)]}'
{"security-notes/OSSN-0047":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a8aca873fe7dc3047dfb99e300a9b861f43756da","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone does not validate identity provider matches federation mapping"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_5f3247f3","line":1,"updated":"2015-04-09 18:56:51.000000000","message":"validate *that identity provider...","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"01f283af69d0ae7f783cbcf1ade2b445631e1d9f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone does not validate identity provider matches federation mapping"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_5ae5b535","line":1,"in_reply_to":"9aa53dc9_5f3247f3","updated":"2015-04-09 19:33:25.000000000","message":"Done","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a8aca873fe7dc3047dfb99e300a9b861f43756da","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Keystone\u0027s OS-FEDERATION extension does not enforce a link between an"},{"line_number":6,"context_line":"identity provider and a federation mapping.  This can lead to assertions"},{"line_number":7,"context_line":"or claims from one identity provider being used with mappings intended"},{"line_number":8,"context_line":"for use with another identity provider.  This could result in users"},{"line_number":9,"context_line":"obtaining access to resources that they are not intended to have."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_7f12ab58","line":8,"updated":"2015-04-09 18:56:51.000000000","message":"maybe reword in some way where these two sentences don\u0027t begin with \"this\".  You could probably just make this sentence an extension of the last...\n\n...used with mappings intended for use with another identity provider, which could result in users having access...","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"01f283af69d0ae7f783cbcf1ade2b445631e1d9f","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Keystone\u0027s OS-FEDERATION extension does not enforce a link between an"},{"line_number":6,"context_line":"identity provider and a federation mapping.  This can lead to assertions"},{"line_number":7,"context_line":"or claims from one identity provider being used with mappings intended"},{"line_number":8,"context_line":"for use with another identity provider.  This could result in users"},{"line_number":9,"context_line":"obtaining access to resources that they are not intended to have."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_5aeff5e8","line":8,"in_reply_to":"9aa53dc9_7f12ab58","updated":"2015-04-09 19:33:25.000000000","message":"Done","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a8aca873fe7dc3047dfb99e300a9b861f43756da","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Keystone\u0027s OS-FEDERATION extension allows for a set of environment"},{"line_number":16,"context_line":"variables provided by a trusted identity provider to be used as mapping"},{"line_number":17,"context_line":"inputs to determine group membership (and ultimately role assignment)."},{"line_number":18,"context_line":"Mapping rules are intended to be identity provider specific, as"},{"line_number":19,"context_line":"different identity providers provide their assertions or claims in"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_9f6a0fb2","line":16,"updated":"2015-04-09 18:56:51.000000000","message":"maybe give an example of a trusted identity provider, ie.. \"a trusted identity provider such as LDAP\"","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3bc857d4be6d1a6582d69af7e613dee15e524ed7","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Keystone\u0027s OS-FEDERATION extension allows for a set of environment"},{"line_number":16,"context_line":"variables provided by a trusted identity provider to be used as mapping"},{"line_number":17,"context_line":"inputs to determine group membership (and ultimately role assignment)."},{"line_number":18,"context_line":"Mapping rules are intended to be identity provider specific, as"},{"line_number":19,"context_line":"different identity providers provide their assertions or claims in"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_5fe367a4","line":16,"in_reply_to":"9aa53dc9_9f6a0fb2","updated":"2015-04-09 19:17:02.000000000","message":"LDAP isn\u0027t a federated identity provider.  The term \"identity provider\" is a specific object type within Keystone\u0027s database (and in the API).  It is also a very specific terminology within SAML and OpenID.  I could say \"a trusted identity provider, such as a SAML identity provider\", but it seems repetitive to me.","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a8aca873fe7dc3047dfb99e300a9b861f43756da","unresolved":false,"context_lines":[{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"},{"line_number":29,"context_line":"access to resources that they are not intended to access."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"### Recommended Actions ###"},{"line_number":32,"context_line":"Even though the Juno release of Keystone does not have the ability to"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_3fb42333","line":29,"updated":"2015-04-09 18:56:51.000000000","message":"Can you add an example here to make this clearer how an attack would work?","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3bc857d4be6d1a6582d69af7e613dee15e524ed7","unresolved":false,"context_lines":[{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"},{"line_number":29,"context_line":"access to resources that they are not intended to access."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"### Recommended Actions ###"},{"line_number":32,"context_line":"Even though the Juno release of Keystone does not have the ability to"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_df3897f0","line":29,"in_reply_to":"9aa53dc9_3fb42333","updated":"2015-04-09 19:17:02.000000000","message":"It\u0027s a bit convoluted, as it would involve showing how to use something like the SAML ECP profile to get an assertion, then provide that to Keystone with a different auth URL using the keystoneclient-federation plugin (soon to be renamed to be SAML specific).  It seems like a lot of detail that might just make this note harder to understand.\n\nI could provide an example of mappings that would be problematic if you feel that would be helpful.  It would basically be an example where a group named \"foo\" from \"idp1\" gets the \"admin\" role on a project, while a group named \"foo\" from \"idp2\" would get the \"_member_\" role on some other project.  Providing the assertion from \"idp2\" would allow a member of the \"foo\" group from that IDP to get \"admin\" role on some other project that is intended for an \"idp1\" user.","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"01f283af69d0ae7f783cbcf1ade2b445631e1d9f","unresolved":false,"context_lines":[{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"},{"line_number":29,"context_line":"access to resources that they are not intended to access."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"### Recommended Actions ###"},{"line_number":32,"context_line":"Even though the Juno release of Keystone does not have the ability to"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_3aed51b7","line":29,"in_reply_to":"9aa53dc9_df3897f0","updated":"2015-04-09 19:33:25.000000000","message":"Done","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a8aca873fe7dc3047dfb99e300a9b861f43756da","unresolved":false,"context_lines":[{"line_number":34,"context_line":"configure the frontend webserver that is used to deploy Keystone to"},{"line_number":35,"context_line":"perform this enforcement.  Each identity provider within Keystone has"},{"line_number":36,"context_line":"it\u0027s own authentication URL.  It is recommended that the webserver"},{"line_number":37,"context_line":"configuration configures it\u0027s underlying federation plug-ins to"},{"line_number":38,"context_line":"cryptograhically enforce that an identity provider is only valid for"},{"line_number":39,"context_line":"it\u0027s associated authentication URL."},{"line_number":40,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_bf7ef367","line":37,"updated":"2015-04-09 18:56:51.000000000","message":"*its","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"01f283af69d0ae7f783cbcf1ade2b445631e1d9f","unresolved":false,"context_lines":[{"line_number":34,"context_line":"configure the frontend webserver that is used to deploy Keystone to"},{"line_number":35,"context_line":"perform this enforcement.  Each identity provider within Keystone has"},{"line_number":36,"context_line":"it\u0027s own authentication URL.  It is recommended that the webserver"},{"line_number":37,"context_line":"configuration configures it\u0027s underlying federation plug-ins to"},{"line_number":38,"context_line":"cryptograhically enforce that an identity provider is only valid for"},{"line_number":39,"context_line":"it\u0027s associated authentication URL."},{"line_number":40,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_5a6a5582","line":37,"in_reply_to":"9aa53dc9_bf7ef367","updated":"2015-04-09 19:33:25.000000000","message":"Done","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a8aca873fe7dc3047dfb99e300a9b861f43756da","unresolved":false,"context_lines":[{"line_number":36,"context_line":"it\u0027s own authentication URL.  It is recommended that the webserver"},{"line_number":37,"context_line":"configuration configures it\u0027s underlying federation plug-ins to"},{"line_number":38,"context_line":"cryptograhically enforce that an identity provider is only valid for"},{"line_number":39,"context_line":"it\u0027s associated authentication URL."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"For example, the SAML protocol uses an asymmetric keypair to sign the"},{"line_number":42,"context_line":"requests and responses that are transmitted between an identity provider"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_7f950b85","line":39,"updated":"2015-04-09 18:56:51.000000000","message":"*its","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"01f283af69d0ae7f783cbcf1ade2b445631e1d9f","unresolved":false,"context_lines":[{"line_number":36,"context_line":"it\u0027s own authentication URL.  It is recommended that the webserver"},{"line_number":37,"context_line":"configuration configures it\u0027s underlying federation plug-ins to"},{"line_number":38,"context_line":"cryptograhically enforce that an identity provider is only valid for"},{"line_number":39,"context_line":"it\u0027s associated authentication URL."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"For example, the SAML protocol uses an asymmetric keypair to sign the"},{"line_number":42,"context_line":"requests and responses that are transmitted between an identity provider"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_3a6791b8","line":39,"in_reply_to":"9aa53dc9_7f950b85","updated":"2015-04-09 19:33:25.000000000","message":"Done","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a8aca873fe7dc3047dfb99e300a9b861f43756da","unresolved":false,"context_lines":[{"line_number":48,"context_line":"provider specific \u0027Location\u0027 directives.  This will ensure that a signed"},{"line_number":49,"context_line":"SAML assertion from one trusted identity provider will only be"},{"line_number":50,"context_line":"successfully validated when used against the appropriate authentication"},{"line_number":51,"context_line":"URL.  Here is an example with the mod_auth_mellon HTTPD module:"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"--- begin example httpd configuration snippet ---"},{"line_number":54,"context_line":"  \u003cLocation /v3/OS-FEDERATION/identity_providers/idp1/protocols/saml2/auth\u003e"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_bf115306","line":51,"updated":"2015-04-09 18:56:51.000000000","message":"we should break this paragraph up in some way, it\u0027s a little heavy.  If nothing else maybe add a line break before \"Here is an example\".","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"01f283af69d0ae7f783cbcf1ade2b445631e1d9f","unresolved":false,"context_lines":[{"line_number":48,"context_line":"provider specific \u0027Location\u0027 directives.  This will ensure that a signed"},{"line_number":49,"context_line":"SAML assertion from one trusted identity provider will only be"},{"line_number":50,"context_line":"successfully validated when used against the appropriate authentication"},{"line_number":51,"context_line":"URL.  Here is an example with the mod_auth_mellon HTTPD module:"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"--- begin example httpd configuration snippet ---"},{"line_number":54,"context_line":"  \u003cLocation /v3/OS-FEDERATION/identity_providers/idp1/protocols/saml2/auth\u003e"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_1a2e0d43","line":51,"in_reply_to":"9aa53dc9_bf115306","updated":"2015-04-09 19:33:25.000000000","message":"Done","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a8aca873fe7dc3047dfb99e300a9b861f43756da","unresolved":false,"context_lines":[{"line_number":75,"context_line":"each \u0027Location\u0027 directive.  This configuration will not allow a signed"},{"line_number":76,"context_line":"assertion from \u0027idp1\u0027 to be used against the authentication URL for"},{"line_number":77,"context_line":"\u0027idp2\u0027.  An attempt to do so would be rejected by mod_auth_mellon and"},{"line_number":78,"context_line":"would never actually reach Keystone\u0027s OS-FEDERATION extention."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"It is recommended to read the Keystone fedration documentation as well"},{"line_number":81,"context_line":"as the documentation for the HTTPD module that you are using for your"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_1f2eff42","line":78,"updated":"2015-04-09 18:56:51.000000000","message":"I like this part of the example","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"59b1828c576b5760012ca50974c420e2550707e5","unresolved":false,"context_lines":[{"line_number":77,"context_line":"\u0027idp2\u0027.  An attempt to do so would be rejected by mod_auth_mellon and"},{"line_number":78,"context_line":"would never actually reach Keystone\u0027s OS-FEDERATION extention."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"It is recommended to read the Keystone fedration documentation as well"},{"line_number":81,"context_line":"as the documentation for the HTTPD module that you are using for your"},{"line_number":82,"context_line":"federation method of choice.  Some useful links to this documentation"},{"line_number":83,"context_line":"are provided in the references section of this note."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_d432be5d","line":80,"updated":"2015-04-09 19:10:05.000000000","message":"federation","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"01f283af69d0ae7f783cbcf1ade2b445631e1d9f","unresolved":false,"context_lines":[{"line_number":77,"context_line":"\u0027idp2\u0027.  An attempt to do so would be rejected by mod_auth_mellon and"},{"line_number":78,"context_line":"would never actually reach Keystone\u0027s OS-FEDERATION extention."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"It is recommended to read the Keystone fedration documentation as well"},{"line_number":81,"context_line":"as the documentation for the HTTPD module that you are using for your"},{"line_number":82,"context_line":"federation method of choice.  Some useful links to this documentation"},{"line_number":83,"context_line":"are provided in the references section of this note."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_5a8ed579","line":80,"in_reply_to":"9aa53dc9_d432be5d","updated":"2015-04-09 19:33:25.000000000","message":"Done","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"59b1828c576b5760012ca50974c420e2550707e5","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"In the Kilo release of Keystone, it is also possible to have Keystone"},{"line_number":86,"context_line":"enforce that an assertion actually comes from the identity provider that"},{"line_number":87,"context_line":"is associated with the authentication URL.  This is performed by"},{"line_number":88,"context_line":"comparing an identity provider identifier value from the assertion or"},{"line_number":89,"context_line":"claim with an identifier that is stored as a part of the identity"},{"line_number":90,"context_line":"provider within Keystone.  To enable this functionality, you must set"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_d4099e85","line":87,"updated":"2015-04-09 19:10:05.000000000","message":"If Kilo also has this functionality, it is required by default? Should Kilo be listed as affected as well, or is there another mitigation in place?","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"01f283af69d0ae7f783cbcf1ade2b445631e1d9f","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"In the Kilo release of Keystone, it is also possible to have Keystone"},{"line_number":86,"context_line":"enforce that an assertion actually comes from the identity provider that"},{"line_number":87,"context_line":"is associated with the authentication URL.  This is performed by"},{"line_number":88,"context_line":"comparing an identity provider identifier value from the assertion or"},{"line_number":89,"context_line":"claim with an identifier that is stored as a part of the identity"},{"line_number":90,"context_line":"provider within Keystone.  To enable this functionality, you must set"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_1aebad14","line":87,"in_reply_to":"9aa53dc9_3a18b174","updated":"2015-04-09 19:33:25.000000000","message":"Done","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3bc857d4be6d1a6582d69af7e613dee15e524ed7","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"In the Kilo release of Keystone, it is also possible to have Keystone"},{"line_number":86,"context_line":"enforce that an assertion actually comes from the identity provider that"},{"line_number":87,"context_line":"is associated with the authentication URL.  This is performed by"},{"line_number":88,"context_line":"comparing an identity provider identifier value from the assertion or"},{"line_number":89,"context_line":"claim with an identifier that is stored as a part of the identity"},{"line_number":90,"context_line":"provider within Keystone.  To enable this functionality, you must set"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_3a18b174","line":87,"in_reply_to":"9aa53dc9_d4099e85","updated":"2015-04-09 19:17:02.000000000","message":"It is not required by default, though it is recommended.  Even though it\u0027s not required for regular federation (for backwards compatibility reasons), it is required when using Kilo\u0027s new WebSSO functionality in Keystone and Horizon.\n\nI will list Kilo as affected since people might not be setting the remote_id_attribute option.","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a8aca873fe7dc3047dfb99e300a9b861f43756da","unresolved":false,"context_lines":[{"line_number":87,"context_line":"is associated with the authentication URL.  This is performed by"},{"line_number":88,"context_line":"comparing an identity provider identifier value from the assertion or"},{"line_number":89,"context_line":"claim with an identifier that is stored as a part of the identity"},{"line_number":90,"context_line":"provider within Keystone.  To enable this functionality, you must set"},{"line_number":91,"context_line":"the \u0027remote_id_attribute\u0027 setting in keystone.conf, which defines the"},{"line_number":92,"context_line":"environment variable that contains the identity provider identifier."},{"line_number":93,"context_line":"You then must add the identifier value that the \u0027remote_id_attribute\u0027"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_3ffe63ae","line":90,"updated":"2015-04-09 18:56:51.000000000","message":"Paragraph break here?","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"01f283af69d0ae7f783cbcf1ade2b445631e1d9f","unresolved":false,"context_lines":[{"line_number":87,"context_line":"is associated with the authentication URL.  This is performed by"},{"line_number":88,"context_line":"comparing an identity provider identifier value from the assertion or"},{"line_number":89,"context_line":"claim with an identifier that is stored as a part of the identity"},{"line_number":90,"context_line":"provider within Keystone.  To enable this functionality, you must set"},{"line_number":91,"context_line":"the \u0027remote_id_attribute\u0027 setting in keystone.conf, which defines the"},{"line_number":92,"context_line":"environment variable that contains the identity provider identifier."},{"line_number":93,"context_line":"You then must add the identifier value that the \u0027remote_id_attribute\u0027"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9aa53dc9_3a8b116a","line":90,"in_reply_to":"9aa53dc9_3ffe63ae","updated":"2015-04-09 19:33:25.000000000","message":"Done","commit_id":"9b1c9c324bca04ac86d777de09f40bb4445c2f44"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bdd678f66372ec6671625af7c11b2e2c7ed6c384","unresolved":false,"context_lines":[{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Keystone\u0027s OS-FEDERATION extension allows for a set of environment"},{"line_number":16,"context_line":"variables provided by a trusted identity provider to be used as mapping"},{"line_number":17,"context_line":"inputs to determine group membership (and ultimately role assignment)."},{"line_number":18,"context_line":"Mapping rules are intended to be identity provider specific, as"},{"line_number":19,"context_line":"different identity providers provide their assertions or claims in"},{"line_number":20,"context_line":"different forms."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_0aff4368","line":17,"updated":"2015-04-14 03:31:45.000000000","message":"excellent summary!","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c01ededf5c1d9b0d06fee80e8997952bc1e158f7","unresolved":false,"context_lines":[{"line_number":22,"context_line":"In the Juno release of Keystone, there is no ability within Keystone"},{"line_number":23,"context_line":"itself to enforce that assertions or claims from an identity provider"},{"line_number":24,"context_line":"are actually being used against a mapping that is associated with that"},{"line_number":25,"context_line":"same identity provider.  A malicious user from a trusted identity"},{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_73093b95","line":25,"updated":"2015-04-13 15:01:35.000000000","message":"\"from a trusted identity provider\" - is this a user that is part of the IDP or one of the IDP\u0027s customers/service users?\n\nI think I know, but it\u0027s worth clarification, not all readers will be familiar with all concepts","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"55abfee71858162f5fd1e1cfbaec38e94c8f9003","unresolved":false,"context_lines":[{"line_number":22,"context_line":"In the Juno release of Keystone, there is no ability within Keystone"},{"line_number":23,"context_line":"itself to enforce that assertions or claims from an identity provider"},{"line_number":24,"context_line":"are actually being used against a mapping that is associated with that"},{"line_number":25,"context_line":"same identity provider.  A malicious user from a trusted identity"},{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_4ec42a5e","line":25,"in_reply_to":"7aaa499b_215c6b4a","updated":"2015-04-14 14:04:17.000000000","message":"I (very) slightly reworded this sentence.  If you feel that it needs more explanation, let me know.","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"6f9bb0a22e8c04caf70d1bc34c0cd66ecabe1f7c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"In the Juno release of Keystone, there is no ability within Keystone"},{"line_number":23,"context_line":"itself to enforce that assertions or claims from an identity provider"},{"line_number":24,"context_line":"are actually being used against a mapping that is associated with that"},{"line_number":25,"context_line":"same identity provider.  A malicious user from a trusted identity"},{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_215c6b4a","line":25,"in_reply_to":"7aaa499b_73093b95","updated":"2015-04-13 21:57:59.000000000","message":"The \"malicious user\" would be a normal (valid) user from one trusted IdP who is accessing the Keystone federation authentication URL of another IdP.  If I was an evil employee at \"Some Corp.\", I would go to my IdP to get an assertion and supply it to Keystone using the federation authentication URL of \"Another Corp.\" in the hopes that the mapping rules there give me some unintended access.\n\nIs there a better way of wording it than I initially proposed that you can think of?  I suppose I could say that \"A malicious user from one identity provider...for another identity provider\", but I\u0027m not sure if that adds the clarity you are looking for.","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bdd678f66372ec6671625af7c11b2e2c7ed6c384","unresolved":false,"context_lines":[{"line_number":24,"context_line":"are actually being used against a mapping that is associated with that"},{"line_number":25,"context_line":"same identity provider.  A malicious user from a trusted identity"},{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"},{"line_number":29,"context_line":"access to resources that they are not intended to access."},{"line_number":30,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_aaf4cf86","line":27,"updated":"2015-04-14 03:31:45.000000000","message":"content* singular","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c01ededf5c1d9b0d06fee80e8997952bc1e158f7","unresolved":false,"context_lines":[{"line_number":24,"context_line":"are actually being used against a mapping that is associated with that"},{"line_number":25,"context_line":"same identity provider.  A malicious user from a trusted identity"},{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"},{"line_number":29,"context_line":"access to resources that they are not intended to access."},{"line_number":30,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_d3f24f9a","line":27,"updated":"2015-04-13 15:01:35.000000000","message":"typo: ientity","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"55abfee71858162f5fd1e1cfbaec38e94c8f9003","unresolved":false,"context_lines":[{"line_number":24,"context_line":"are actually being used against a mapping that is associated with that"},{"line_number":25,"context_line":"same identity provider.  A malicious user from a trusted identity"},{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"},{"line_number":29,"context_line":"access to resources that they are not intended to access."},{"line_number":30,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_2ed43e1e","line":27,"in_reply_to":"7aaa499b_aaf4cf86","updated":"2015-04-14 14:04:17.000000000","message":"Done","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"55abfee71858162f5fd1e1cfbaec38e94c8f9003","unresolved":false,"context_lines":[{"line_number":24,"context_line":"are actually being used against a mapping that is associated with that"},{"line_number":25,"context_line":"same identity provider.  A malicious user from a trusted identity"},{"line_number":26,"context_line":"provider could access a Keystone federated authentication URL for a"},{"line_number":27,"context_line":"different ientity provider.  Depending on the contents of the assertions"},{"line_number":28,"context_line":"or claims and the mapping rules, this could result in a user gaining"},{"line_number":29,"context_line":"access to resources that they are not intended to access."},{"line_number":30,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_4e166af2","line":27,"in_reply_to":"7aaa499b_d3f24f9a","updated":"2015-04-14 14:04:17.000000000","message":"Done","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bdd678f66372ec6671625af7c11b2e2c7ed6c384","unresolved":false,"context_lines":[{"line_number":41,"context_line":"Even though the Juno release of Keystone does not have the ability to"},{"line_number":42,"context_line":"enforce that an identity provider and a mapping match, it is possible to"},{"line_number":43,"context_line":"configure the frontend webserver that is used to deploy Keystone to"},{"line_number":44,"context_line":"perform this enforcement.  Each identity provider within Keystone has"},{"line_number":45,"context_line":"its own authentication URL.  It is recommended that the webserver"},{"line_number":46,"context_line":"configuration configures its underlying federation plug-ins to"},{"line_number":47,"context_line":"cryptograhically enforce that an identity provider is only valid for"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_4a2c2b02","line":44,"updated":"2015-04-14 03:31:45.000000000","message":"supported by instead of within?","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"55abfee71858162f5fd1e1cfbaec38e94c8f9003","unresolved":false,"context_lines":[{"line_number":41,"context_line":"Even though the Juno release of Keystone does not have the ability to"},{"line_number":42,"context_line":"enforce that an identity provider and a mapping match, it is possible to"},{"line_number":43,"context_line":"configure the frontend webserver that is used to deploy Keystone to"},{"line_number":44,"context_line":"perform this enforcement.  Each identity provider within Keystone has"},{"line_number":45,"context_line":"its own authentication URL.  It is recommended that the webserver"},{"line_number":46,"context_line":"configuration configures its underlying federation plug-ins to"},{"line_number":47,"context_line":"cryptograhically enforce that an identity provider is only valid for"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_0ea502b4","line":44,"in_reply_to":"7aaa499b_4a2c2b02","updated":"2015-04-14 14:04:17.000000000","message":"Done","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c01ededf5c1d9b0d06fee80e8997952bc1e158f7","unresolved":false,"context_lines":[{"line_number":77,"context_line":"    MellonIdPMetadataFile /etc/httpd/mellon/idp2-metadata.xml"},{"line_number":78,"context_line":"    MellonEndpointPath /v3/OS-FEDERATION/identity_providers/idp2/protocols/saml2/auth/mellon"},{"line_number":79,"context_line":"  \u003c/Location\u003e"},{"line_number":80,"context_line":"--- end example httpd configuration snippet ---"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"In the above example, we have two identity providers (\u0027idp1\u0027 and"},{"line_number":83,"context_line":"\u0027idp2\u0027).  Each identity provider has their own \u0027Location\u0027 directive,"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_b31d83bf","line":80,"updated":"2015-04-13 15:01:35.000000000","message":"Request: Can someone confirm this was tested please?","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"6f9bb0a22e8c04caf70d1bc34c0cd66ecabe1f7c","unresolved":false,"context_lines":[{"line_number":77,"context_line":"    MellonIdPMetadataFile /etc/httpd/mellon/idp2-metadata.xml"},{"line_number":78,"context_line":"    MellonEndpointPath /v3/OS-FEDERATION/identity_providers/idp2/protocols/saml2/auth/mellon"},{"line_number":79,"context_line":"  \u003c/Location\u003e"},{"line_number":80,"context_line":"--- end example httpd configuration snippet ---"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"In the above example, we have two identity providers (\u0027idp1\u0027 and"},{"line_number":83,"context_line":"\u0027idp2\u0027).  Each identity provider has their own \u0027Location\u0027 directive,"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_e1f9e34e","line":80,"in_reply_to":"7aaa499b_b31d83bf","updated":"2015-04-13 21:57:59.000000000","message":"I\u0027ve tested it.","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c01ededf5c1d9b0d06fee80e8997952bc1e158f7","unresolved":false,"context_lines":[{"line_number":108,"context_line":"This can be done using the Identity API directly, or via the \u0027openstack\u0027"},{"line_number":109,"context_line":"command-line utility."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"It is recommended that you use the proper webserver configuration in"},{"line_number":112,"context_line":"addition to the new \u0027remote_ids\u0027 checking checking in the Kilo release."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_1355574f","line":111,"updated":"2015-04-13 15:01:35.000000000","message":"proper? Is this the one described above? I suggest changing the wording slightly.","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"55abfee71858162f5fd1e1cfbaec38e94c8f9003","unresolved":false,"context_lines":[{"line_number":108,"context_line":"This can be done using the Identity API directly, or via the \u0027openstack\u0027"},{"line_number":109,"context_line":"command-line utility."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"It is recommended that you use the proper webserver configuration in"},{"line_number":112,"context_line":"addition to the new \u0027remote_ids\u0027 checking checking in the Kilo release."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_ceaefa97","line":111,"in_reply_to":"7aaa499b_1355574f","updated":"2015-04-14 14:04:17.000000000","message":"Done","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bdd678f66372ec6671625af7c11b2e2c7ed6c384","unresolved":false,"context_lines":[{"line_number":109,"context_line":"command-line utility."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"It is recommended that you use the proper webserver configuration in"},{"line_number":112,"context_line":"addition to the new \u0027remote_ids\u0027 checking checking in the Kilo release."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"### Contacts / References ###"},{"line_number":115,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0047"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_6a1c87c1","line":112,"updated":"2015-04-14 03:31:45.000000000","message":"checking is written twice here","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"55abfee71858162f5fd1e1cfbaec38e94c8f9003","unresolved":false,"context_lines":[{"line_number":109,"context_line":"command-line utility."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"It is recommended that you use the proper webserver configuration in"},{"line_number":112,"context_line":"addition to the new \u0027remote_ids\u0027 checking checking in the Kilo release."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"### Contacts / References ###"},{"line_number":115,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0047"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7aaa499b_ae960e4a","line":112,"in_reply_to":"7aaa499b_6a1c87c1","updated":"2015-04-14 14:04:17.000000000","message":"Done","commit_id":"6d96772ff7d107e6f115b69d48297c25045d1a66"}]}