OpenStack Identity (keystone)

Certificates cannot be retrieved from the V3 API

Bug #1259011 reported by Jamie Lennox
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Fix Released
Wishlist
Jamie Lennox
OpenStack Identity (keystone) 2014.1 "icehouse"
keystonemiddleware
Won't Fix
Wishlist
Unassigned
openstack-api-site
Fix Released
Wishlist
Jamie Lennox

Bug Description

Auth_token middleware relies upon the V2 api to provide the certificates that are required to validate PKI tokens because this information is not provided by the V3 API.

Longer term i think we should be encouraging deployers to handle their own certificate distribution as fetching the certificates from the same source that is issuing tokens is not secure, however for the mean time we need some way of providing these certificates to token validators.

Tags: pki
Revision history for this message
Jamie Lennox (jamielennox) wrote :

Added keystoneclient as it should be able to make use of the certificates from a v3 api.

Revision history for this message
Dolph Mathews (dolph) wrote :

Isn't this exposed on v3 but not documented... again?

Changed in keystone:
importance: Undecided → Wishlist
Changed in python-keystoneclient:
importance: Undecided → Wishlist
Revision history for this message
Jamie Lennox (jamielennox) wrote :

No, i don't think it's exposed on the v3 API at all. On v2 it's /v2.0/certificates/signing /v3/certificates/signing doesn't exist and i can't find anywhere else that it is exposed.

It's definitely not used via the 3.0 API, documented or not.

Revision history for this message
Dolph Mathews (dolph) wrote :

Well, that's good to hear. Adam has an abandoned API review to spec this out.

Revision history for this message
Jamie Lennox (jamielennox) wrote :

He does, I remember commenting on it but it's been abandoned for a while and was tied in with revocation. So i just put in a new one: https://review.openstack.org/#/c/60727/

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.openstack.org/62810

Changed in keystone:
assignee: nobody → Jamie Lennox (jamielennox)
status: New → In Progress
Revision history for this message
Jamie Lennox (jamielennox) wrote :

https://review.openstack.org/#/c/60727/

Changed in openstack-api-site:
assignee: nobody → Jamie Lennox (jamielennox)
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to identity-api (master)

Reviewed: https://review.openstack.org/60727
Committed: https://git.openstack.org/cgit/openstack/identity-api/commit/?id=602aa6b90adb11103e2683a34fa4e0e13a3e8c69
Submitter: Jenkins
Branch: master

commit 602aa6b90adb11103e2683a34fa4e0e13a3e8c69
Author: Jamie Lennox <email address hidden>
Date: Mon Dec 9 11:41:03 2013 +1000

    Add OS-SIMPLE-CERT extension

    This provides a very basic mechanism for retrieving the CA and signing
    certificate from the identity service. It aims to simply replicate the
    functionality provided by the v2.0 API.

    SecurityImpact
    Change-Id: I24c77188ebb05ef57b378798584e3829d55827f2
    Partial-Bug: #1259011

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.openstack.org/67785

Revision history for this message
Jamie Lennox (jamielennox) wrote :

Identity API bug closed by: https://review.openstack.org/#/c/60727/

Changed in keystone:
milestone: none → icehouse-2
Changed in openstack-api-site:
status: In Progress → Fix Committed
Dolph Mathews (dolph)
Changed in keystone:
milestone: icehouse-2 → icehouse-3
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (master)

Reviewed: https://review.openstack.org/67785
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=4f9c7e22291b38c88601b757503840ba5806c215
Submitter: Jenkins
Branch: master

commit 4f9c7e22291b38c88601b757503840ba5806c215
Author: Jamie Lennox <email address hidden>
Date: Mon Jan 20 17:56:17 2014 +1000

    Simple Certificate Extension

    Implement the Simple Certificate Extension for retrieving token signing
    certificates from a server.

    Change-Id: I653c527ca2b39628658a24b4d484683d1ac6acf2
    Closes-Bug: #1259011

Changed in keystone:
status: In Progress → Fix Committed
Andreas Jaeger (jaegerandi)
Changed in openstack-api-site:
status: Fix Committed → Fix Released
importance: Undecided → Wishlist
Thierry Carrez (ttx)
Changed in keystone:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in keystone:
milestone: icehouse-3 → 2014.1
Dolph Mathews (dolph)
Changed in keystonemiddleware:
importance: Undecided → Wishlist
status: New → Triaged
no longer affects: python-keystoneclient
Steve Martinelli (stevemar)
tags: added: pki
Revision history for this message
Morgan Fainberg (mdrnstm) wrote :

With PKI tokens being deprecated, I am going to mark this as "wont fix", prefering Fernet and/or UUID tokens to PKI

Changed in keystonemiddleware:
status: Triaged → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.