keystonemiddleware — Rewrite pack

Client contract and Go rewrite — keystonemiddleware — branch stable/2026.2

Branch stable/2026.2 @ 3a8a835bb573 — repository https://opendev.org/openstack/keystonemiddleware — analysed on 2026-10-28 Service used for the proof: Keystone stable/2026.2 @ e6dc5ae079e6 (../reverse-spec-keystone/), in-process; oslo.context 6.5.0 (oslo-context:) for the reading of headers

This file has two purposes:

• state what keystonemiddleware requires from Keystone, so that OpenKeel Keystone is accepted by the Python services that remain;
• state what an equivalent Go middleware (for the OpenKeel services) must reproduce, so that the identity handed to the services stays the same.

1. Contents of _rewrite/

How it was produced: conformance_capture.py scenarios with the keystonemiddleware adapter.

• The same throw-away Keystone as for keystoneauth.
• auth_token in front of an "echo" application that returns the headers received.
• Ordinary users (member, service) are created through the API.

Result: 10/10 as expected.

2. Scenarios

3. What keystonemiddleware requires from Keystone

4. What a Go middleware for the OpenKeel services must reproduce

1. Remove every client-supplied identity header before validating (the list of keystonemiddleware/auth_token/_request.py:206-227), **including OpenStack-System-Scope** (see § 5).
2. Read X-Auth-Token, or X-Storage-Token for Swift, and X-Service-Token. Validate them through GET /v3/auth/tokens with the middleware's own token, OpenStack-Identity-Access-Rules: 1, and allow_expired=1 when a service token with the service role is present.
3. Cache the valid validations (TTL token_cache_time, 300 s), keyed by sha256(token), with optional HMAC or encryption. Never cache an invalid token. Document the revocation delay this implies, or make it configurable (0 = no cache).
4. Check expiry (unless allow_expired), access rules (same *, ** and {x} grammar), and optionally the bind.
5. Inject the headers of the table in 01 § 2, with the same names and formats: comma-separated roles, True/False, Confirmed/Invalid, the catalog as JSON with the v3 catalog normalised as _normalize_catalog does (keystonemiddleware/auth_token/_request.py).
6. On rejection: 401 with the same JSON body and WWW-Authenticate: Keystone uri="…". If Keystone is unavailable: 503 "The Keystone service is temporarily unavailable.". With delay_auth_decision: let the request through, marked Invalid.
7. Read the same [keystone_authtoken] options (01 § 3) so that deployment tools keep working.
8. Optionally: audit (CADF audit.http.request / audit.http.response), OAuth2 Bearer, and mTLS (x5t#S256 thumbprint).

Conformance: run the 10 scenarios against the Go middleware placed in front of the same echo application, with the same Keystone. Expected: the same statuses and the same headers, except § 5 where the Go version must not let the header through.

5. Security point found: OpenStack-System-Scope not removed

remove_auth_headers removes the X-* identity headers, but **not OpenStack-System-Scope**: _all_auth_headers does not list it (keystonemiddleware/auth_token/_request.py:206-227), although _set_auth_headers writes it for valid tokens (keystonemiddleware/auth_token/_request.py:158-164).

• With a valid token, the value is overwritten by the token's scope.
• With an invalid token and delay_auth_decision = true, the header sent by the client reaches the service (scenario 6, observed).

oslo.context builds system_scope from HTTP_OPENSTACK_SYSTEM_SCOPE (oslo-context:oslo_context/context.py:53). A service using delay_auth_decision that builds its context **without checking X-Identity-Status** would therefore see system_scope = all for an anonymous request.

• The impact is limited: X-Roles is removed, so rules like role:admin and system_scope:all fail.
• A rule based only on system_scope:all would pass.

[inferred: impact depends on each service; to report upstream.]

OpenKeel requirement: remove this header like the others.

6. Gaps

Source: reverse-spec-keystonemiddleware/07-rewrite-pack_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.