I personally think that having an external Identity Management solution is the best option. In my mind there are vare valuable benefits for having a highly scalable, enterprise class, identity management solution on OpenStack such as (1) Separation of concerns of Authentication and Authorization from the core OpenStack services and (2) Providing a unified authentication and user management system for OpenStack services (i.e. Swift, Nova, Glance, ..etc.). <div>
<br></div><div>I think this is worthy of a summit discussion.<br><div><br></div><div>Thanks,</div><div>Khaled<br><br><div class="gmail_quote">On Mon, Mar 28, 2011 at 10:27 AM, <span dir="ltr"><<a href="mailto:ksankar@doubleclix.net">ksankar@doubleclix.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><span style="font-family:Verdana;color:#000000;font-size:10pt"><div>Couple of quick thoughts:</div><div><br></div><div>IMHO, -2. Rely on external system- is the best solution. This enables the decoupling of authorization, which then can be extended or integrated with existing systems, as appropriate by Openstack deployments. This also can be an instance of a federated identity management. <br>
</div><div><br></div><div><a href="http://-1.Replicated" target="_blank">-1.Replicated</a> user accounts- is the worst as it can create sync problems.</div><div><br></div><div>Cheers</div><div><k/><br></div>
<blockquote style="border-left:2px solid blue;margin-left:8px;padding-left:8px;font-size:10pt;color:black;font-family:verdana">
<div><div class="im">
-------- Original Message --------<br>
Subject: [Openstack] Federated Identity Management (bursting and zones)<br></div><div class="im">
From: Sandy Walsh <<a href="mailto:sandy.walsh@rackspace.com" target="_blank">sandy.walsh@rackspace.com</a>><br></div><div><div></div><div class="h5">
Date: Mon, March 28, 2011 7:15 am<br>
To: "<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>" <<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>><br>
<br>
<div style="direction:ltr;font-family:Tahoma;color:#000000;font-size:10pt"> <div>Currently, we link Nova deployments (aka Zones) with a single admin account. All operations done in the child zone are done with this admin account. </div>
<div><br> </div> <div>Obviously this needs to change. A simple operation such as "get_all_servers" should only return the servers that User X owns. In the current implementation, all the servers the admin account can see will be returned.</div>
<div><br> </div> <div>We need some form of federated identity management. User accounts must be shared between homogeneous and heterogeneous deployments. ie. all private, all public or public/private (aka Hybrid) via Bursting.</div>
<div><br> </div> <div>There are some possibilities here:</div> <div><br> </div> <div>1. Replicate User accounts across zones. A user account would map to N child zone accounts ... one for each child zone. These "placeholder" accounts are hidden from the user and synchronized when the parent changes.</div>
<div><br> </div> <div>2. Rely on an external/shared user management service. Let the Auth/RBAC system sort out visibility, control, etc. This system would need to be publicly available to both groups in the hybrid scenario.</div>
<div><br> </div> <div>3. Continue with the admin account and filter access control/visibility in the parent zone. </div> <div><br> </div> <div>... and I'm sure there are others. </div> <div><br> </div> <div>Nasty problem. Lots of issues and concerns with each approach. </div>
<div><br> </div> <div>Is there anyone actively working on this who can share some info?</div> <div>What is the currently sentiment in terms of an approach?</div> <div><br> </div> <div>Summit discussion?</div> <div><br> </div>
<div>Thanks,</div> <div>Sandy</div> <div><br> </div> <div><br> </div> <div><br> </div> <div>PS> I did some scanning of the BP's and don't see anything directly addressing this. </div> <div><a href="https://blueprints.launchpad.net/nova/+spec/bursting" target="_blank">https://blueprints.launchpad.net/nova/+spec/bursting</a></div>
<div><a href="https://blueprints.launchpad.net/nova/+spec/authentication-consistency" target="_blank">https://blueprints.launchpad.net/nova/+spec/authentication-consistency</a></div> <div><a href="https://blueprints.launchpad.net/nova/+spec/bexar-auth-manager-api" target="_blank">https://blueprints.launchpad.net/nova/+spec/bexar-auth-manager-api</a></div>
</div> <pre>Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at <a href="mailto:abuse@rackspace.com" target="_blank">abuse@rackspace.com</a>, and delete the original message.
Your cooperation is appreciated.
</pre> <hr>_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
</div></div></div>
</blockquote></span></div>
<br>_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br></blockquote></div><br></div></div><PRE>
Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at abuse@rackspace.com, and delete the original message.
Your cooperation is appreciated.
</PRE>