Right now Keystone provides so called bearer tokens: This means that whoever has a token can do whatever the token entitles him to do. If I manage to get somebody's token I can do whatever this person is able to do. To fix it, the other services that use tokens to:
1. Authenticate the identity 2. Match the name in the token to the identity that authenticated the connection. If the names match then you can be sure that the user that connected to the service and presented a token is the same user that acquired the token from keystone in the first place. To make this happen we need to add authentication to the connections between clients and services. To be able to do that we need to 1. Enable multiple forms of authentication per client. The best way to do this is to use a common client library, which we have developed in keystoneclient 2. Use the 'requests' libraray for HTTP across all clients 3. Enable running the API servers in Apache HTTPD. Making Eventlet support X509 CLient certs and Kerberos is going to be difficult, and the likelihood of introducing a security problem is high. https://blueprints.launchpad.net/keystone/+spec/authentication-tied-to-token Jamie Lennox did the following analysis: Http library usage by clients Keystone: - Uses requests for the keystoneclient - Uses httplib for auth token middleware (i've got a patch to change it to requests). - Checks that os is patched before importing eventlet for cms. Glance: - Uses httplib for communication - Uses keystoneclient within cli - Checks that socket is patched before importing eventlet for httplib. Cinder: - Uses requests - Does not use keystoneclient - Uses sleep from evenlet or time based on ImportError of eventlet Ceilometer: - Uses keystoneclient within library. - Uses httplib - No eventlet Nova: - Uses requests - Does not use keystoneclient - No eventlet Horizon (obviously is a server): - Uses all clients - No eventlet Heat: - Uses keystoneclient within cli - Uses httplib - No eventlet Quantum - Uses httplib - Does not use keystoneclient - No eventlet Openstack Client: - Uses keystoneclient - Communicates via client libraries - No eventlet So this raises a couple of points. - We need to get Nova, Quantum and Cinder to use keystoneclient. - Eventlet is mostly gone from the clients already. I'm not sure how many of those http requests would end up actually blocking. - It would appear that clients have all at some point taken a central layout approach and with it taken httplib. We probably can't get them all changed over to requests before we try to add kerberos. - There is already a number of concerns around the way we use https. By default httplib does not verify https certificates, requests does and provides global ways of setting the bundle. https://wiki.openstack.org/wiki/SecureClientConnections already advocates for the transfer to requests with some interesting examples likehttps://bugs.launchpad.net/python-glanceclient/+bug/1079692 (Server's name isn't verified when using https)
_______________________________________________ OpenStack-dev mailing list OpenStack-dev@lists.openstack.org http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
