)]}'
{"security-threat-analysis/Keystone/Keystone_ThreatAnalysis_Index.md":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"b0bf19d2fc6add84ff11a5ecb18a9d4e209c4e44","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone Threat Analysis Index File"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"A list of major Keystone components and associated threat analysis reports."},{"line_number":4,"context_line":"(Link will be added later after completion of individual reports) "},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"Keystone High Level Analysis"},{"line_number":7,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":1,"id":"fa98f980_a9f0bcfd","line":4,"updated":"2014-09-12 15:28:42.000000000","message":"You have many extra whitespaces at end of line, please remove them.","commit_id":"a852d09471c019aec88ea0cf0c5e7ad10e9f24e5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone threat analysis index file"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"This file list major keystone components and link to the associated threat"},{"line_number":4,"context_line":"analysis reports. (link will be added later after completion of individual"},{"line_number":5,"context_line":"reports)."},{"line_number":6,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_edbe6aad","line":3,"updated":"2014-11-24 00:36:09.000000000","message":"capitalize Keystone consistently.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f34ca39a68ce7f5484ea730c9568c07ada02b949","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone threat analysis index file"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"This file list major keystone components and link to the associated threat"},{"line_number":4,"context_line":"analysis reports. (link will be added later after completion of individual"},{"line_number":5,"context_line":"reports)."},{"line_number":6,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_de99567a","line":3,"in_reply_to":"5a890539_edbe6aad","updated":"2014-11-24 06:38:49.000000000","message":"According to our conventions it should be lowercase - see https://wiki.openstack.org/wiki/Documentation/Conventions#Service_and_project_names","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":27,"context_line":" - ID-2.5: Identity service"},{"line_number":28,"context_line":" - ID-2.6: Assignment service"},{"line_number":29,"context_line":" - ID-2.7: Credentials service"},{"line_number":30,"context_line":" - ID-2.8: Policy service"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"#####Others:"},{"line_number":33,"context_line":" - ID-2.9: Filters including token_auth"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_cdd8ce20","line":30,"updated":"2014-11-24 00:36:09.000000000","message":"* Catalog","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":27,"context_line":" - ID-2.5: Identity service"},{"line_number":28,"context_line":" - ID-2.6: Assignment service"},{"line_number":29,"context_line":" - ID-2.7: Credentials service"},{"line_number":30,"context_line":" - ID-2.8: Policy service"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"#####Others:"},{"line_number":33,"context_line":" - ID-2.9: Filters including token_auth"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_cf2df990","line":30,"in_reply_to":"5a890539_cdd8ce20","updated":"2014-11-25 10:15:31.000000000","message":"Need to be added","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":30,"context_line":" - ID-2.8: Policy service"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"#####Others:"},{"line_number":33,"context_line":" - ID-2.9: Filters including token_auth"},{"line_number":34,"context_line":" - ID-2.10: Cache"},{"line_number":35,"context_line":" - ID-2.11: Notification system"},{"line_number":36,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_edd58ae5","line":33,"updated":"2014-11-24 00:36:09.000000000","message":"isn\u0027t this the same as Keystonemiddleware?","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":30,"context_line":" - ID-2.8: Policy service"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"#####Others:"},{"line_number":33,"context_line":" - ID-2.9: Filters including token_auth"},{"line_number":34,"context_line":" - ID-2.10: Cache"},{"line_number":35,"context_line":" - ID-2.11: Notification system"},{"line_number":36,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_c4ffa000","line":33,"in_reply_to":"5a890539_edd58ae5","updated":"2014-11-25 10:15:31.000000000","message":"In my understanding, keystonemiddleware is added to the pipeline of Identity consuming service (e.g., Nova).  Token_auth and other filters e.g., admin_token_auth are added to the pipeline of keystone (provider).","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"####ID-3: Persistence storage"},{"line_number":38,"context_line":" - ID-3.1: SQL back end"},{"line_number":39,"context_line":" - ID-3.2: LDAP back end"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"####ID-4: System"},{"line_number":42,"context_line":" - ID-4.1: Web server – WSGI server"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_2de4f2df","line":39,"updated":"2014-11-24 00:36:09.000000000","message":"* memcache backend end","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"####ID-3: Persistence storage"},{"line_number":38,"context_line":" - ID-3.1: SQL back end"},{"line_number":39,"context_line":" - ID-3.2: LDAP back end"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"####ID-4: System"},{"line_number":42,"context_line":" - ID-4.1: Web server – WSGI server"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_0f7aa187","line":39,"in_reply_to":"5a890539_2de4f2df","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"}],"security-threat-analysis/Keystone/Keystone_ThreatAnalysis_keystonemidddlware.md":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003ca name\u003d\"system\"/\u003e"},{"line_number":19,"context_line":"###System overview"},{"line_number":20,"context_line":"####Application version"},{"line_number":21,"context_line":"Keystonemiddleware Juno"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"####Application description"},{"line_number":24,"context_line":"Keystonemiddleware provides authentication and authorization features to web"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_cd4b6eaf","line":21,"updated":"2014-11-24 00:36:09.000000000","message":"The keystonemiddleware repo doesn\u0027t follow the integrated release, so there\u0027s no \"Juno\" release of keystonemiddleware. This should refer to the version number.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003ca name\u003d\"system\"/\u003e"},{"line_number":19,"context_line":"###System overview"},{"line_number":20,"context_line":"####Application version"},{"line_number":21,"context_line":"Keystonemiddleware Juno"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"####Application description"},{"line_number":24,"context_line":"Keystonemiddleware provides authentication and authorization features to web"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_6fdfa569","line":21,"in_reply_to":"5a890539_cd4b6eaf","updated":"2014-11-25 10:15:31.000000000","message":"Good point... done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"####Application description"},{"line_number":24,"context_line":"Keystonemiddleware provides authentication and authorization features to web"},{"line_number":25,"context_line":"services using OpenStack Identity API (keystone). It is placed in the"},{"line_number":26,"context_line":"configuration pipeline of WSGI enabled web services (e.g.,nova, glance) to"},{"line_number":27,"context_line":"support a common authentication protocol in use among OpenStack projects. The"},{"line_number":28,"context_line":"middleware component acts as a proxy that intercepts HTTP calls, validate the"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_2d0b128f","line":25,"updated":"2014-11-24 00:36:09.000000000","message":"capitalize Keystone","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"####Application description"},{"line_number":24,"context_line":"Keystonemiddleware provides authentication and authorization features to web"},{"line_number":25,"context_line":"services using OpenStack Identity API (keystone). It is placed in the"},{"line_number":26,"context_line":"configuration pipeline of WSGI enabled web services (e.g.,nova, glance) to"},{"line_number":27,"context_line":"support a common authentication protocol in use among OpenStack projects. The"},{"line_number":28,"context_line":"middleware component acts as a proxy that intercepts HTTP calls, validate the"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_6f740568","line":25,"in_reply_to":"5a890539_2d0b128f","updated":"2014-11-25 10:15:31.000000000","message":"doc convention contradicts","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":23,"context_line":"####Application description"},{"line_number":24,"context_line":"Keystonemiddleware provides authentication and authorization features to web"},{"line_number":25,"context_line":"services using OpenStack Identity API (keystone). It is placed in the"},{"line_number":26,"context_line":"configuration pipeline of WSGI enabled web services (e.g.,nova, glance) to"},{"line_number":27,"context_line":"support a common authentication protocol in use among OpenStack projects. The"},{"line_number":28,"context_line":"middleware component acts as a proxy that intercepts HTTP calls, validate the"},{"line_number":29,"context_line":"headers, and populates HTTP headers in the request context for use in the"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_4dfcde72","line":26,"updated":"2014-11-24 00:36:09.000000000","message":"change \"configuration\" to \"paste\"\n\nchange \"nova\" to \"nova-api\" and \"glance\" to \"glance-api\"","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":25,"context_line":"services using OpenStack Identity API (keystone). It is placed in the"},{"line_number":26,"context_line":"configuration pipeline of WSGI enabled web services (e.g.,nova, glance) to"},{"line_number":27,"context_line":"support a common authentication protocol in use among OpenStack projects. The"},{"line_number":28,"context_line":"middleware component acts as a proxy that intercepts HTTP calls, validate the"},{"line_number":29,"context_line":"headers, and populates HTTP headers in the request context for use in the"},{"line_number":30,"context_line":"downstream WSGI middleware or applications."},{"line_number":31,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_cdefeeaf","line":28,"updated":"2014-11-24 00:36:09.000000000","message":"change \"validate\" to \"validates\"","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":25,"context_line":"services using OpenStack Identity API (keystone). It is placed in the"},{"line_number":26,"context_line":"configuration pipeline of WSGI enabled web services (e.g.,nova, glance) to"},{"line_number":27,"context_line":"support a common authentication protocol in use among OpenStack projects. The"},{"line_number":28,"context_line":"middleware component acts as a proxy that intercepts HTTP calls, validate the"},{"line_number":29,"context_line":"headers, and populates HTTP headers in the request context for use in the"},{"line_number":30,"context_line":"downstream WSGI middleware or applications."},{"line_number":31,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_4fad899a","line":28,"in_reply_to":"5a890539_cdefeeaf","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":33,"context_line":"From Juno release, keystonemiddleware is an independent middleware module."},{"line_number":34,"context_line":"Earlier, it was part of python-keystoneclient and keystone server. More"},{"line_number":35,"context_line":"information from"},{"line_number":36,"context_line":"http://docs.openstack.org/developer/python-keystoneclient/middlewarearchitecture.html"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"\u003ca name\u003d\"implementation\"/\u003e"},{"line_number":39,"context_line":"###Implementation overview"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_2d32325f","line":36,"updated":"2014-11-24 00:36:09.000000000","message":"this document should be going away. It should be in http://docs.openstack.org/developer/keystonemiddleware/middlewarearchitecture.html  now.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":33,"context_line":"From Juno release, keystonemiddleware is an independent middleware module."},{"line_number":34,"context_line":"Earlier, it was part of python-keystoneclient and keystone server. More"},{"line_number":35,"context_line":"information from"},{"line_number":36,"context_line":"http://docs.openstack.org/developer/python-keystoneclient/middlewarearchitecture.html"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"\u003ca name\u003d\"implementation\"/\u003e"},{"line_number":39,"context_line":"###Implementation overview"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_0fa701be","line":36,"in_reply_to":"5a890539_2d32325f","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":49,"context_line":"   such as user name, tenant, etc."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"####Dependent components"},{"line_number":52,"context_line":"1. cms:"},{"line_number":53,"context_line":"   - Certificate signing functions"},{"line_number":54,"context_line":"2. memcache_crypt:"},{"line_number":55,"context_line":"   - Utilities for memcache encryption and integrity check. Encryption has a"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_ad3d422d","line":52,"updated":"2014-11-24 00:36:09.000000000","message":"suggest call this \"openssl cms\"","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":49,"context_line":"   such as user name, tenant, etc."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"####Dependent components"},{"line_number":52,"context_line":"1. cms:"},{"line_number":53,"context_line":"   - Certificate signing functions"},{"line_number":54,"context_line":"2. memcache_crypt:"},{"line_number":55,"context_line":"   - Utilities for memcache encryption and integrity check. Encryption has a"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_0f8e212e","line":52,"in_reply_to":"5a890539_ad3d422d","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":56,"context_line":"     dependency on the *pycrypto*. If *pycrypto* is not available,"},{"line_number":57,"context_line":"     CryptoUnavailableError will be raised."},{"line_number":58,"context_line":"3. hashlib:"},{"line_number":59,"context_line":"   - To hash PKI tokens using a configured hash algorithm.The default hash"},{"line_number":60,"context_line":"     algorithm is md5."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"####Major use cases:"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_ed43caac","line":59,"updated":"2014-11-24 00:36:09.000000000","message":"add a space after \"algorithm.\"","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":56,"context_line":"     dependency on the *pycrypto*. If *pycrypto* is not available,"},{"line_number":57,"context_line":"     CryptoUnavailableError will be raised."},{"line_number":58,"context_line":"3. hashlib:"},{"line_number":59,"context_line":"   - To hash PKI tokens using a configured hash algorithm.The default hash"},{"line_number":60,"context_line":"     algorithm is md5."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"####Major use cases:"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_4f002966","line":59,"in_reply_to":"5a890539_ed43caac","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":57,"context_line":"     CryptoUnavailableError will be raised."},{"line_number":58,"context_line":"3. hashlib:"},{"line_number":59,"context_line":"   - To hash PKI tokens using a configured hash algorithm.The default hash"},{"line_number":60,"context_line":"     algorithm is md5."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"####Major use cases:"},{"line_number":63,"context_line":"1. Verifies that incoming client requests have valid tokens by validating"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_cd460ec0","line":60,"updated":"2014-11-24 00:36:09.000000000","message":"Also memcache for caching of tokens","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":57,"context_line":"     CryptoUnavailableError will be raised."},{"line_number":58,"context_line":"3. hashlib:"},{"line_number":59,"context_line":"   - To hash PKI tokens using a configured hash algorithm.The default hash"},{"line_number":60,"context_line":"     algorithm is md5."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"####Major use cases:"},{"line_number":63,"context_line":"1. Verifies that incoming client requests have valid tokens by validating"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_6ffa4576","line":60,"in_reply_to":"5a890539_cd460ec0","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":74,"context_line":" -  Idenity API (auth service) is trustworthy."},{"line_number":75,"context_line":" -  Memcache is initialized and the memcache secret key is only accessible to"},{"line_number":76,"context_line":"    the trusted parties."},{"line_number":77,"context_line":" -  Keystonemiddleware process is trustworthy."},{"line_number":78,"context_line":" -  The communication channel between the auth service and the"},{"line_number":79,"context_line":"    keystonemiddleware is protected by secure tunnel protocol."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_ad52a264","line":77,"updated":"2014-11-24 00:36:09.000000000","message":"Keystonemiddleware should be changed to auth_token middleware throughout this document. The keystonemiddleware component contains more than just the auth_token middleware.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":74,"context_line":" -  Idenity API (auth service) is trustworthy."},{"line_number":75,"context_line":" -  Memcache is initialized and the memcache secret key is only accessible to"},{"line_number":76,"context_line":"    the trusted parties."},{"line_number":77,"context_line":" -  Keystonemiddleware process is trustworthy."},{"line_number":78,"context_line":" -  The communication channel between the auth service and the"},{"line_number":79,"context_line":"    keystonemiddleware is protected by secure tunnel protocol."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_2a1f4b5c","line":77,"in_reply_to":"5a890539_ad52a264","updated":"2014-11-25 10:15:31.000000000","message":"yes, keystonemiddleware contains more than auth_token. However, auth_token is not an independent middleware unlike earlier. Does it ok, if we state in the beginning, that when we say keystonemiddleware it only means auth_token middleware or changing to auth_token middleware throughout the document is more exact.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    keystonemiddleware is protected by secure tunnel protocol."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"###Security Objective"},{"line_number":82,"context_line":" - Verify the integrity of the token and token data (authenticity,and freshness)"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"\u003ca name\u003d\"dfd\"/\u003e"},{"line_number":85,"context_line":"###Data flow diagrams"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_2d1952d7","line":82,"updated":"2014-11-24 00:36:09.000000000","message":"add a space after \"authenticity,\"","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    keystonemiddleware is protected by secure tunnel protocol."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"###Security Objective"},{"line_number":82,"context_line":" - Verify the integrity of the token and token data (authenticity,and freshness)"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"\u003ca name\u003d\"dfd\"/\u003e"},{"line_number":85,"context_line":"###Data flow diagrams"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_8a3e7fb6","line":82,"in_reply_to":"5a890539_2d1952d7","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":116,"context_line":"###Assets"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"1. Request env parameters"},{"line_number":119,"context_line":"   - X-Auth-Token:UUID or PKI token"},{"line_number":120,"context_line":"2. Config parameters"},{"line_number":121,"context_line":"   - auth_URI (identity_URI)"},{"line_number":122,"context_line":"   - signing_cert_file_name, signing_ca_file_name, revoked_file_name"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_6d0fda88","line":119,"updated":"2014-11-24 00:36:09.000000000","message":"also X-Storage-Token and X-Service-Token","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":116,"context_line":"###Assets"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"1. Request env parameters"},{"line_number":119,"context_line":"   - X-Auth-Token:UUID or PKI token"},{"line_number":120,"context_line":"2. Config parameters"},{"line_number":121,"context_line":"   - auth_URI (identity_URI)"},{"line_number":122,"context_line":"   - signing_cert_file_name, signing_ca_file_name, revoked_file_name"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_2a7bcb7b","line":119,"in_reply_to":"5a890539_6d0fda88","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":118,"context_line":"1. Request env parameters"},{"line_number":119,"context_line":"   - X-Auth-Token:UUID or PKI token"},{"line_number":120,"context_line":"2. Config parameters"},{"line_number":121,"context_line":"   - auth_URI (identity_URI)"},{"line_number":122,"context_line":"   - signing_cert_file_name, signing_ca_file_name, revoked_file_name"},{"line_number":123,"context_line":"   - service username, password, service token"},{"line_number":124,"context_line":"   - service certificate for authentication (not used)"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_ed1aeac4","line":121,"updated":"2014-11-24 00:36:09.000000000","message":"auth_uri","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":118,"context_line":"1. Request env parameters"},{"line_number":119,"context_line":"   - X-Auth-Token:UUID or PKI token"},{"line_number":120,"context_line":"2. Config parameters"},{"line_number":121,"context_line":"   - auth_URI (identity_URI)"},{"line_number":122,"context_line":"   - signing_cert_file_name, signing_ca_file_name, revoked_file_name"},{"line_number":123,"context_line":"   - service username, password, service token"},{"line_number":124,"context_line":"   - service certificate for authentication (not used)"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_0a88cf6f","line":121,"in_reply_to":"5a890539_ed1aeac4","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":125,"context_line":"   - token cache related configuration: token_cache_enable,"},{"line_number":126,"context_line":"     revocation_check_on_cached_token"},{"line_number":127,"context_line":"   - token_cache_time"},{"line_number":128,"context_line":"   - token revocation list related configuration:token_revocation_list,"},{"line_number":129,"context_line":"     token_revocation_list_cache_time"},{"line_number":130,"context_line":"   - memcache related configuration: secret key, memcache_security_strategy"},{"line_number":131,"context_line":"   - token_bind"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_2d8072bf","line":128,"updated":"2014-11-24 00:36:09.000000000","message":"add a space after \"configuration:\"","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":125,"context_line":"   - token cache related configuration: token_cache_enable,"},{"line_number":126,"context_line":"     revocation_check_on_cached_token"},{"line_number":127,"context_line":"   - token_cache_time"},{"line_number":128,"context_line":"   - token revocation list related configuration:token_revocation_list,"},{"line_number":129,"context_line":"     token_revocation_list_cache_time"},{"line_number":130,"context_line":"   - memcache related configuration: secret key, memcache_security_strategy"},{"line_number":131,"context_line":"   - token_bind"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_8adaff75","line":128,"in_reply_to":"5a890539_2d8072bf","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":130,"context_line":"   - memcache related configuration: secret key, memcache_security_strategy"},{"line_number":131,"context_line":"   - token_bind"},{"line_number":132,"context_line":"   - delay_auth_decision"},{"line_number":133,"context_line":"   - http_max_retries"},{"line_number":134,"context_line":"3. Cache"},{"line_number":135,"context_line":"   - token_id, token_data, per object secret key"},{"line_number":136,"context_line":"4. Certificate Store"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_4d813ec2","line":133,"updated":"2014-11-24 00:36:09.000000000","message":"http_request_max_retries, also http_connect_timeout\n\nand there\u0027s more, just check auth_token.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":130,"context_line":"   - memcache related configuration: secret key, memcache_security_strategy"},{"line_number":131,"context_line":"   - token_bind"},{"line_number":132,"context_line":"   - delay_auth_decision"},{"line_number":133,"context_line":"   - http_max_retries"},{"line_number":134,"context_line":"3. Cache"},{"line_number":135,"context_line":"   - token_id, token_data, per object secret key"},{"line_number":136,"context_line":"4. Certificate Store"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_6a7eb31a","line":133,"in_reply_to":"5a890539_4d813ec2","updated":"2014-11-25 10:15:31.000000000","message":"yes, there are more, we try to include only important assets which seems to have an impact on threat analysis... this is not a total inclusive list.  An asset must be added to this list if we are find a relation that an attacker tries to/motivation to exploit that asset /  has impact on the component integrity.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":142,"context_line":"   - X-Service-Catalog"},{"line_number":143,"context_line":"   - X-Roles"},{"line_number":144,"context_line":"   - X-Service-Roles"},{"line_number":145,"context_line":"   - keystone.token_info"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"----------"},{"line_number":148,"context_line":"\u003ca name\u003d\"threats\"/\u003e"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_0d62d63d","line":145,"updated":"2014-11-24 00:36:09.000000000","message":"There\u0027s serveral more env vars: e.g., X-User-Id, X-Project-Id, etc. They\u0027re listed in auth_token middleware.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":142,"context_line":"   - X-Service-Catalog"},{"line_number":143,"context_line":"   - X-Roles"},{"line_number":144,"context_line":"   - X-Service-Roles"},{"line_number":145,"context_line":"   - keystone.token_info"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"----------"},{"line_number":148,"context_line":"\u003ca name\u003d\"threats\"/\u003e"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_aaf09b91","line":145,"in_reply_to":"5a890539_0d62d63d","updated":"2014-11-25 10:15:31.000000000","message":"added some of them","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":152,"context_line":"Spoofing: unauthorized access to the target service (OR)"},{"line_number":153,"context_line":" S1. Attacker populates authentication headers in request env and"},{"line_number":154,"context_line":"     keystonemiddleware fails to remove authentication headers (P:Zero)"},{"line_number":155,"context_line":" S2. Validate UUID token against a compromised Identity API (P:Low)"},{"line_number":156,"context_line":"     S2.1. Identity API is compromised"},{"line_number":157,"context_line":"     S2.2. Keystonemiddleware do not verify authenticity of the Identity API"},{"line_number":158,"context_line":"           endpoint e.g., server certificate check turned off (P:Low)"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_4d585e8a","line":155,"updated":"2014-11-24 00:36:09.000000000","message":"change API to server","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":152,"context_line":"Spoofing: unauthorized access to the target service (OR)"},{"line_number":153,"context_line":" S1. Attacker populates authentication headers in request env and"},{"line_number":154,"context_line":"     keystonemiddleware fails to remove authentication headers (P:Zero)"},{"line_number":155,"context_line":" S2. Validate UUID token against a compromised Identity API (P:Low)"},{"line_number":156,"context_line":"     S2.1. Identity API is compromised"},{"line_number":157,"context_line":"     S2.2. Keystonemiddleware do not verify authenticity of the Identity API"},{"line_number":158,"context_line":"           endpoint e.g., server certificate check turned off (P:Low)"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_8a74bfcf","line":155,"in_reply_to":"5a890539_4d585e8a","updated":"2014-11-25 10:15:31.000000000","message":"I think Identity API is the right convention, others please correct me, if i am wrong.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":153,"context_line":" S1. Attacker populates authentication headers in request env and"},{"line_number":154,"context_line":"     keystonemiddleware fails to remove authentication headers (P:Zero)"},{"line_number":155,"context_line":" S2. Validate UUID token against a compromised Identity API (P:Low)"},{"line_number":156,"context_line":"     S2.1. Identity API is compromised"},{"line_number":157,"context_line":"     S2.2. Keystonemiddleware do not verify authenticity of the Identity API"},{"line_number":158,"context_line":"           endpoint e.g., server certificate check turned off (P:Low)"},{"line_number":159,"context_line":" S3. Delay_auth_request flag is set and delay_auth_module is not trusted (P:Zero)"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_6d5d1a79","line":156,"updated":"2014-11-24 00:36:09.000000000","message":"change API to server","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":154,"context_line":"     keystonemiddleware fails to remove authentication headers (P:Zero)"},{"line_number":155,"context_line":" S2. Validate UUID token against a compromised Identity API (P:Low)"},{"line_number":156,"context_line":"     S2.1. Identity API is compromised"},{"line_number":157,"context_line":"     S2.2. Keystonemiddleware do not verify authenticity of the Identity API"},{"line_number":158,"context_line":"           endpoint e.g., server certificate check turned off (P:Low)"},{"line_number":159,"context_line":" S3. Delay_auth_request flag is set and delay_auth_module is not trusted (P:Zero)"},{"line_number":160,"context_line":" S4. A revoked token can be used as a valid token (P:Low)"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_8d55e651","line":157,"updated":"2014-11-24 00:36:09.000000000","message":"change \"do not\" to \"does not\"","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":154,"context_line":"     keystonemiddleware fails to remove authentication headers (P:Zero)"},{"line_number":155,"context_line":" S2. Validate UUID token against a compromised Identity API (P:Low)"},{"line_number":156,"context_line":"     S2.1. Identity API is compromised"},{"line_number":157,"context_line":"     S2.2. Keystonemiddleware do not verify authenticity of the Identity API"},{"line_number":158,"context_line":"           endpoint e.g., server certificate check turned off (P:Low)"},{"line_number":159,"context_line":" S3. Delay_auth_request flag is set and delay_auth_module is not trusted (P:Zero)"},{"line_number":160,"context_line":" S4. A revoked token can be used as a valid token (P:Low)"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_2a43cb6c","line":157,"in_reply_to":"5a890539_8d55e651","updated":"2014-11-25 10:15:31.000000000","message":"Done","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19484960d6e1b0a0a3c62bb9f56f8f49f3452eb1","unresolved":false,"context_lines":[{"line_number":181,"context_line":"           user. This can happen for integrity protected token in memcache"},{"line_number":182,"context_line":"           (P:Low)"},{"line_number":183,"context_line":"     S5.2. Attacker places compromised token in memcache (P:Zero)"},{"line_number":184,"context_line":"           S5.2.1 Cache secret key is compromised"},{"line_number":185,"context_line":" S6. Validate PKI token against compromised certificate (P:Medium)"},{"line_number":186,"context_line":"     S6.1. Certificate authority is compromised (P:Low)"},{"line_number":187,"context_line":"     S6.2. Signing certificate is compromised (P:Medium)"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_add9c2f4","line":184,"updated":"2014-11-24 00:36:09.000000000","message":"memcache could be restarted or an attacker could flood it with other data to cause auth_token data to be discarded.","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":10824,"name":"Abu Shohel Ahmed","email":"ahmed.shohel@ericsson.com","username":"shohel"},"change_message_id":"010776509316d2139a071b9590fe6d97550793fa","unresolved":false,"context_lines":[{"line_number":181,"context_line":"           user. This can happen for integrity protected token in memcache"},{"line_number":182,"context_line":"           (P:Low)"},{"line_number":183,"context_line":"     S5.2. Attacker places compromised token in memcache (P:Zero)"},{"line_number":184,"context_line":"           S5.2.1 Cache secret key is compromised"},{"line_number":185,"context_line":" S6. Validate PKI token against compromised certificate (P:Medium)"},{"line_number":186,"context_line":"     S6.1. Certificate authority is compromised (P:Low)"},{"line_number":187,"context_line":"     S6.2. Signing certificate is compromised (P:Medium)"}],"source_content_type":"text/x-markdown","patch_set":7,"id":"5a890539_9e37a4e2","line":184,"in_reply_to":"5a890539_add9c2f4","updated":"2014-11-25 10:15:31.000000000","message":"So, it is a denial of service attack against memcache which can negatively affect auth_token\n\nIf this is the case, then we will add it in later denial of service section","commit_id":"d2b093140f2c42fe3e4c1905c64bd06000f18b16"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b61d82d6fb2d6c2e7f0cbf5d2852b9efb5e7f16e","unresolved":false,"context_lines":[{"line_number":76,"context_line":" -  Idenity API (auth service) is trustworthy."},{"line_number":77,"context_line":" -  Memcache is initialized and the memcache secret key is only accessible to"},{"line_number":78,"context_line":"    the trusted parties."},{"line_number":79,"context_line":" -  Keystonemiddleware process is trustworthy."},{"line_number":80,"context_line":" -  The communication channel between the auth service and the"},{"line_number":81,"context_line":"    keystonemiddleware is protected by a secure tunnel protocol."},{"line_number":82,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":8,"id":"5a890539_c77e3d6a","line":79,"updated":"2014-12-01 00:30:44.000000000","message":"\"However, auth_token is not an independent middleware unlike earlier. Does it ok, if we state in the beginning, that when we say keystonemiddleware it only means auth_token middleware or changing to auth_token middleware throughout the document is more exact.\"\n\n- auth_token hasn\u0027t changed... if it was independent middleware before it still is. I don\u0027t know what it means for middleware to be independent or not.\n\n- changing to auth_token middleware throughout the document is more correct.","commit_id":"da0dcba8336b5a74cbbbd1741cc8b392352ad266"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b61d82d6fb2d6c2e7f0cbf5d2852b9efb5e7f16e","unresolved":false,"context_lines":[{"line_number":134,"context_line":"   - memcache related configuration: secret key, memcache_security_strategy"},{"line_number":135,"context_line":"   - token_bind"},{"line_number":136,"context_line":"   - delay_auth_decision"},{"line_number":137,"context_line":"   - http_max_retries"},{"line_number":138,"context_line":"3. Cache"},{"line_number":139,"context_line":"   - token_id, token_data, per object secret key"},{"line_number":140,"context_line":"4. Certificate Store"}],"source_content_type":"text/x-markdown","patch_set":8,"id":"5a890539_278f0177","line":137,"updated":"2014-12-01 00:30:44.000000000","message":"There\u0027s no http_max_retries option, it\u0027s http_request_max_retries","commit_id":"da0dcba8336b5a74cbbbd1741cc8b392352ad266"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b61d82d6fb2d6c2e7f0cbf5d2852b9efb5e7f16e","unresolved":false,"context_lines":[{"line_number":241,"context_line":"           cache write operation on memcache (P:Zero)"},{"line_number":242,"context_line":" D4. DoS attack on memcache server (P: Low)"},{"line_number":243,"context_line":"     D4.1. Attacker intentionally restarts the memchache server"},{"line_number":244,"context_line":"     D4.2. The floods the input/output interface of memcache server"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"Elevation of privileges (OR)"},{"line_number":247,"context_line":"\u003c/code\u003e\u003c/pre\u003e"}],"source_content_type":"text/x-markdown","patch_set":8,"id":"5a890539_27bd4103","line":244,"updated":"2014-12-01 00:30:44.000000000","message":"There\u0027s also a possible attack where an attacker sends requests with a bunch of invalid UUID tokens. These get stored in memcache.","commit_id":"da0dcba8336b5a74cbbbd1741cc8b392352ad266"}],"security-threat-analysis/Project_ThreatAnalysis_ComponentName_Number.md":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"b0bf19d2fc6add84ff11a5ecb18a9d4e209c4e44","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003ca name\u003d\"system\"/\u003e"},{"line_number":21,"context_line":"###System Overview"},{"line_number":22,"context_line":"####Application version"},{"line_number":23,"context_line":"    Version info   "},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"####Application Description"},{"line_number":26,"context_line":"    A short description about target application/component "}],"source_content_type":"text/x-markdown","patch_set":1,"id":"fa98f980_29bbec0f","line":23,"updated":"2014-09-12 15:28:42.000000000","message":"Same here with whitespace","commit_id":"a852d09471c019aec88ea0cf0c5e7ad10e9f24e5"}],"security-threat-analysis/README.md":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"b0bf19d2fc6add84ff11a5ecb18a9d4e209c4e44","unresolved":false,"context_lines":[{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"This directory contains reports for OpenStack threat modelling. We"},{"line_number":5,"context_line":"use Mark Down(.md) format for writing reports. A quick overview of "},{"line_number":6,"context_line":"files and underlying directory structure is provided below."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":""}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa98f980_893db891","line":5,"updated":"2014-09-12 15:28:42.000000000","message":"And here and further below.","commit_id":"a852d09471c019aec88ea0cf0c5e7ad10e9f24e5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"b0bf19d2fc6add84ff11a5ecb18a9d4e209c4e44","unresolved":false,"context_lines":[{"line_number":15,"context_line":"       Common format file for threat modelling"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"**images**"},{"line_number":18,"context_line":"\tContains common images"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"OpenStack Projects:"}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa98f980_a93efc88","line":18,"updated":"2014-09-12 15:28:42.000000000","message":"Don\u0027t use tabs, use spaces","commit_id":"a852d09471c019aec88ea0cf0c5e7ad10e9f24e5"}],"security-threat-analysis/Threat_modeling_process.md":[{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"bc9e2daba4e16067c2aa3ba8f7e7e05527c93c47","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Threat Modelling"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"### Table of contents"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":3,"id":"baa201ad_ecb984ea","line":1,"updated":"2014-09-30 13:26:22.000000000","message":"My reference says this double-l spelling is Brittish English, change to Modeling throughout. http://dictionary.reference.com/browse/modelling","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":11,"context_line":"[Related Assumptions for Threat Modelling](#assumption)"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"-----"},{"line_number":14,"context_line":"Threat modelling and analysis provides a comprehensive security view of a system."},{"line_number":15,"context_line":"It is performed using a systematic and strategic way for identifying and"},{"line_number":16,"context_line":"enumerating threats to a system."},{"line_number":17,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_6c255b09","line":14,"updated":"2014-09-19 10:46:49.000000000","message":"attempts to provide","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"-----"},{"line_number":14,"context_line":"Threat modelling and analysis provides a comprehensive security view of a system."},{"line_number":15,"context_line":"It is performed using a systematic and strategic way for identifying and"},{"line_number":16,"context_line":"enumerating threats to a system."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"\u003ca name\u003d\"definition\"/\u003e"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_8c20bff9","line":15,"updated":"2014-09-19 10:46:49.000000000","message":"s/way/method","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":25,"context_line":"####Threat:"},{"line_number":26,"context_line":"\u003e A potential for violation of security, which exists when there is a"},{"line_number":27,"context_line":"circumstance, capability, action, or event that could breach security and cause"},{"line_number":28,"context_line":" harm... a threat is a possible danger that might exploit a vulnerability."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"####Attack:"},{"line_number":31,"context_line":"\u003e An assault on system security that derives from an intelligent threat, to"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_6f12ad59","line":28,"updated":"2014-09-19 10:46:49.000000000","message":"Is a threat a specific actor or class of actors that may exploit a vulnerability and attack the system?","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":28,"context_line":" harm... a threat is a possible danger that might exploit a vulnerability."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"####Attack:"},{"line_number":31,"context_line":"\u003e An assault on system security that derives from an intelligent threat, to"},{"line_number":32,"context_line":"evade security services and violate the security policy of a system."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"\u003ca name\u003d\"modeling\"/\u003e"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_cf171944","line":31,"updated":"2014-09-19 10:46:49.000000000","message":"define intelligent threat?","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"\u003ca name\u003d\"modeling\"/\u003e"},{"line_number":35,"context_line":"###Modelling Phases"},{"line_number":36,"context_line":"Currently, We are following two phase processes. First phase starts from a"},{"line_number":37,"context_line":"higher level:"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"- Selecting a target"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_8f3b51c7","line":36,"updated":"2014-09-19 10:46:49.000000000","message":"we","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":40,"context_line":"- Identifying major components"},{"line_number":41,"context_line":"- Identify of threats from overall perspective"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"In the second phase, we perform threat analysis for each of the earlier"},{"line_number":44,"context_line":"identified components."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"**Figure 1: Two phase process for threat identification**"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_cf455944","line":43,"updated":"2014-09-19 10:46:49.000000000","message":"s/earlier//","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"bc9e2daba4e16067c2aa3ba8f7e7e05527c93c47","unresolved":false,"context_lines":[{"line_number":58,"context_line":"Steps:"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":" 1. Application/component overview (deployment, technologies, usage, assumptions)"},{"line_number":61,"context_line":" 2. Security objectives of a component/sub components"},{"line_number":62,"context_line":" 3. Decomposition (Data Flow Diagrams - DFD, Trust boundaries, entry/exit point,"},{"line_number":63,"context_line":"    assets, security controls in place)"},{"line_number":64,"context_line":" 4. Threats against assets - derived from known threats. STRIDE is used for"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"baa201ad_cc820000","line":61,"updated":"2014-09-30 13:26:22.000000000","message":"Steps should have periods at the end and be complete sentences.","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":61,"context_line":" 2. Security objectives of a component/sub components"},{"line_number":62,"context_line":" 3. Decomposition (Data Flow Diagrams - DFD, Trust boundaries, entry/exit point,"},{"line_number":63,"context_line":"    assets, security controls in place)"},{"line_number":64,"context_line":" 4. Threats against assets - derived from known threats. STRIDE is used for"},{"line_number":65,"context_line":"    threat identification and classification. This step also includes:"},{"line_number":66,"context_line":"    - Threat Quantification (Attacker model, DREAD, Risk analysis)"},{"line_number":67,"context_line":"    - Security Controls vs. Threats"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_cfbe39ae","line":64,"updated":"2014-09-19 10:46:49.000000000","message":"STRIDE needs an introduction or href to the explanation further on in this document.","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"bc9e2daba4e16067c2aa3ba8f7e7e05527c93c47","unresolved":false,"context_lines":[{"line_number":63,"context_line":"    assets, security controls in place)"},{"line_number":64,"context_line":" 4. Threats against assets - derived from known threats. STRIDE is used for"},{"line_number":65,"context_line":"    threat identification and classification. This step also includes:"},{"line_number":66,"context_line":"    - Threat Quantification (Attacker model, DREAD, Risk analysis)"},{"line_number":67,"context_line":"    - Security Controls vs. Threats"},{"line_number":68,"context_line":" 5. Vulnerability exploitation in code"},{"line_number":69,"context_line":" 6. Vulnerability exists but cannot be exploited due to the attacker model"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"baa201ad_2c92ac57","line":66,"updated":"2014-09-30 13:26:22.000000000","message":"Spell out first use of acronym DREAD please.","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    threat identification and classification. This step also includes:"},{"line_number":66,"context_line":"    - Threat Quantification (Attacker model, DREAD, Risk analysis)"},{"line_number":67,"context_line":"    - Security Controls vs. Threats"},{"line_number":68,"context_line":" 5. Vulnerability exploitation in code"},{"line_number":69,"context_line":" 6. Vulnerability exists but cannot be exploited due to the attacker model"},{"line_number":70,"context_line":" 7. Security guidance/Security test case development."},{"line_number":71,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_2f0c2594","line":68,"updated":"2014-09-19 10:46:49.000000000","message":"Unclear what this means.","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    - Threat Quantification (Attacker model, DREAD, Risk analysis)"},{"line_number":67,"context_line":"    - Security Controls vs. Threats"},{"line_number":68,"context_line":" 5. Vulnerability exploitation in code"},{"line_number":69,"context_line":" 6. Vulnerability exists but cannot be exploited due to the attacker model"},{"line_number":70,"context_line":" 7. Security guidance/Security test case development."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"\u003ca name\u003d\"identification\"/\u003e"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_ef94dde9","line":69,"updated":"2014-09-19 10:46:49.000000000","message":"In general, I always try to steer clear of making this statement, history shows us most things are exploitable and we cannot hope to understand every exploitation scenario","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b5dcf61525a8351b62ce4b1061f446031a6b3bbe","unresolved":false,"context_lines":[{"line_number":96,"context_line":"\u003ca name\u003d\"assumption\"/\u003e"},{"line_number":97,"context_line":"###Common assumptions/guidelines for the threat modelling"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"#### Threat Agents:"},{"line_number":100,"context_line":"- ID-U: Internet Attacker – Unauthorized"},{"line_number":101,"context_line":"- ID-A: Internet Attacker – Authorized"},{"line_number":102,"context_line":"- IN-I: Internal Attacker - Insider"}],"source_content_type":"text/x-markdown","patch_set":3,"id":"fa98f980_5a0cc93b","line":99,"updated":"2014-09-19 10:46:49.000000000","message":"Where has this list come from? I can think of other actors\n\nInternal attacks can also be from Authorized or Unauthorized actors","commit_id":"3462e355d8117ef7046f810049492e6bddca12cd"}]}