Loading...

Type: Bug
Resolution: Duplicate
Priority: Undefined
Fix Version/s: None
Affects Version/s: rhos-18.0.15
Component/s: barbican-operator, openstack-barbican
Labels:
None

Story Points:
0
Epic Link:
[BugEpic]: Special characters in BarbicanPassword may block application startup
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Ready:
False
Docs Approval:
?
AssignedTeam:
rhos-ops-platform-services-security
Regression:
None
Intelligence Requested:
Market:
PX Impact Score:

Severity:
Important

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

To Reproduce Steps to reproduce the behavior:
Customer set BarbicanPassword to

c^sometext02%text%text02$someText&

and barbican-api pods were stuck in CrashLoopBackOff state because of the following error in barbican's httpd logs:

[Fri Feb 06 10:25:21.356442 2026] [wsgi:info] [pid 11:tid 63] [remote 192.168.0.1:55730] mod_wsgi (pid=11, process='internal', application=''): Loading Python script file '/var/www/cgi-bin/barbican/main'.
[Fri Feb 06 10:25:22.919679 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] mod_wsgi (pid=11): Failed to exec Python script file '/var/www/cgi-bin/barbican/main'.
[Fri Feb 06 10:25:22.919723 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] mod_wsgi (pid=11): Exception occurred processing WSGI script '/var/www/cgi-bin/barbican/main'.
[Fri Feb 06 10:25:22.921143 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] Traceback (most recent call last):
[Fri Feb 06 10:25:22.921167 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/keystonemiddleware/_common/config.py", line 111, in get
[Fri Feb 06 10:25:22.921170 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return self.paste_overrides[name]
[Fri Feb 06 10:25:22.921183 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] KeyError: 'password'
[Fri Feb 06 10:25:22.921189 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]
[Fri Feb 06 10:25:22.921191 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] During handling of the above exception, another exception occurred:
[Fri Feb 06 10:25:22.921193 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]
[Fri Feb 06 10:25:22.921195 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] Traceback (most recent call last):
[Fri Feb 06 10:25:22.921209 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 3247, in __getitem__
[Fri Feb 06 10:25:22.921212 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     value = self.conf._get(option, group=group,
[Fri Feb 06 10:25:22.921214 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2653, in _get
[Fri Feb 06 10:25:22.921216 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     value, loc = self._do_get(name, group, namespace)
[Fri Feb 06 10:25:22.921219 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2671, in _do_get
[Fri Feb 06 10:25:22.921221 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     info = self._get_opt_info(name, group)
[Fri Feb 06 10:25:22.921224 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2876, in _get_opt_info
[Fri Feb 06 10:25:22.921226 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     raise NoSuchOptError(opt_name, group)
[Fri Feb 06 10:25:22.921233 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] oslo_config.cfg.NoSuchOptError: no such option someText in group [keystone_authtoken]
[Fri Feb 06 10:25:22.921236 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]
[Fri Feb 06 10:25:22.921238 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] During handling of the above exception, another exception occurred:
[Fri Feb 06 10:25:22.921240 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]
[Fri Feb 06 10:25:22.921243 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] Traceback (most recent call last):
[Fri Feb 06 10:25:22.921301 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/var/www/cgi-bin/barbican/main", line 52, in <module>
[Fri Feb 06 10:25:22.921303 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     application = get_api_wsgi_script()
[Fri Feb 06 10:25:22.921306 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/barbican/api/app.py", line 118, in get_api_wsgi_script
[Fri Feb 06 10:25:22.921308 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     application = deploy.loadapp('config:%s' % conf)
[Fri Feb 06 10:25:22.921311 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/paste/deploy/loadwsgi.py", line 253, in loadapp
[Fri Feb 06 10:25:22.921313 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return loadobj(APP, uri, name=name, **kw)
[Fri Feb 06 10:25:22.921316 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/paste/deploy/loadwsgi.py", line 278, in loadobj
[Fri Feb 06 10:25:22.921318 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return context.create()
[Fri Feb 06 10:25:22.921321 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/paste/deploy/loadwsgi.py", line 715, in create
[Fri Feb 06 10:25:22.921323 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return self.object_type.invoke(self)
[Fri Feb 06 10:25:22.921326 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/paste/deploy/loadwsgi.py", line 148, in invoke
[Fri Feb 06 10:25:22.921334 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return fix_call(context.object,
[Fri Feb 06 10:25:22.921337 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/paste/deploy/util.py", line 55, in fix_call
[Fri Feb 06 10:25:22.921339 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     val = callable(*args, **kw)
[Fri Feb 06 10:25:22.921342 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/paste/urlmap.py", line 31, in urlmap_factory
[Fri Feb 06 10:25:22.921344 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     app = loader.get_app(app_name, global_conf=global_conf)
[Fri Feb 06 10:25:22.921347 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/paste/deploy/loadwsgi.py", line 355, in get_app
[Fri Feb 06 10:25:22.921349 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return self.app_context(
[Fri Feb 06 10:25:22.921351 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/paste/deploy/loadwsgi.py", line 715, in create
[Fri Feb 06 10:25:22.921353 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return self.object_type.invoke(self)
[Fri Feb 06 10:25:22.921356 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/paste/deploy/loadwsgi.py", line 213, in invoke
[Fri Feb 06 10:25:22.921358 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     app = filter(app)
[Fri Feb 06 10:25:22.921361 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/keystonemiddleware/auth_token/__init__.py", line 912, in auth_filter
[Fri Feb 06 10:25:22.921363 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return AuthProtocol(app, conf)
[Fri Feb 06 10:25:22.921366 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/keystonemiddleware/auth_token/__init__.py", line 627, in __init__
[Fri Feb 06 10:25:22.921368 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     self._auth = self._create_auth_plugin()
[Fri Feb 06 10:25:22.921371 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/keystonemiddleware/auth_token/__init__.py", line 821, in _create_auth_plugin
[Fri Feb 06 10:25:22.921373 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return plugin_loader.load_from_options_getter(getter)
[Fri Feb 06 10:25:22.921376 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/keystoneauth1/loading/base.py", line 182, in load_from_options_getter
[Fri Feb 06 10:25:22.921378 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     val = getter(opt)
[Fri Feb 06 10:25:22.921381 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/keystonemiddleware/auth_token/__init__.py", line 820, in <lambda>
[Fri Feb 06 10:25:22.921383 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     getter = lambda opt: self._conf.get(opt.dest, group=group)  # noqa
[Fri Feb 06 10:25:22.921386 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/keystonemiddleware/_common/config.py", line 116, in get
[Fri Feb 06 10:25:22.921388 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return self.oslo_conf_obj[group][name]
[Fri Feb 06 10:25:22.921391 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 3165, in __getitem__
[Fri Feb 06 10:25:22.921393 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return self.__getattr__(key)
[Fri Feb 06 10:25:22.921395 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 3161, in __getattr__
[Fri Feb 06 10:25:22.921397 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return self._conf._get(name, self._group)
[Fri Feb 06 10:25:22.921402 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2653, in _get
[Fri Feb 06 10:25:22.921404 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     value, loc = self._do_get(name, group, namespace)
[Fri Feb 06 10:25:22.921407 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2716, in _do_get
[Fri Feb 06 10:25:22.921409 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return (convert(val), alt_loc)
[Fri Feb 06 10:25:22.921411 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2686, in convert
[Fri Feb 06 10:25:22.921413 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     self._substitute(value, group, namespace), opt)
[Fri Feb 06 10:25:22.921416 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2786, in _substitute
[Fri Feb 06 10:25:22.921418 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     ret = tmpl.safe_substitute(
[Fri Feb 06 10:25:22.921421 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib64/python3.9/string.py", line 142, in safe_substitute
[Fri Feb 06 10:25:22.921424 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return self.pattern.sub(convert, self.template)
[Fri Feb 06 10:25:22.921428 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib64/python3.9/string.py", line 133, in convert
[Fri Feb 06 10:25:22.921431 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     return str(mapping[named])
[Fri Feb 06 10:25:22.921435 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 3250, in __getitem__
[Fri Feb 06 10:25:22.921438 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     value = self.conf._get(key, namespace=self.namespace)
[Fri Feb 06 10:25:22.921443 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2653, in _get
[Fri Feb 06 10:25:22.921446 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     value, loc = self._do_get(name, group, namespace)
[Fri Feb 06 10:25:22.921449 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2671, in _do_get
[Fri Feb 06 10:25:22.921451 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     info = self._get_opt_info(name, group)
[Fri Feb 06 10:25:22.921454 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]   File "/usr/lib/python3.9/site-packages/oslo_config/cfg.py", line 2876, in _get_opt_info
[Fri Feb 06 10:25:22.921456 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730]     raise NoSuchOptError(opt_name, group)
[Fri Feb 06 10:25:22.921463 2026] [wsgi:error] [pid 11:tid 63] [remote 192.168.0.1:55730] oslo_config.cfg.NoSuchOptError: no such option someText in group [DEFAULT]
[Fri Feb 06 10:25:22.921796 2026] [ssl:debug] [pid 28:tid 147] ssl_engine_io.c(1151): [client 192.168.0.1:55730] AH02001: Connection closed to child 68 with standard shutdown (server barbican-internal.openstack.svc:443)

Expected behavior
Special characters are parsed properly by barbican, or configuration definition has proper quotation

Bug impact
Barbican deployment may be blocked

Known workaround
Switch to password without special characters

Additional context
Must gather is attached to case, but description likely contains all needed info

is cloned by

OSPRH-26428 Special characters in GlancePassword may block application startup

Closed

is duplicated by

OSPRH-26429 It looks like some special characters in passwords may block OSCP reconciliation

Refinement

is triggering

OSPRH-25961 Barbican API pod is in CrashLoopBackOff state because readiness probe is blocked

Closed

relates to

OSPRH-26429 It looks like some special characters in passwords may block OSCP reconciliation

Refinement

Details

Description

Attachments

Issue Links

Easy Agile Planning Poker

Activity

People

Dates

PagerDuty