Open Stack

Right now Keystone provides so called bearer tokens: This means that whoever has a token can do whatever the token entitles him to do. If I
manage to get somebody's token I can do whatever this person is able to do. To fix it, the other services that use tokens to:

1. Authenticate the identity
2. Match the name in the token to the  identity that authenticated the connection.

If the names match then you can be sure that the user that connected to the service and presented a token is the same user that acquired the token from keystone in the first place.

To make this happen we need to add authentication to the connections between clients and services.


To be able to do that we need to
1. Enable multiple forms of authentication per client.  The best way to do this is to use a common client library, which we have developed in keystoneclient
2. Use the 'requests' libraray for HTTP across all clients
3. Enable running the API servers in Apache HTTPD.  Making Eventlet support X509 CLient certs and Kerberos is going to be difficult, and the likelihood of introducing a security problem is high.


https://blueprints.launchpad.net/keystone/+spec/authentication-tied-to-token


Jamie Lennox did the following analysis:


Http library usage by clients



  Keystone:
- Uses requests for the keystoneclient
- Uses httplib for auth token middleware (i've got a patch to change it
to requests).
- Checks that os is patched before importing eventlet for cms.

Glance:
- Uses httplib for communication
- Uses keystoneclient within cli
- Checks that socket is patched before importing eventlet for httplib.

Cinder:
- Uses requests
- Does not use keystoneclient
- Uses sleep from evenlet or time based on ImportError of eventlet

Ceilometer:
- Uses keystoneclient within library.
- Uses httplib
- No eventlet

Nova:
- Uses requests
- Does not use keystoneclient
- No eventlet

Horizon (obviously is a server):
- Uses all clients
- No eventlet

Heat:
- Uses keystoneclient within cli
- Uses httplib
- No eventlet

Quantum
- Uses httplib
- Does not use keystoneclient
- No eventlet

Openstack Client:
- Uses keystoneclient
- Communicates via client libraries
- No eventlet

So this raises a couple of points.
- We need to get Nova, Quantum and Cinder to use keystoneclient.

- Eventlet is mostly gone from the clients already. I'm not sure how
many of those http requests would end up actually blocking.

- It would appear that clients have all at some point taken a central
layout approach and with it taken httplib. We probably can't get them
all changed over to requests before we try to add kerberos.


- There is already a number of concerns around the way we use https. By
default httplib does not verify https certificates, requests does and
provides global ways of setting the bundle.
https://wiki.openstack.org/wiki/SecureClientConnections  already
advocates for the transfer to requests with some interesting examples
likehttps://bugs.launchpad.net/python-glanceclient/+bug/1079692
(Server's name isn't verified when using https)


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20130626/ebac465f/attachment.html>