Open Stack

On Fri, Apr 5, 2019, at 06:38, Ben Nemec wrote:
> Tagging with relevant projects for visibility.
> 
> On 3/30/19 3:54 PM, Paulo Angelo wrote:
> > Hi all,
> > 
> > 
> > We are trying to integrate OpenStack (Horizon or Keystone) with 
> > GuardianKey. However, we have doubts related to the best way to do this 
> > and the best point in the code for this integration.
> > 
> > 
> > GuardianKey is a solution to protect systems against authentication 
> > attacks. It uses Machine Learning and analyses the user's behavior, 
> > threat intelligence and psychometrics (or behavioral biometrics). The 
> > protected system (in the concrete case, OpenStack admin interface) must 
> > send an event via REST for the GuardianKey on each login attempt. More 
> > info at https://guardiankey.io <https://guardiankey.io>.
> > 
> > The best way to integrate would be on having a hook in the procedure 
> > that process the user credentials submission in OpenStack (the script 
> > that receives the POST), something such as:
> > 
> > 
> > if(<POST IN AUTH FORM>) {
> > 
> >   boolean loginFailed =  checkLogin();
> > 
> >   GuardianKeyEvent event = createEventForGuardianKey(username,loginFailed);
> > 
> >   boolean GuardianKeyValidation = checkGuardianKeyViaREST(event);
> > 
> >   if(GuardianKeyValidation){
> > 
> >      // Allow access
> > 
> >   } else {
> > 
> >      // Deny access
> > 
> >   }
> > 
> > }
> > 
> > 
> > Where is the best place to create this integration? Horizon or Keystone? 
> > Is there a way to create a hook for this purpose? Should we create an 
> > extension?

Keystone would be the best place for this. Horizon is only one way a user can log in to OpenStack, so hooking into Horizon would not cover your attack vector. Keystone has a built-in auditing system specifically for this, using CADF notifications to emit events when a user logs in:

https://docs.openstack.org/keystone/latest/admin/event_notifications.html

All you need to do is create a consumer for those notifications.

Colleen

> > 
> > 
> > Any help is welcome.
> > 
> > 
> > Thank you in advance.
> > 
> > 
> > Best regards,
> > 
> > 
> > Paulo Angelo
> 
>