<html><head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000">Sergey,<br>
<br>
Great news! Thanks for the update on OpenID. <br>
<br>
Our other question is around the workflow for the Authorization tokens.
It seems like you're bypassing oAuth2 on OpenStackID in order to manage
the authorization on the refstack client. Why not utilize OpenStackID
for both openid and oAuth2? Basically create the authorization tokens on
the OpenStackID side and create your own resources server as gatekeeper
of you API and validate oauth2 tokens against introspection endpoint
(<a class="moz-txt-link-freetext" href="http://ci.openstack.org/openstackid/oauth2.html#token-introspection">http://ci.openstack.org/openstackid/oauth2.html#token-introspection</a>).<br>
<br>
Thoughts?<br>
<br>
Thanks,<br>
Jimmy<br>
<br>
<br>
<br>
Sergey Slypushenko wrote:
<blockquote
cite="mid:CAF6tC6-v=SfdRbT_9ruKsp+i3q6vL-THBOGMoVhq9Oxg8zJ67Q@mail.gmail.com"
type="cite">
<div dir="ltr">Jimmy,<br><br>Thank you for your comment! That diagram
was kind of outdated. I have updated it already.<div> </div><div>We are
planning to use OpenID for authentication and we have been already
working on it.<br><br>Regards,<br>Sergey<br><div><br></div><div><br></div></div></div>
<div class="gmail_extra"><br><div class="gmail_quote">On Mon, Apr 20,
2015 at 6:30 PM, Jimmy McArthur <span dir="ltr"><<a
moz-do-not-send="true" href="mailto:jimmy@tipit.net" target="_blank">jimmy@tipit.net</a>></span>
wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Sergey,<div><br></div><div>The
biggest thing that stands out is the lack of authentication through
OpenID. It appears that you're still authenticating through oAuth2,
which is against security best practices and not how OpenStackID is
designed. For a primer on the difference and why it's set up this way: <a
moz-do-not-send="true"
href="http://nat.sakimura.org/2011/05/15/dummys-guide-for-the-difference-between-oauth-authentication-and-openid/"
target="_blank">http://nat.sakimura.org/2011/05/15/dummys-guide-for-the-difference-between-oauth-authentication-and-openid/</a>
(forgive the title, but it does a nice job of illustrating the issue)</div><div><br></div><div>I'm
adding Sebastian here to chime in on potential technical details and
the possibility of setting up your own resource server. The important
thing though is to follow the steps outlined in the OpenStackID
documentation for proper authentication.</div><div><br></div><div
class="gmail_extra"><div><div><div dir="ltr">--<br><div
style="color:rgb(136,136,136);margin-right:24px"><span
style="color:rgb(0,0,0)">Jimmy McArthur / </span><a
moz-do-not-send="true" style="color:rgb(0,0,0)" href="http://Tipit.net"
target="_blank">Tipit.net</a><span style="color:rgb(0,0,0)"> < </span><a
moz-do-not-send="true" style="color:rgb(0,0,0)"
href="mailto:jimmy@tipit.net" target="_blank">jimmy@tipit.net</a><span
style="color:rgb(0,0,0)">></span><br><a moz-do-not-send="true"
href="tel:512.965.4846" value="+15129654846" target="_blank">512.965.4846</a>
<div><br></div></div></div></div></div>
<br><div class="gmail_quote"><div><div class="h5">On Thu, Apr 16, 2015
at 4:49 AM, Sergey Slypushenko <span dir="ltr"><<a
moz-do-not-send="true" href="mailto:sslypushenko@mirantis.com"
target="_blank">sslypushenko@mirantis.com</a>></span> wrote:<br></div></div><blockquote
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc
solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Here you can
find slides with general user stories: <div><ul><li>create user account</li><li>access
to resource required user auth in Web UI<br></li><li>access to resource
required user auth in CLI client</li></ul><div><a
moz-do-not-send="true"
href="https://docs.google.com/presentation/d/1v7exKKL1zSA102Xu8FkY1u9rMVUE6BjwUCoWGYYvbaI/edit#slide=id.g9870fa983_0_0"
target="_blank">https://docs.google.com/presentation/d/1v7exKKL1zSA102Xu8FkY1u9rMVUE6BjwUCoWGYYvbaI/edit#slide=id.g9870fa983_0_0</a><br></div></div><div><br></div><div>Any
comments related to this topic will be very appreciated.</div><div><br></div><div><div
style="font-size:12.8000001907349px">Regards,</div><div
style="font-size:12.8000001907349px">Sergey Slipushenko,</div><div
style="font-size:12.8000001907349px"><br></div><div
style="font-size:12.8000001907349px">Software Developer,</div><div
style="font-size:12.8000001907349px">Kharkiv, Ukraine,</div><div
style="font-size:12.8000001907349px">Mirantis Inc.</div></div><div><br></div></div>
<br></div></div>_______________________________________________<br>
OpenStack-Infra mailing list<br>
<a moz-do-not-send="true"
href="mailto:OpenStack-Infra@lists.openstack.org" target="_blank">OpenStack-Infra@lists.openstack.org</a><br>
<a moz-do-not-send="true"
href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra"
target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra</a><br>
<br></blockquote></div><br></div></div></blockquote></div><br></div>
</blockquote>
</body></html>