expire user passwords
after certain period of time. On password expiry, running kinit will present
a prompt to enter the new passwod. This used to result in kinit subprocess
waiting indefinitely for user input and request never reaching completion.

This fix will kill kinit child process if it is taking too long to finish.

Change-Id: I129a420663c67debe3345448a172b54abc8179bc
Signed-off-by: Prashanth Pai 
Reviewed-on: http://review.gluster.org/6713
Tested-by: Chetan Risbud 
Reviewed-by: Chetan Risbud

Return X-Storage-Url in passive mode

2014-01-10T15:45:51+00:00

When auth_mode is set to 'passive', client can authenticate itself
using account, user and key. This enables swiftkerbauth to return
X-Storage-Url response header to client. X-Storage-Url contains
account name provided in the request.

This required a change in X-Storage-User header format from

X-Storage-User: user
            to
X-Storage-User: account:user

This makes swiftkerbauth(passive mode) handle_get_token APIs to be
more consistent with that of swauth and tempauth.

Change-Id: Ic1d1520bb8afbc80cca443d92d659436f2f7cd0e
Signed-off-by: Prashanth Pai 
Reviewed-on: http://review.gluster.org/6595
Reviewed-by: Chetan Risbud 
Tested-by: Chetan Risbud

Additional Parameters to create keytab file

2013-12-04T21:09:44+00:00

Minor changes to explicitly set keyversion number as 0 and
encryption method while creating keytab file on Windows AD server.
This has been noticed on different windows 2008 server that they set
different kvno by default. So just making sure it to be 0 as expected by
mod_auth_kerb.

Bug: N/A

Change-Id: Ic114e4964745abfe97fbfcd575b5205bd6aaf171
Signed-off-by: Chetan Risbud 
Reviewed-on: http://review.gluster.org/6370
Reviewed-by: Prashanth Pai 
Tested-by: Prashanth Pai 
Reviewed-by: Luis Pabon

Feature: Support client outside domain

2013-11-26T02:40:41+00:00

Until now, all clients had to be part of Kerberos domain as authentication
was done by mod_auth_kerb module of httpd by using Kerberos Ticket bundled
with the request.

To suport clients residing outside domain, we introduce a configurable option
called "auth_mode". When auth_mode is set to 'passive', a client residing
outside domain can authenticate itself by sending username(X-Auth-User) and
password(X-Auth-Key) as request headers. This information is gleaned from the
request and kinit is run against it. A successful kinit means the username
and password exists on the Kerberos server.

Change-Id: I1a165bd56bc3a425b00bcfdbf32150c14b5d9790
Signed-off-by: Prashanth Pai 
Reviewed-on: http://review.gluster.org/6296
Reviewed-by: Chetan Risbud 
Tested-by: Chetan Risbud 
Reviewed-by: Luis Pabon 
Tested-by: Luis Pabon

Modularize swift-auth CGI script, add unit tests

2013-11-18T00:34:11+00:00

- Moved most of swift-auth CGI script to kerbauth_utils.py
- Added unit tests for kerbauth_utils.py
- Made MEMCACHE_SERVERS, DEBUG_HEADERS, TOKEN_LIFE as
  configurable parameters

Change-Id: I2e9e9823e8aa99dc2cf41327c55428350c8768dc
Signed-off-by: Prashanth Pai 
Reviewed-on: http://review.gluster.org/6248
Tested-by: Chetan Risbud 
Reviewed-by: Chetan Risbud 
Reviewed-by: Luis Pabon 
Tested-by: Luis Pabon

Update to OpenStack Swift Havana

2013-11-06T15:09:29+00:00

To update to Havana, we needed to change the
return status of the unit tests to code 303
which means See Other

Change-Id: I068fddae6e3f0f9d77c2eebd54fba1f91dfeb025
Signed-off-by: Luis Pabon 
Reviewed-on: http://review.gluster.org/6227
Reviewed-by: Prashanth Pai 
Tested-by: Prashanth Pai

Add Windows AD documentation

2013-10-17T20:01:12+00:00

Added documentation to setup swiftkerbauth environment
with Windows Active Directory Server and Linux client

Change-Id: I18333428c633b23fd15afc8965266d546f0bb03b
Original-author: Chetan Risbud 
Signed-off-by: Prashanth Pai 
Reviewed-on: http://review.gluster.org/6041
Reviewed-by: Luis Pabon 
Tested-by: Luis Pabon

Add documentation

2013-10-16T22:49:12+00:00

The following guides were added:
* Setting up a RHEL 6.x IdM server with a Fedora 18 client
* Setting up and configuring swiftkerbauth
* Architecture of Swiftkerbauth

Change-Id: I50665e584ff9513b5a20d1eda546c73c93f14638
Signed-off-by: Prashanth Pai 
Reviewed-on: http://review.gluster.org/6040
Reviewed-by: Luis Pabon 
Tested-by: Luis Pabon

Add unit tests

2013-10-15T03:20:24+00:00

Change-Id: I7bbf74b66c26d0a964fa769bf9c46dd73bd03d73
Signed-off-by: Prashanth Pai 
Reviewed-on: http://review.gluster.org/6067
Reviewed-by: Luis Pabon 
Tested-by: Luis Pabon