)]}'
{"specs/mitaka/key-mgmt.rst":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"By design, modules handling supporting SAML2 workflow query trusted Identity"},{"line_number":25,"context_line":"Providers every ``n`` seconds (default refresh rate is usually set to single"},{"line_number":26,"context_line":"hours) in order to refresh information about Identity Provider:"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* Identity Provider entityId"},{"line_number":29,"context_line":"* Identity Provider endpoints"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_1b334cf7","line":26,"updated":"2015-11-12 18:38:40.000000000","message":"We don\u0027t do that if a static metadata file is used right? Also, I am not sure if this is necessary for K2K mechanism.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"By design, modules handling supporting SAML2 workflow query trusted Identity"},{"line_number":25,"context_line":"Providers every ``n`` seconds (default refresh rate is usually set to single"},{"line_number":26,"context_line":"hours) in order to refresh information about Identity Provider:"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* Identity Provider entityId"},{"line_number":29,"context_line":"* Identity Provider endpoints"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_1c86c613","line":26,"in_reply_to":"da85f559_1b334cf7","updated":"2015-11-13 10:02:32.000000000","message":"This spec is not only for a K2K use case. \nAnd yes, mod_shib lets you specify static file, however the default and scalable way is to query IdP.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"2cdb2352b9987e289ef2860d14848b413eb2c3c3","unresolved":false,"context_lines":[{"line_number":30,"context_line":"* Identity Provider public keys used for signing and/or encrypting of the"},{"line_number":31,"context_line":"  assertions."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Identity Provider administrator wishing to change a set of configuration should"},{"line_number":34,"context_line":"change metadata entry and wait for the data to propagate to all trusted Service"},{"line_number":35,"context_line":"Providers. Unfortunately the \"update metadata/propagate changes\" cycle is not"},{"line_number":36,"context_line":"sufficient when it comes to quick keys revocation.  If the Identity Providers"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_20f13d95","line":33,"updated":"2015-11-12 18:11:16.000000000","message":"How do we do this now in general idp/sp setup? Don\u0027t they have the same problem?  I think we should handle this in similar to how idp/sp issues are handled in industry.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":30,"context_line":"* Identity Provider public keys used for signing and/or encrypting of the"},{"line_number":31,"context_line":"  assertions."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Identity Provider administrator wishing to change a set of configuration should"},{"line_number":34,"context_line":"change metadata entry and wait for the data to propagate to all trusted Service"},{"line_number":35,"context_line":"Providers. Unfortunately the \"update metadata/propagate changes\" cycle is not"},{"line_number":36,"context_line":"sufficient when it comes to quick keys revocation.  If the Identity Providers"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_5cba0ec2","line":33,"in_reply_to":"da85f559_20f13d95","updated":"2015-11-13 10:02:32.000000000","message":"This is how it\u0027s setup in normal setups.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Providers. Unfortunately the \"update metadata/propagate changes\" cycle is not"},{"line_number":36,"context_line":"sufficient when it comes to quick keys revocation.  If the Identity Providers"},{"line_number":37,"context_line":"key has been compromised there is a chance that attacker will use it to access"},{"line_number":38,"context_line":"cloud provider (or any other Service Provider)."},{"line_number":39,"context_line":"There should be a robust and easy way for keys revocation to minimize risk"},{"line_number":40,"context_line":"after IdP has been compromised. This also means the changes should be executed"},{"line_number":41,"context_line":"immediately after the client\u0027s request, preferably by the client herself or the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_bb27a061","line":38,"updated":"2015-11-12 18:38:40.000000000","message":"This is a generally a risk we need to manage. No different from a situation where an LDAP user has been disabled. We\u0027ve been consistently in stating that this is part of deployer-specific monitoring/notification/workflow, outside the scope of core keystone function. I don\u0027t necessary agree with this, but that ship has sailed.\n\nbtw, this is the same for K2K. If a user is disabled at IdP Keystone. The SP Keystone doesn\u0027t necessary get notified and subsequently revoke the SP-issued token. That\u0027s workflow still need to be established out-of-band.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"2cdb2352b9987e289ef2860d14848b413eb2c3c3","unresolved":false,"context_lines":[{"line_number":38,"context_line":"cloud provider (or any other Service Provider)."},{"line_number":39,"context_line":"There should be a robust and easy way for keys revocation to minimize risk"},{"line_number":40,"context_line":"after IdP has been compromised. This also means the changes should be executed"},{"line_number":41,"context_line":"immediately after the client\u0027s request, preferably by the client herself or the"},{"line_number":42,"context_line":"1st level of support."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_e0f01569","line":41,"updated":"2015-11-12 18:11:16.000000000","message":"I still believe disabling idp is easiest way rather than relying on  key revocation.  Again it depends on how often key management system checks for revocation.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":38,"context_line":"cloud provider (or any other Service Provider)."},{"line_number":39,"context_line":"There should be a robust and easy way for keys revocation to minimize risk"},{"line_number":40,"context_line":"after IdP has been compromised. This also means the changes should be executed"},{"line_number":41,"context_line":"immediately after the client\u0027s request, preferably by the client herself or the"},{"line_number":42,"context_line":"1st level of support."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_7c4832cd","line":41,"in_reply_to":"da85f559_e0f01569","updated":"2015-11-13 10:02:32.000000000","message":"SPs don\u0027t really check CAs for revoked tokens - just an argument to make idp disabling probably better.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":39,"context_line":"There should be a robust and easy way for keys revocation to minimize risk"},{"line_number":40,"context_line":"after IdP has been compromised. This also means the changes should be executed"},{"line_number":41,"context_line":"immediately after the client\u0027s request, preferably by the client herself or the"},{"line_number":42,"context_line":"1st level of support."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_3bebb0dd","line":42,"updated":"2015-11-12 18:38:40.000000000","message":"I wholeheartedly agree with this statement in principal. But in practice?","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":45,"context_line":"Proposed Change"},{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_3b70903f","line":48,"updated":"2015-11-12 18:38:40.000000000","message":"How do we make 3rd IdPs (i.e. ADFS) using Barbican? Do you have a diagram to illustrate this flow?","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":45,"context_line":"Proposed Change"},{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_fc8182c4","line":48,"in_reply_to":"da85f559_3b70903f","updated":"2015-11-13 10:02:32.000000000","message":"we don\u0027t - this would kind of mean using non standard ways of keys distribution. Users would neeed to distribute keys manually by uploading/managing them to barbican.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_bb9a4060","line":49,"updated":"2015-11-12 18:38:40.000000000","message":"By \"Clients\" you mean \"IdPs\"?","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_dc691e27","line":49,"in_reply_to":"da85f559_bb9a4060","updated":"2015-11-13 10:02:32.000000000","message":"No, people who pay for the service.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"2cdb2352b9987e289ef2860d14848b413eb2c3c3","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules modules. Almost all configuration would be"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_80e58909","line":50,"updated":"2015-11-12 18:11:16.000000000","message":"What happens to openid connect?","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules modules. Almost all configuration would be"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_1c5ec676","line":50,"in_reply_to":"da85f559_80e58909","updated":"2015-11-13 10:02:32.000000000","message":"no openid connect withing the scope of this spec. It would be handled as is today - with mod_oidc.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules modules. Almost all configuration would be"},{"line_number":54,"context_line":"configured via dynamic API calls"},{"line_number":55,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_1bacac8a","line":52,"updated":"2015-11-12 18:38:40.000000000","message":"Don\u0027t think we encrypt SAML2. Just signing.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules modules. Almost all configuration would be"},{"line_number":54,"context_line":"configured via dynamic API calls"},{"line_number":55,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_bcda1ae8","line":52,"in_reply_to":"da85f559_1bacac8a","updated":"2015-11-13 10:02:32.000000000","message":"we don\u0027t in k2k, but this spec is not limited to k2k only. And everywhere else assertion can also be encrypted (which should be default imho)","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules modules. Almost all configuration would be"},{"line_number":54,"context_line":"configured via dynamic API calls"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_9be5fcdc","line":53,"updated":"2015-11-12 18:38:40.000000000","message":"s/modules modules/modules/\n\nbtw, its more than just Apache modules. We also need the Shibboleth Daemon (shibd).","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules modules. Almost all configuration would be"},{"line_number":54,"context_line":"configured via dynamic API calls"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_7cfb5248","line":53,"in_reply_to":"da85f559_9be5fcdc","updated":"2015-11-13 10:02:32.000000000","message":"I trieat it as a bundle (mod_shib + shibd) :-)","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":69,"context_line":"hours.  Additionally an access to modifying identity provider and protocol"},{"line_number":70,"context_line":"objects configured in keystone should be granted to non admin users i.e."},{"line_number":71,"context_line":"operators working as a 1st line of support. All required technicalities are"},{"line_number":72,"context_line":"implemented in today\u0027s versions of OpenStack. What is more, this scenario will"},{"line_number":73,"context_line":"atomatically handle all federated protocols as well align with recommendations"},{"line_number":74,"context_line":"for sharing configurations via exposed Metadata between trusted peers (main"},{"line_number":75,"context_line":"solution assumes clients would manually upload files to barbican)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_9b9dfc0b","line":72,"updated":"2015-11-12 18:38:40.000000000","message":"That\u0027s generally the expected workflow when dealing with 3rd party IdPs.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":69,"context_line":"hours.  Additionally an access to modifying identity provider and protocol"},{"line_number":70,"context_line":"objects configured in keystone should be granted to non admin users i.e."},{"line_number":71,"context_line":"operators working as a 1st line of support. All required technicalities are"},{"line_number":72,"context_line":"implemented in today\u0027s versions of OpenStack. What is more, this scenario will"},{"line_number":73,"context_line":"atomatically handle all federated protocols as well align with recommendations"},{"line_number":74,"context_line":"for sharing configurations via exposed Metadata between trusted peers (main"},{"line_number":75,"context_line":"solution assumes clients would manually upload files to barbican)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_bc245ac6","line":72,"in_reply_to":"da85f559_9b9dfc0b","updated":"2015-11-13 10:02:32.000000000","message":"++","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":71,"context_line":"operators working as a 1st line of support. All required technicalities are"},{"line_number":72,"context_line":"implemented in today\u0027s versions of OpenStack. What is more, this scenario will"},{"line_number":73,"context_line":"atomatically handle all federated protocols as well align with recommendations"},{"line_number":74,"context_line":"for sharing configurations via exposed Metadata between trusted peers (main"},{"line_number":75,"context_line":"solution assumes clients would manually upload files to barbican)"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_1b926cf6","line":74,"updated":"2015-11-12 18:38:40.000000000","message":"s/Metadata/metadata/","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":71,"context_line":"operators working as a 1st line of support. All required technicalities are"},{"line_number":72,"context_line":"implemented in today\u0027s versions of OpenStack. What is more, this scenario will"},{"line_number":73,"context_line":"atomatically handle all federated protocols as well align with recommendations"},{"line_number":74,"context_line":"for sharing configurations via exposed Metadata between trusted peers (main"},{"line_number":75,"context_line":"solution assumes clients would manually upload files to barbican)"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_5c352ef5","line":74,"in_reply_to":"da85f559_1b926cf6","updated":"2015-11-13 10:02:32.000000000","message":"Done","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":78,"context_line":"---------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"There is a great security impact as software handling SAML2 protocol must be"},{"line_number":81,"context_line":"written with security in mind and new code should be carefully pentested."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Notifications Impact"},{"line_number":84,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_bb6ec0fd","line":81,"updated":"2015-11-12 18:38:40.000000000","message":"++. Reimplementing Shibboleth is not fun. We also need to cache the relay state to prevent possible man-in-the-middle replay attack.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"2cdb2352b9987e289ef2860d14848b413eb2c3c3","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Keystone would need to store all HTTP sessions as well as handle and evict them"},{"line_number":99,"context_line":"correctly Depending on the backend and whether caching is used, performance may"},{"line_number":100,"context_line":"be degraded in comparison to the one we have today with Apache modules used."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Other Deployer Impact"},{"line_number":103,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_20acdd8a","line":100,"updated":"2015-11-12 18:11:16.000000000","message":"How is this going to work?    If keystone stores session how is it  going to be shared across multiple process within the same apache instance\n e.g  modwsgi setting process\u003d5, thread\u003d1","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"172d5e82e33b781e78da978fbd1603dfdba581d4","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Keystone would need to store all HTTP sessions as well as handle and evict them"},{"line_number":99,"context_line":"correctly Depending on the backend and whether caching is used, performance may"},{"line_number":100,"context_line":"be degraded in comparison to the one we have today with Apache modules used."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Other Deployer Impact"},{"line_number":103,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_5b61d403","line":100,"updated":"2015-11-12 18:38:40.000000000","message":"Pretty sure we need a global shared cache to manage the relay states.","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a4716a8fa0ab6b1874cdea11672bcd7ddf803bc","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Keystone would need to store all HTTP sessions as well as handle and evict them"},{"line_number":99,"context_line":"correctly Depending on the backend and whether caching is used, performance may"},{"line_number":100,"context_line":"be degraded in comparison to the one we have today with Apache modules used."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Other Deployer Impact"},{"line_number":103,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_bc0bfa2a","line":100,"in_reply_to":"da85f559_5b61d403","updated":"2015-11-13 10:02:32.000000000","message":"++","commit_id":"45233b2398e60ab7bb309f856cf7fb48f9262b83"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7ff25c583c910ad2877674408b4353024301e2d2","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Keystone as a SAML2 Service Provider"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp key-mgmt \u003chttps://blueprints.launchpad.net/keystone/+spec/key-mgmt\u003e`_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_89a55f05","line":8,"updated":"2015-11-17 16:14:14.000000000","message":"nit: crop the equal signs to be the same length as the title.","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"622d8f63b2ed1d5650687ee50b7a07087695931a","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Keystone as a SAML2 Service Provider"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp key-mgmt \u003chttps://blueprints.launchpad.net/keystone/+spec/key-mgmt\u003e`_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_86e30105","line":8,"in_reply_to":"ba8a016a_89a55f05","updated":"2015-11-17 18:46:40.000000000","message":"Done","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7ff25c583c910ad2877674408b4353024301e2d2","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* Identity Provider entityId"},{"line_number":29,"context_line":"* Identity Provider endpoints"},{"line_number":30,"context_line":"* Identity Provider public keys used for signing and/or encrypting of the"},{"line_number":31,"context_line":"  assertions."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Identity Provider administrator wishing to change a set of configuration should"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_696efb97","line":30,"updated":"2015-11-17 16:14:14.000000000","message":"aren\u0027t the IdP public keys used for verifying or decrypting assertions?","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"622d8f63b2ed1d5650687ee50b7a07087695931a","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* Identity Provider entityId"},{"line_number":29,"context_line":"* Identity Provider endpoints"},{"line_number":30,"context_line":"* Identity Provider public keys used for signing and/or encrypting of the"},{"line_number":31,"context_line":"  assertions."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Identity Provider administrator wishing to change a set of configuration should"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_577dc9af","line":30,"in_reply_to":"ba8a016a_696efb97","updated":"2015-11-17 18:46:40.000000000","message":"yeah, I was thinking about the other side (IdP) who signs and encrypts, but on the other hand they would use private keys for that :-)","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7ff25c583c910ad2877674408b4353024301e2d2","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Providers. Unfortunately the \"update metadata/propagate changes\" cycle is not"},{"line_number":36,"context_line":"sufficient when it comes to quick keys revocation.  If the Identity Providers"},{"line_number":37,"context_line":"key has been compromised there is a chance that attacker will use it to access"},{"line_number":38,"context_line":"cloud provider (or any other Service Provider)."},{"line_number":39,"context_line":"There should be a robust and easy way for keys revocation to minimize risk"},{"line_number":40,"context_line":"after IdP has been compromised. This also means the changes should be executed"},{"line_number":41,"context_line":"immediately after the client\u0027s request, preferably by the client herself or the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_49d21702","line":38,"updated":"2015-11-17 16:14:14.000000000","message":"So, to recap, this is a problem because it is painful for deployers to rotate keys. Painful in the sense that it requires a manual kick of each httpd server in order to read new configs, etc... \n\nright?","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"622d8f63b2ed1d5650687ee50b7a07087695931a","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Providers. Unfortunately the \"update metadata/propagate changes\" cycle is not"},{"line_number":36,"context_line":"sufficient when it comes to quick keys revocation.  If the Identity Providers"},{"line_number":37,"context_line":"key has been compromised there is a chance that attacker will use it to access"},{"line_number":38,"context_line":"cloud provider (or any other Service Provider)."},{"line_number":39,"context_line":"There should be a robust and easy way for keys revocation to minimize risk"},{"line_number":40,"context_line":"after IdP has been compromised. This also means the changes should be executed"},{"line_number":41,"context_line":"immediately after the client\u0027s request, preferably by the client herself or the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_b7d195cf","line":38,"in_reply_to":"ba8a016a_49d21702","updated":"2015-11-17 18:46:40.000000000","message":"I think rotation is not a big problem. You don\u0027t rotate your keys too often. It depends what\u0027s your expiration date but typically we are talking years, right? \nI think the problem here was \u0027quick way for revoking my  key\u0027 -\u003e when I realize that somebody stole my private key I want my public/private keys unusable as soon as possible.","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7ff25c583c910ad2877674408b4353024301e2d2","unresolved":false,"context_lines":[{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules. Almost all configuration would be"},{"line_number":54,"context_line":"configured via dynamic API calls"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_29731317","line":54,"updated":"2015-11-17 16:14:14.000000000","message":"nit: missing punctuation at the end of this sentence.","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"622d8f63b2ed1d5650687ee50b7a07087695931a","unresolved":false,"context_lines":[{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules. Almost all configuration would be"},{"line_number":54,"context_line":"configured via dynamic API calls"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_46ed19ee","line":54,"in_reply_to":"ba8a016a_29731317","updated":"2015-11-17 18:46:40.000000000","message":"Done","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7ff25c583c910ad2877674408b4353024301e2d2","unresolved":false,"context_lines":[{"line_number":70,"context_line":"objects configured in keystone should be granted to non admin users i.e."},{"line_number":71,"context_line":"operators working as a 1st line of support. All required technicalities are"},{"line_number":72,"context_line":"implemented in today\u0027s versions of OpenStack. What is more, this scenario will"},{"line_number":73,"context_line":"atomatically handle all federated protocols as well align with recommendations"},{"line_number":74,"context_line":"for sharing configurations via exposed metadata between trusted peers (main"},{"line_number":75,"context_line":"solution assumes clients would manually upload files to barbican)"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_09fdef39","line":73,"updated":"2015-11-17 16:14:14.000000000","message":"automatically*","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"622d8f63b2ed1d5650687ee50b7a07087695931a","unresolved":false,"context_lines":[{"line_number":70,"context_line":"objects configured in keystone should be granted to non admin users i.e."},{"line_number":71,"context_line":"operators working as a 1st line of support. All required technicalities are"},{"line_number":72,"context_line":"implemented in today\u0027s versions of OpenStack. What is more, this scenario will"},{"line_number":73,"context_line":"atomatically handle all federated protocols as well align with recommendations"},{"line_number":74,"context_line":"for sharing configurations via exposed metadata between trusted peers (main"},{"line_number":75,"context_line":"solution assumes clients would manually upload files to barbican)"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_26c9f578","line":73,"in_reply_to":"ba8a016a_09fdef39","updated":"2015-11-17 18:46:40.000000000","message":"thanks!","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7ff25c583c910ad2877674408b4353024301e2d2","unresolved":false,"context_lines":[{"line_number":78,"context_line":"---------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"There is a great security impact as software handling SAML2 protocol must be"},{"line_number":81,"context_line":"written with security in mind and new code should be carefully pentested."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Notifications Impact"},{"line_number":84,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_e9bf4b5e","line":81,"updated":"2015-11-17 16:14:14.000000000","message":"Do we have specific RFCs to implement here? I think eliminating ambiguity when dealing with security code would be the best starting point if we are going to take on this risk.","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"622d8f63b2ed1d5650687ee50b7a07087695931a","unresolved":false,"context_lines":[{"line_number":78,"context_line":"---------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"There is a great security impact as software handling SAML2 protocol must be"},{"line_number":81,"context_line":"written with security in mind and new code should be carefully pentested."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Notifications Impact"},{"line_number":84,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_172f41f7","line":81,"in_reply_to":"ba8a016a_e9bf4b5e","updated":"2015-11-17 18:46:40.000000000","message":"it\u0027s not a RFC but a specification: http://saml.xml.org/saml-specifications","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7ff25c583c910ad2877674408b4353024301e2d2","unresolved":false,"context_lines":[{"line_number":96,"context_line":"------------------"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Keystone would need to store all HTTP sessions as well as handle and evict them"},{"line_number":99,"context_line":"correctly Depending on the backend and whether caching is used, performance may"},{"line_number":100,"context_line":"be degraded in comparison to the one we have today with Apache modules used."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Other Deployer Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_c94a8783","line":99,"updated":"2015-11-17 16:14:14.000000000","message":"nit: missing punctuation between \u0027correctly\u0027 and \u0027Depending\u0027.","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7ff25c583c910ad2877674408b4353024301e2d2","unresolved":false,"context_lines":[{"line_number":150,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"We may want to depend on `pysaml2 \u003chttps://pypi.python.org/pypi/pysaml2\u003e`_"},{"line_number":153,"context_line":"library or implement everything from scratch."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_492697cf","line":153,"updated":"2015-11-17 16:14:14.000000000","message":"Do we have a dependency for depending on Barbican on some way? Is that possible today? I thought we were blocked by the \"chicken and egg\" problem there.","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"622d8f63b2ed1d5650687ee50b7a07087695931a","unresolved":false,"context_lines":[{"line_number":150,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"We may want to depend on `pysaml2 \u003chttps://pypi.python.org/pypi/pysaml2\u003e`_"},{"line_number":153,"context_line":"library or implement everything from scratch."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_57d709ed","line":153,"in_reply_to":"ba8a016a_492697cf","updated":"2015-11-17 18:46:40.000000000","message":"This i am not sure and I will be happy to listen what Barbican folks have to say in that matter :-)","commit_id":"dfd3e86cb7f858392354ddec38e8bf70dcc9cdfc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"3c1bcc1bce1a35d0930c82b931eef287c5af802b","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules. Almost all configuration would be"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba8a016a_f35a0350","line":50,"updated":"2015-11-21 02:38:08.000000000","message":"how does keystone authenticate to barbican?","commit_id":"42989290fce5095736b0b9e2195c4dfbad940f29"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2f06820fab516938c43799742562876ca7c26cdb","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules. Almost all configuration would be"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba8a016a_a16145aa","line":50,"in_reply_to":"ba8a016a_f35a0350","updated":"2015-11-23 19:26:02.000000000","message":"I was curious about that same question in the previous patch set. Keystone will have to do the following: \n\n    - user goes to keystone to revoke a key\n    - keystone goes to barbican to request key\n    - barbican asks keystone if it can access the key it wants? \n\nIs that how this would work or am I missing something? Or, does the user have to interact directly with barbican on order to revoke keys?","commit_id":"42989290fce5095736b0b9e2195c4dfbad940f29"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"3c1bcc1bce1a35d0930c82b931eef287c5af802b","unresolved":false,"context_lines":[{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules. Almost all configuration would be"},{"line_number":54,"context_line":"configured via dynamic API calls"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba8a016a_1311c75d","line":54,"updated":"2015-11-21 02:38:08.000000000","message":"Are you suggesting here that keystone would fetch the keys from barbican on every federated login? If so are we sure this is a good idea? If not what is the difference between this and making the `n` seconds smaller?","commit_id":"42989290fce5095736b0b9e2195c4dfbad940f29"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"3c1bcc1bce1a35d0930c82b931eef287c5af802b","unresolved":false,"context_lines":[{"line_number":72,"context_line":"implemented in today\u0027s versions of OpenStack. What is more, this scenario will"},{"line_number":73,"context_line":"automatically handle all federated protocols as well align with recommendations"},{"line_number":74,"context_line":"for sharing configurations via exposed metadata between trusted peers (main"},{"line_number":75,"context_line":"solution assumes clients would manually upload files to barbican)"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Security Impact"},{"line_number":78,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba8a016a_133a27e8","line":75,"updated":"2015-11-21 02:38:08.000000000","message":"Is this a real problem? I feel if i\u0027ve lost control of my SAML private keys you would want to notify and reboot keystone or httpds across your network anyway. I\u0027m thinking that having this propogate within single hours is impressive.","commit_id":"42989290fce5095736b0b9e2195c4dfbad940f29"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"375decfe2ac5f18647f23f1e8d0fe8806a14291f","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Problem Description"},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"As of today, keystone works as a wsgi application deployed on top of"},{"line_number":17,"context_line":"recommended Apache HTTPD server.  When it comes to federated authentication all"},{"line_number":18,"context_line":"protocol specific details are handled by the HTTPD. As an effect, all the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_c64fdfbc","line":15,"updated":"2015-12-01 15:12:22.000000000","message":"We seem to be going full circle here. If you remember, the first implementation of federated keystone performed by Kent implemented all the protocol handling within Keystone, but with one big difference to this spec, namely:\n\nOur design was federation protocol independent and allowed multiple federation protocols to be plugged in to Keystone. This spec is not. It is for this reason that I suggest we should reject it.\n\nIt is imperative that Keystone is not hardcoded to support only one federation protocol, as these come and go. Google and others are now supporting OpenID Connect for example.\n\nWe spent a long time fixing the original Horizon implementation that had lots of SAML protocol bits hard coded in, so as to allow any federation protocol to work with Keystone. We do not want to make the same mistake again.","commit_id":"084827a0b781b8c729647c1f1dae8caf81ee5d52"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5e447adfac70bc241ae2bb0a92cde69482838883","unresolved":false,"context_lines":[{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_8ae7cc3f","line":49,"updated":"2015-11-24 17:13:02.000000000","message":"For this, would we start with only supporting SAML2 protocols?\n\nAs we look to support more, we will have to own that code in Keystone, right?","commit_id":"084827a0b781b8c729647c1f1dae8caf81ee5d52"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5e447adfac70bc241ae2bb0a92cde69482838883","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Implement whole SAML2 functionalities (both WebSSO and ECP) in keystone with"},{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules. Almost all configuration would be"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_ea48d82f","line":50,"updated":"2015-11-24 17:13:02.000000000","message":"This would require barbican in keystone deployments that want to use federation.","commit_id":"084827a0b781b8c729647c1f1dae8caf81ee5d52"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5e447adfac70bc241ae2bb0a92cde69482838883","unresolved":false,"context_lines":[{"line_number":49,"context_line":"barbican serving as a keys management service.  Clients would upload their"},{"line_number":50,"context_line":"public keys to barbican on their own and revoke when appropriate.  Keystone"},{"line_number":51,"context_line":"being a native, fully fledged SAML2 Service Provider would use barbican and"},{"line_number":52,"context_line":"stored keys for SAML signature validation and decryption.  That way there would"},{"line_number":53,"context_line":"be no need to using Apache modules. Almost all configuration would be"},{"line_number":54,"context_line":"configured via dynamic API calls"},{"line_number":55,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_6a94e836","line":52,"updated":"2015-11-24 17:13:02.000000000","message":"Does barbican support validating of SAML assertions? Do we think that would be a better place for this kind of validation to live?","commit_id":"084827a0b781b8c729647c1f1dae8caf81ee5d52"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5e447adfac70bc241ae2bb0a92cde69482838883","unresolved":false,"context_lines":[{"line_number":58,"context_line":"------------"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Rely on today\u0027s design. If the IdP has been compromised and keys need to be"},{"line_number":61,"context_line":"revoked simply disable ``Idenity Provider`` and/or ``Protocol`` in keystone."},{"line_number":62,"context_line":"That being said, a module handling the protocol (say ``mod_shib``) will let"},{"line_number":63,"context_line":"attacker get through, however keystone will raise appropriate HTTP status code"},{"line_number":64,"context_line":"(401 for disabled Identity Provider and 404 for deleted Identity Provider)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_2a1100ad","line":61,"updated":"2015-11-24 17:13:02.000000000","message":"Identity*","commit_id":"084827a0b781b8c729647c1f1dae8caf81ee5d52"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5e447adfac70bc241ae2bb0a92cde69482838883","unresolved":false,"context_lines":[{"line_number":66,"context_line":"metadata and update it\u0027s public keys, making compromised keys unusable."},{"line_number":67,"context_line":"Depending on the SLA and other agreements with customers Apache modules should"},{"line_number":68,"context_line":"be configured to refresh trusted IdP\u0027s metadata within minutes instead of"},{"line_number":69,"context_line":"hours.  Additionally an access to modifying identity provider and protocol"},{"line_number":70,"context_line":"objects configured in keystone should be granted to non admin users i.e."},{"line_number":71,"context_line":"operators working as a 1st line of support. All required technicalities are"},{"line_number":72,"context_line":"implemented in today\u0027s versions of OpenStack. What is more, this scenario will"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_aa4bb0af","line":69,"updated":"2015-11-24 17:13:02.000000000","message":"nit: Additionally, access to modifying...","commit_id":"084827a0b781b8c729647c1f1dae8caf81ee5d52"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5e447adfac70bc241ae2bb0a92cde69482838883","unresolved":false,"context_lines":[{"line_number":82,"context_line":"4) Client updates his new keys and updates his IdP metadata, effectively"},{"line_number":83,"context_line":"   propagating changes to all trusted service providers. If the attacker"},{"line_number":84,"context_line":"   tries to access cloud provider shibboleth/mellon will properly validate key"},{"line_number":85,"context_line":"   (as the new metadata has not yet been propagaet), however keystone will"},{"line_number":86,"context_line":"   deny access as the identity provider object was disabled."},{"line_number":87,"context_line":"5) After the changes were correctly propagated, support enables identity"},{"line_number":88,"context_line":"   provider in keystone making it accessible again."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_4a9564e2","line":85,"updated":"2015-11-24 17:13:02.000000000","message":"propagated*","commit_id":"084827a0b781b8c729647c1f1dae8caf81ee5d52"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5e447adfac70bc241ae2bb0a92cde69482838883","unresolved":false,"context_lines":[{"line_number":85,"context_line":"   (as the new metadata has not yet been propagaet), however keystone will"},{"line_number":86,"context_line":"   deny access as the identity provider object was disabled."},{"line_number":87,"context_line":"5) After the changes were correctly propagated, support enables identity"},{"line_number":88,"context_line":"   provider in keystone making it accessible again."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_cd416e3b","line":88,"updated":"2015-11-24 17:13:02.000000000","message":"This doesn\u0027t require apache to be restarted right? If the shibboleth configuration pulls metadata from a matedataURL of if identity provider, it should get it automatically.\n\nIf the shibboleth configuration has the public keys locally, then the service provider will have to go through and update the keys manually, requiring a restart of apache?\n\nI don\u0027t think this needs to be added to the list, I\u0027m just thinking through each case. Thanks for adding the list btw :)","commit_id":"084827a0b781b8c729647c1f1dae8caf81ee5d52"}]}