)]}'
{"doc/source/configuration.rst":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"b07958c3145c24b8e70fbbfd73ba00d39593c5ad","unresolved":false,"context_lines":[{"line_number":346,"context_line":"available as Certificate Authority (CA) certificate.  These files can be"},{"line_number":347,"context_line":"generated either using the keystone-manage utility, or externally generated."},{"line_number":348,"context_line":""},{"line_number":349,"context_line":"Use of keystone-manage\u0027s pki_setup command is discouraged in favor using"},{"line_number":350,"context_line":"an external CA. This is because the CA secret key should generally be kept"},{"line_number":351,"context_line":"apart from the token signing secret keys so that a compromise of a node"},{"line_number":352,"context_line":"does not lead to an attacker being able to generate their own keystone"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAWH%2F%2Fk6I%3D","line":349,"updated":"2014-03-16 12:01:25.000000000","message":"s/favor/favor of/","commit_id":"8f218031fd0aa3f5cb41828e67235006cb196c63"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e9d0ea63866cf396591927d62b47d62f356ade02","unresolved":false,"context_lines":[{"line_number":346,"context_line":"available as Certificate Authority (CA) certificate.  These files can be"},{"line_number":347,"context_line":"generated either using the keystone-manage utility, or externally generated."},{"line_number":348,"context_line":""},{"line_number":349,"context_line":"Use of keystone-manage\u0027s pki_setup command is discouraged in favor of"},{"line_number":350,"context_line":"using an external CA. This is because the CA secret key should generally"},{"line_number":351,"context_line":"be kept apart from the token signing secret keys so that a compromise"},{"line_number":352,"context_line":"of a node does not lead to an attacker being able to generate their"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWH%2F%2BK9M%3D","line":349,"updated":"2014-03-28 16:40:23.000000000","message":"``keystone-manage``\u0027s ``pki_setup``","commit_id":"c8528dccf8aafc55ec4b752f4e9e9b6960642403"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0bd147fc572b79803211282446152056646d479f","unresolved":false,"context_lines":[{"line_number":350,"context_line":"favor of using an external CA. This is because the CA secret key should"},{"line_number":351,"context_line":"generally be kept apart from the token signing secret keys so that a"},{"line_number":352,"context_line":"compromise of a node does not lead to an attacker being able to generate"},{"line_number":353,"context_line":"their own keystone tokens. This seems like a low probability attack"},{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAXH%2F%2F1EM%3D","line":353,"updated":"2014-04-17 05:53:51.000000000","message":"capitalize K in keystone here, too","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d184fe8adbdb9438a3e5ad560a98f264839f1e37","unresolved":false,"context_lines":[{"line_number":350,"context_line":"favor of using an external CA. This is because the CA secret key should"},{"line_number":351,"context_line":"generally be kept apart from the token signing secret keys so that a"},{"line_number":352,"context_line":"compromise of a node does not lead to an attacker being able to generate"},{"line_number":353,"context_line":"their own keystone tokens. This seems like a low probability attack"},{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAWH%2F%2BJ%2FM%3D","line":353,"updated":"2014-03-28 18:35:35.000000000","message":"suggest: attacker being able to create valid signed Keystone tokens.\n\n\"their own keystone tokens\" is not very descriptive.\n\nAlso suggest \"This seems like a\" to \"This is a\"","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"c3845c02cd676478a50c88ae9eaba5f50ccf0e6e","unresolved":false,"context_lines":[{"line_number":350,"context_line":"favor of using an external CA. This is because the CA secret key should"},{"line_number":351,"context_line":"generally be kept apart from the token signing secret keys so that a"},{"line_number":352,"context_line":"compromise of a node does not lead to an attacker being able to generate"},{"line_number":353,"context_line":"their own keystone tokens. This seems like a low probability attack"},{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAXH%2F%2FdBw%3D","line":353,"in_reply_to":"AAAAXH%2F%2F1EM%3D","updated":"2014-04-21 16:42:07.000000000","message":"Done","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d184fe8adbdb9438a3e5ad560a98f264839f1e37","unresolved":false,"context_lines":[{"line_number":351,"context_line":"generally be kept apart from the token signing secret keys so that a"},{"line_number":352,"context_line":"compromise of a node does not lead to an attacker being able to generate"},{"line_number":353,"context_line":"their own keystone tokens. This seems like a low probability attack"},{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."},{"line_number":357,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAWH%2F%2BJ%2B0%3D","line":354,"updated":"2014-03-28 18:35:35.000000000","message":"capital K in keystone","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"c3845c02cd676478a50c88ae9eaba5f50ccf0e6e","unresolved":false,"context_lines":[{"line_number":351,"context_line":"generally be kept apart from the token signing secret keys so that a"},{"line_number":352,"context_line":"compromise of a node does not lead to an attacker being able to generate"},{"line_number":353,"context_line":"their own keystone tokens. This seems like a low probability attack"},{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."},{"line_number":357,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAXH%2F%2FdB0%3D","line":354,"in_reply_to":"AAAAWH%2F%2BJ%2B0%3D","updated":"2014-04-21 16:42:07.000000000","message":"Done","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d184fe8adbdb9438a3e5ad560a98f264839f1e37","unresolved":false,"context_lines":[{"line_number":352,"context_line":"compromise of a node does not lead to an attacker being able to generate"},{"line_number":353,"context_line":"their own keystone tokens. This seems like a low probability attack"},{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."},{"line_number":357,"context_line":""},{"line_number":358,"context_line":"The files need to be in the locations specified by the top level Keystone"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAWH%2F%2BJ%2Bc%3D","line":355,"updated":"2014-03-28 18:35:35.000000000","message":"Suggest ending the paragraph and sentence after \"to the token backend\" (remove the rest of the sentence)","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"c3845c02cd676478a50c88ae9eaba5f50ccf0e6e","unresolved":false,"context_lines":[{"line_number":352,"context_line":"compromise of a node does not lead to an attacker being able to generate"},{"line_number":353,"context_line":"their own keystone tokens. This seems like a low probability attack"},{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."},{"line_number":357,"context_line":""},{"line_number":358,"context_line":"The files need to be in the locations specified by the top level Keystone"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAXH%2F%2FdB4%3D","line":355,"in_reply_to":"AAAAWH%2F%2BJ%2Bc%3D","updated":"2014-04-21 16:42:07.000000000","message":"Done","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4d161a38affd0ef6840ea3b20679af2d720f7da6","unresolved":false,"context_lines":[{"line_number":353,"context_line":"their own keystone tokens. This seems like a low probability attack"},{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."},{"line_number":357,"context_line":""},{"line_number":358,"context_line":"The files need to be in the locations specified by the top level Keystone"},{"line_number":359,"context_line":"configuration file as specified in the above section.  Additionally, the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAW3%2F%2FiOk%3D","line":356,"updated":"2014-04-13 15:14:48.000000000","message":"I think that being able to generate your own tokens with whatever authorities you want is a bigger threat than being limited to whatever tokens currently exist.\n\nAlso, I don\u0027t see how having access to the CA secret key means that they necessarily have access to the token backend.\n\nSuggest remove this sentence.","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"c3845c02cd676478a50c88ae9eaba5f50ccf0e6e","unresolved":false,"context_lines":[{"line_number":353,"context_line":"their own keystone tokens. This seems like a low probability attack"},{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."},{"line_number":357,"context_line":""},{"line_number":358,"context_line":"The files need to be in the locations specified by the top level Keystone"},{"line_number":359,"context_line":"configuration file as specified in the above section.  Additionally, the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAXH%2F%2FdCY%3D","line":356,"in_reply_to":"AAAAW3%2F%2FiOk%3D","updated":"2014-04-21 16:42:07.000000000","message":"The sentence above does not imply that access to the CA secret key means that they have access to the token backend. It suggests that access to the keystone machine means direct access to the token backend.\n\nI\u0027ve clarified it to say that compromise of a Keystone service machine\u0027s filesystem security would likely mean direct access to the token backend.\n\nAnyway, it seems unlikely to me that one would set up a machine in such a way where an attacker would be able to read the CA secret key, but not /etc/keystone/keystone.conf.","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4d161a38affd0ef6840ea3b20679af2d720f7da6","unresolved":false,"context_lines":[{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."},{"line_number":357,"context_line":""},{"line_number":358,"context_line":"The files need to be in the locations specified by the top level Keystone"},{"line_number":359,"context_line":"configuration file as specified in the above section.  Additionally, the"},{"line_number":360,"context_line":"private key should only be readable by the system user that will run Keystone."}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAW3%2F%2FiOA%3D","line":357,"updated":"2014-04-13 15:14:48.000000000","message":"Also, I think this information should be in the pki_setup command -- print out a warning when it\u0027s used and also in the keystone-manage man page.","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"c3845c02cd676478a50c88ae9eaba5f50ccf0e6e","unresolved":false,"context_lines":[{"line_number":354,"context_line":"vector, as compromise of the keystone machines also means direct access"},{"line_number":355,"context_line":"to the token backend, and thus no need to generate ones\u0027 own tokens,"},{"line_number":356,"context_line":"they can just steal all of the existing tokens."},{"line_number":357,"context_line":""},{"line_number":358,"context_line":"The files need to be in the locations specified by the top level Keystone"},{"line_number":359,"context_line":"configuration file as specified in the above section.  Additionally, the"},{"line_number":360,"context_line":"private key should only be readable by the system user that will run Keystone."}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAXH%2F%2FdCE%3D","line":357,"in_reply_to":"AAAAW3%2F%2FiOA%3D","updated":"2014-04-21 16:42:07.000000000","message":"Perhaps this could be a follow-up patch?","commit_id":"d93263d14f6c41b506f4520dfa7a5845b5ab9219"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"819066f806f8560f4f7919e6ce2a3fd089b20611","unresolved":false,"context_lines":[{"line_number":350,"context_line":"of using an external CA. This is because the CA secret key should generally"},{"line_number":351,"context_line":"be kept apart from the token signing secret keys so that a compromise of"},{"line_number":352,"context_line":"a node does not lead to an attacker being able to generate valid signed"},{"line_number":353,"context_line":"Keystone tokens. This is a low probability attack vector, as compromise of"},{"line_number":354,"context_line":"a Keystone service machine\u0027s filesystem security almost certainly means the"},{"line_number":355,"context_line":"attacker will be able to gain direct access to the token backend."},{"line_number":356,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAXH%2F%2FcVQ%3D","line":353,"updated":"2014-04-21 18:34:22.000000000","message":"I think this statement is rather vague. So we don\u0027t encourage self-signed CA. But we don\u0027t recommend a practical alternative for key management. I don\u0027t think (auth_token) middleware does CRL checking either so revoking a compromised token signing certificate likely constitutes a redeployment of Keystone.","commit_id":"2974ef3ccb2c3ecd45f6e95457c04612f5179e22"}]}