)]}'
{"doc/security-guide/ch024_authentication.xml":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"ac07715dbb56df90032da9222b5b424508d45b62","unresolved":false,"context_lines":[{"line_number":64,"context_line":"        \u003cpara\u003eThe Identity Service supports client authentication for SSL which may be enabled. SSL client authentication provides an additional authentication factor, in addition to the username / password, that provides greater reliability on user identification. It reduces the risk of unauthorized access when usernames and passwords may be compromised.  However, there is additional administrative overhead and cost to issue certificates to users that may not be feasible in every deployment.\u003c/para\u003e"},{"line_number":65,"context_line":"        \u003cpara\u003eNOTE: We recommend using client authentication using SSL for the authentication of services to Identity.\u003c/para\u003e"},{"line_number":66,"context_line":"        \u003cpara\u003eThe cloud administrator should protect sensitive configuration files for unauthorized modification. This can be achieved with mandatory access control frameworks such as SELinux, including \u003cliteral\u003e/etc/keystone.conf\u003c/literal\u003e and X.509 certificates.\u003c/para\u003e"},{"line_number":67,"context_line":"        \u003cpara\u003eOpenStack services use self signed certificates with Keystone. We can enable it by defining \u003cliteral\u003einsecure\u003dTrue\u003c/literal\u003e in \u003cliteral\u003e[filter:authtoken]\u003c/literal\u003e in \u003cfilename\u003e/etc/nova/api.paste.ini\u003c/filename\u003e file. The same will be enabled for other components as well.\u003c/para\u003e       "},{"line_number":68,"context_line":"\u003c/section\u003e"},{"line_number":69,"context_line":"      \u003csection xml:id\u003d\"ch024_authentication-idp267040\"\u003e"},{"line_number":70,"context_line":"        \u003ctitle\u003eAdministrative Users\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"AAAAT3%2F%2Fy2Q%3D","line":67,"updated":"2013-12-31 12:41:14.000000000","message":"I don\u0027t think that this information is correct. You can use self signed certificates but you don\u0027t have to...\n\nAlso, there\u0027s whitespace at the end of the line. Please reformat to not create new lines longer than 72 characters and remove the whitespace.","commit_id":"d4f64e0be1bcb3de9cdf4994e90ddb9062532c1b"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"3503387285aad0a1d66839e91d4086fcc485c339","unresolved":false,"context_lines":[{"line_number":62,"context_line":"        \u003cpara\u003eAs described in the \u003clink xlink:href\u003d\"http://docs.openstack.org/admin-guide-cloud/content/index.html\"\u003e\u003ccitetitle\u003eOpenStack Cloud Administrator Guide\u003c/citetitle\u003e\u003c/link\u003e, cloud administrators must define a user for each service, with a role of Admin. This service user account provides the service with the authorization to authenticate users.\u003c/para\u003e"},{"line_number":63,"context_line":"        \u003cpara\u003eThe Compute and Object Storage services can be configured to use either the \"tempAuth\" file or Identity Service to store authentication information. The \"tempAuth\" solution MUST NOT be deployed in a production environment since it stores passwords in plain text.\u003c/para\u003e"},{"line_number":64,"context_line":"        \u003cpara\u003eThe Identity Service supports client authentication for SSL which may be enabled. SSL client authentication provides an additional authentication factor, in addition to the username / password, that provides greater reliability on user identification. It reduces the risk of unauthorized access when usernames and passwords may be compromised.  However, there is additional administrative overhead and cost to issue certificates to users that may not be feasible in every deployment.\u003c/para\u003e"},{"line_number":65,"context_line":"        \u003cpara\u003eNOTE: We recommend using client authentication using SSL for the authentication of services to Identity.\u003c/para\u003e"},{"line_number":66,"context_line":"        \u003cpara\u003eThe cloud administrator should protect sensitive configuration files for unauthorized modification. This can be achieved with mandatory access control frameworks such as SELinux, including \u003cliteral\u003e/etc/keystone.conf\u003c/literal\u003e and X.509 certificates.\u003c/para\u003e"},{"line_number":67,"context_line":"        \u003cpara\u003eSelf signed certificates are used by OpenStack services to communicate with Identity Service but we can disable it by defining \u003cliteral\u003einsecure\u003dFalse\u003c/literal\u003e in \u003cliteral\u003e[filter:authtoken]\u003c/literal\u003e in \u003cfilename\u003e/etc/nova/api.paste.ini\u003c/filename\u003e file. The same will be enabled for other components as well.\u003c/para\u003e"},{"line_number":68,"context_line":"\u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"AAAAT3%2F%2Ft74%3D","line":65,"updated":"2014-01-02 23:31:18.000000000","message":"\u003cnote\u003e\u003cpara\u003eWe recommend that you use client authentication with SSL for the authentication of services to the Identity Service.\u003c/para\u003e\u003c/note\u003e","commit_id":"afcb3c1eb81deb3ec6d71893ad676cd37c81dc8f"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"3503387285aad0a1d66839e91d4086fcc485c339","unresolved":false,"context_lines":[{"line_number":64,"context_line":"        \u003cpara\u003eThe Identity Service supports client authentication for SSL which may be enabled. SSL client authentication provides an additional authentication factor, in addition to the username / password, that provides greater reliability on user identification. It reduces the risk of unauthorized access when usernames and passwords may be compromised.  However, there is additional administrative overhead and cost to issue certificates to users that may not be feasible in every deployment.\u003c/para\u003e"},{"line_number":65,"context_line":"        \u003cpara\u003eNOTE: We recommend using client authentication using SSL for the authentication of services to Identity.\u003c/para\u003e"},{"line_number":66,"context_line":"        \u003cpara\u003eThe cloud administrator should protect sensitive configuration files for unauthorized modification. This can be achieved with mandatory access control frameworks such as SELinux, including \u003cliteral\u003e/etc/keystone.conf\u003c/literal\u003e and X.509 certificates.\u003c/para\u003e"},{"line_number":67,"context_line":"        \u003cpara\u003eSelf signed certificates are used by OpenStack services to communicate with Identity Service but we can disable it by defining \u003cliteral\u003einsecure\u003dFalse\u003c/literal\u003e in \u003cliteral\u003e[filter:authtoken]\u003c/literal\u003e in \u003cfilename\u003e/etc/nova/api.paste.ini\u003c/filename\u003e file. The same will be enabled for other components as well.\u003c/para\u003e"},{"line_number":68,"context_line":"\u003c/section\u003e"},{"line_number":69,"context_line":"      \u003csection xml:id\u003d\"ch024_authentication-idp267040\"\u003e"},{"line_number":70,"context_line":"        \u003ctitle\u003eAdministrative Users\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"AAAAT3%2F%2Ft7k%3D","line":67,"updated":"2014-01-02 23:31:18.000000000","message":"\u003cpara\u003eOpenStack services use self-signed certificates to communicate with the Identity Service. To disable these certificates, set \u003cliteral\u003einsecure\u003dFalse\u003c/literal\u003e in the \u003cliteral\u003e[filter:authtoken]\u003c/literal\u003e section in the \u003cfilename\u003e/etc/nova/api.paste.ini\u003c/filename\u003e file. This setting also disables certificates for other components.\u003c/para\u003e","commit_id":"afcb3c1eb81deb3ec6d71893ad676cd37c81dc8f"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"33117c072a9fb87341066aa5db404b6373e1fcf2","unresolved":false,"context_lines":[{"line_number":66,"context_line":"          \u003cpara\u003eWe recommend that you use client authentication with SSL for the authentication of services to the Identity Service.\u003c/para\u003e"},{"line_number":67,"context_line":"        \u003c/note\u003e"},{"line_number":68,"context_line":"        \u003cpara\u003eThe cloud administrator should protect sensitive configuration files for unauthorized modification. This can be achieved with mandatory access control frameworks such as SELinux, including \u003cliteral\u003e/etc/keystone.conf\u003c/literal\u003e and X.509 certificates.\u003c/para\u003e"},{"line_number":69,"context_line":"        \u003cpara\u003eOpenStack services use self-signed certificates to communicate with the Identity Service. To disable these certificates, set \u003cliteral\u003einsecure\u003dFalse\u003c/literal\u003e in the \u003cliteral\u003e[filter:authtoken]\u003c/literal\u003e section in the \u003cfilename\u003e/etc/nova/api.paste.ini\u003c/filename\u003e file. This setting also disables certificates for other components.\u003c/para\u003e"},{"line_number":70,"context_line":"     \u003c/section\u003e"},{"line_number":71,"context_line":"      \u003csection xml:id\u003d\"ch024_authentication-idp267040\"\u003e"},{"line_number":72,"context_line":"        \u003ctitle\u003eAdministrative Users\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"AAAAT3%2F%2FtEU%3D","line":69,"updated":"2014-01-03 06:06:51.000000000","message":"I think it\u0027s wrong to state this as a general fact \"OpenStack Service use self-signed certificates\". self-signed certificates are an option that the admin makes but not a necessity. Let\u0027s make this clear. this paragraph applies, if the admin chooses this option. My understanding of the situation is:\n\nCertificates need to be signed by an external authority or can be signed by the admin itself. If there is no certificate available for the signed authority, the signature cannot be verified. OpenStack services by default will check the signatures. To disable this check, set insecure\u003dFalse... This setting also disables *checking* of certificates for other components.","commit_id":"b9e6c623be96edf4f80a5a021943225be6bfd674"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"f5fc185953f513747b47e6423ce07d62d9d3be39","unresolved":false,"context_lines":[{"line_number":66,"context_line":"          \u003cpara\u003eWe recommend that you use client authentication with SSL for the authentication of services to the Identity Service.\u003c/para\u003e"},{"line_number":67,"context_line":"        \u003c/note\u003e"},{"line_number":68,"context_line":"        \u003cpara\u003eThe cloud administrator should protect sensitive configuration files for unauthorized modification. This can be achieved with mandatory access control frameworks such as SELinux, including \u003cliteral\u003e/etc/keystone.conf\u003c/literal\u003e and X.509 certificates.\u003c/para\u003e"},{"line_number":69,"context_line":"        \u003cpara\u003eSelf-signed certificates provides an option to Cloud administrators to verify HTTP connections or insecure to specifically ignore HTTPS validation. If a cloud admin chooses this option, the certificates needs to be signed by external authority or can be signed by admin itself. If there is no certificate available for the signed authority, the signature cannot be verified. OpenStack services by default will check the signatures. To disable these certificates, set \u003cliteral\u003einsecure\u003dFalse\u003c/literal\u003e in the \u003cliteral\u003e[filter:authtoken]\u003c/literal\u003e section in the \u003cfilename\u003e/etc/nova/api.paste.ini\u003c/filename\u003e file. This setting also disables certificates for other components.\u003c/para\u003e"},{"line_number":70,"context_line":"     \u003c/section\u003e"},{"line_number":71,"context_line":"      \u003csection xml:id\u003d\"ch024_authentication-idp267040\"\u003e"},{"line_number":72,"context_line":"        \u003ctitle\u003eAdministrative Users\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":6,"id":"AAAAT3%2F%2Frgc%3D","line":69,"updated":"2014-01-03 16:15:30.000000000","message":"Self-signed certificates enable cloud administrators to verify HTTP connections or ignore HTTPs validation. If a cloud administrator chooses to use self-signed certificates, the certificates must be signed by an external authority or by the cloud administrator. If no certificate is available for the signed authority, xxx\n\n(I don\u0027t know if I\u0027ve got the meaning right - but this text is confusing to me.)","commit_id":"95a9a82a8fffb437cedf20e12fe7597507e282b5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"fe7448ae3b277b1ade11f17d5d45359b15668183","unresolved":false,"context_lines":[{"line_number":66,"context_line":"          \u003cpara\u003eWe recommend that you use client authentication with SSL for the authentication of services to the Identity Service.\u003c/para\u003e"},{"line_number":67,"context_line":"        \u003c/note\u003e"},{"line_number":68,"context_line":"        \u003cpara\u003eThe cloud administrator should protect sensitive configuration files for unauthorized modification. This can be achieved with mandatory access control frameworks such as SELinux, including \u003cliteral\u003e/etc/keystone.conf\u003c/literal\u003e and X.509 certificates.\u003c/para\u003e"},{"line_number":69,"context_line":"        \u003cpara\u003eSelf-signed certificates enable cloud administrators to verify HTTP connections or ignore HTTPs validation. If a cloud administrator chooses to use self-signed certificates, the certificates must be signed by an external authority or by the cloud administrator. If no certificate is available for the signed authority, the signature cannot be verified. OpenStack services by default will check the signatures. To disable these certificates, set \u003cliteral\u003einsecure\u003dFalse\u003c/literal\u003e in the \u003cliteral\u003e[filter:authtoken]\u003c/literal\u003e section in the \u003cfilename\u003e/etc/nova/api.paste.ini\u003c/filename\u003e file. This setting also disables certificates for other components.\u003c/para\u003e"},{"line_number":70,"context_line":"     \u003c/section\u003e"},{"line_number":71,"context_line":"      \u003csection xml:id\u003d\"ch024_authentication-idp267040\"\u003e"},{"line_number":72,"context_line":"        \u003ctitle\u003eAdministrative Users\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"AAAAUH%2F%2F%2FJU%3D","line":69,"updated":"2014-01-04 20:34:46.000000000","message":"A self-signed certificate is signed by the admin herself. The first two sentences just do not make sense to me as written.","commit_id":"2e8338102c28408db0ead353006123573d397e69"}]}