<font size=2 face="sans-serif">+1! Excellent summary and analysis
Morgan!</font>
<br>
<br><font size=2 face="sans-serif">--Brad</font>
<br><font size=2 face="sans-serif"><br>
<br>
Brad Topol, Ph.D.<br>
IBM Distinguished Engineer<br>
OpenStack<br>
(919) 543-0646<br>
Internet: btopol@us.ibm.com<br>
Assistant: Kendra Witherspoon (919) 254-0680</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Morgan Fainberg <morgan.fainberg@gmail.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">"OpenStack Development
Mailing List (not for usage questions)" <openstack-dev@lists.openstack.org>,
</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">05/29/2014 01:07 PM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: [openstack-dev]
[keystone] Redesign of Keystone Federation</font>
<br>
<hr noshade>
<br>
<br>
<br><font size=2 face="Arial">I agree that there is room for improvement
on the Federation design within Keystone. I would like to re-iterate what
Adam said that we are already seeing efforts to fully integrate further
protocol support (OpenID Connect, etc) within the current system. Lets
be sure that whatever redesign work is proposed and accepted takes into
account the current stakeholders (that are really using Federation) and
ensure full backwards compatibility.</font>
<br>
<br><font size=2 face="Arial">I firmly believe we can work within the Apache
module framework for Juno. Moving beyond Juno we may need to start implementing
the more native modules (proposal #2). Lets be sure whatever redesign work
we perform this cycle doesn’t lock us exclusively into one path or another.
It shouldn’t be too hard to continue making incremental improvements (agile
methodology) and keeping the stakeholders engaged.</font>
<br>
<br><font size=2 face="Arial">David and Kristy, the slides and summit session
are a great starting place for this work. Now we need to get the proposal
drafted up in the new Keystone-Specs repository ( </font><a href="https://git.openstack.org/cgit/openstack/keystone-specs"><font size=2 face="Arial">https://git.openstack.org/cgit/openstack/keystone-specs</font></a><font size=2 face="Arial">
) so we can keep this conversation on track. Having the specification clearly
outlined and targeted will help us address any concerns with the proposal/redesign
as we move into implementation.</font>
<br>
<br><font size=2 face="Arial">Cheers,</font>
<br><font size=2 face="Arial">Morgan</font>
<p><font size=2 face="Arial"><b>—<br>
Morgan Fainberg</b></font>
<p><font size=2 face="Arial"><br>
From: Adam Young </font><a href=mailto:ayoung@redhat.com><font size=2 color=blue face="Arial"><u>ayoung@redhat.com</u></font></a><font size=2 face="Arial"><br>
Reply: OpenStack Development Mailing List (not for usage questions) </font><a href="mailto:openstack-dev@lists.openstack.org"><font size=2 color=blue face="Arial"><u>openstack-dev@lists.openstack.org</u></font></a><font size=2 face="Arial"><br>
Date: May 28, 2014 at 09:24:26<br>
To: openstack-dev@lists.openstack.org </font><a href="mailto:openstack-dev@lists.openstack.org"><font size=2 color=blue face="Arial"><u>openstack-dev@lists.openstack.org</u></font></a><font size=2 face="Arial"><br>
Subject: Re: [openstack-dev] [keystone] Redesign of Keystone Federation
</font>
<br>
<br><font size=2 face="Arial">On 05/28/2014 11:59 AM, David Chadwick wrote:
<br>
> Hi Everyone <br>
> <br>
> at the Atlanta meeting the following slides were presented during
the <br>
> federation session <br>
> <br>
> </font><a href="http://www.slideshare.net/davidwchadwick/keystone-apach-authn"><font size=2 face="Arial">http://www.slideshare.net/davidwchadwick/keystone-apach-authn</font></a><font size=2 face="Arial">
<br>
> <br>
> It was acknowledged that the current design is sub-optimal, but was
a <br>
> best first efforts to get something working in time for the IceHouse
<br>
> release, which it did successfully. <br>
> <br>
> Now is the time to redesign federated access in Keystone in order
to <br>
> allow for: <br>
> i) the inclusion of more federation protocols such as OpenID and OpenID
<br>
> Connect via Apache plugins <br>
<br>
These are underway: Steve Mar just posted review for OpenID connect. <br>
> ii) federating together multiple Keystone installations <br>
I think Keystone should be dealt with separately. Keystone is not a good
<br>
stand-alone authentication mechanism. <br>
<br>
> iii) the inclusion of federation protocols directly into Keystone
where <br>
> good Apache plugins dont yet exist e.g. IETF ABFAB <br>
I though this was mostly pulling together other protocols such as Radius?
<br>
</font><a href=http://freeradius.org/mod_auth_radius/><font size=2 face="Arial">http://freeradius.org/mod_auth_radius/</font></a><font size=2 face="Arial">
<br>
<br>
> <br>
> The Proposed Design (1) in the slide show is the simplest change to
<br>
> make, in which the Authn module has different plugins for different
<br>
> federation protocols, whether via Apache or not. <br>
<br>
I'd like to avoid doing non-HTTPD modules for as long as possible. <br>
<br>
> <br>
> The Proposed Design (2) is cleaner since the plugins are directly
into <br>
> Keystone and not via the Authn module, but it requires more <br>
> re-engineering work, and it was questioned in Atlanta whether that
<br>
> effort exists or not. <br>
<br>
The "method" parameter is all that is going to vary for most
of the Auth <br>
mechanisms. X509 and Kerberos both require special set up of the HTTP <br>
connection to work, which means client and server sides need to be in <br>
sync: SAML, OpenID and the rest have no such requirements. <br>
<br>
> <br>
> Kent therefore proposes that we go with Proposed Design (1). Kent
will <br>
> provide drafts of the revised APIs and the re-engineered code for
<br>
> inspection and approval by the group, if the group agrees to go with
<br>
> this revised design. <br>
> <br>
> If you have any questions about the proposed re-design, please don't
<br>
> hesitate to ask <br>
> <br>
> regards <br>
> <br>
> David and Kristy <br>
> <br>
> _______________________________________________ <br>
> OpenStack-dev mailing list <br>
> OpenStack-dev@lists.openstack.org <br>
> </font><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev"><font size=2 face="Arial">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</font></a><font size=2 face="Arial">
<br>
<br>
<br>
_______________________________________________ <br>
OpenStack-dev mailing list <br>
OpenStack-dev@lists.openstack.org <br>
</font><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev"><font size=2 face="Arial">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</font></a><font size=2 face="Arial">
</font><tt><font size=2>_______________________________________________<br>
OpenStack-dev mailing list<br>
OpenStack-dev@lists.openstack.org<br>
</font></tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev"><tt><font size=2>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</font></tt></a><tt><font size=2><br>
</font></tt>
<br>