)]}'
{"security-notes/OSSN-0053":[{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"7af3112ec74d5314f758994d8c37666956c148be","unresolved":false,"context_lines":[{"line_number":36,"context_line":"in the future."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"#### Recommended Actions ###"},{"line_number":39,"context_line":"Any, or all, of the following steps can be taken to reduce exposure:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"1. Monitor and audit trust creation events within your environment."},{"line_number":42,"context_line":"Keystone emits notifications on trust creation and deletion that are"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"da20952f_6320404a","line":39,"updated":"2015-09-02 22:59:03.000000000","message":"I prefer the original language, if someone who didn\u0027t have a tech background only did #1, they would be able to claim security.\n\nMaybe: \"The following steps are recommended to reduce exposure, based on the granularity and desired level of exposure in a given environment\u0027?","commit_id":"695536fcb9a7baeea6b59dfcd4dea88e60429f78"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"954bcec8c4c7f3e96e9d27cdb4b27e5803ef3d1e","unresolved":false,"context_lines":[{"line_number":31,"context_line":"issue of trust documented here appears most critical."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This behavior is intrinsic to the bearer token model used within"},{"line_number":34,"context_line":"Keystone / OpenStack. With dynamic policy and a unified delegation"},{"line_number":35,"context_line":"model this will ultimately be fixed, but that is likely to be some time"},{"line_number":36,"context_line":"in the future."},{"line_number":37,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_defec304","line":34,"updated":"2015-09-02 23:16:17.000000000","message":"Maybe make this more aspirational : If the proposals for a dynamic policy framework are accepted...\n\nand add a link to the review for dynamic policy in the links section","commit_id":"bab150964eb149c862d5c1ecc89cdcc1b4168445"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"954bcec8c4c7f3e96e9d27cdb4b27e5803ef3d1e","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"#### Contacts / References ###"},{"line_number":59,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0053"},{"line_number":60,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1455582"},{"line_number":61,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":62,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_e349b08f","line":60,"updated":"2015-09-02 23:16:17.000000000","message":"s/ossn/keystone","commit_id":"bab150964eb149c862d5c1ecc89cdcc1b4168445"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"fcf37aebada28056a55884389f4a6bc1cb28b1a2","unresolved":false,"context_lines":[{"line_number":33,"context_line":"This behavior is intrinsic to the bearer token model used within"},{"line_number":34,"context_line":"Keystone / OpenStack. There is currently a proposal for a dynamic policy"},{"line_number":35,"context_line":"framework that should provide operators with improved capabilities for"},{"line_number":36,"context_line":"mitigating these issues through policy configurations."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"#### Recommended Actions ###"},{"line_number":39,"context_line":"The following steps are recommended to reduce exposure, based on the"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_3ecc76ba","line":36,"updated":"2015-09-10 20:28:18.000000000","message":"I don\u0027t see how a vague hand waving of \"dynamic policies\" would provide any sort of meaningful mitigation against this. If you can\u0027t provide an explanation of the relevant \"improved capabilities,\" and it has nothing to do with the recommended actions, then this should be removed, especially considering the feature is not available in any stable branch.","commit_id":"2a295f326093e4fadcc2bec7fdc92ff58f932b15"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"7b5616cd020921146e7bbd47bee8fb90a12e37dd","unresolved":false,"context_lines":[{"line_number":33,"context_line":"This behavior is intrinsic to the bearer token model used within"},{"line_number":34,"context_line":"Keystone / OpenStack. There is currently a proposal for a dynamic policy"},{"line_number":35,"context_line":"framework that should provide operators with improved capabilities for"},{"line_number":36,"context_line":"mitigating these issues through policy configurations."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"#### Recommended Actions ###"},{"line_number":39,"context_line":"The following steps are recommended to reduce exposure, based on the"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_34d23b01","line":36,"in_reply_to":"da20952f_3ecc76ba","updated":"2015-09-11 13:39:22.000000000","message":"fair, i think the intent with this paragraph was just to indicate that things might change with the addition of the dynamic policy framework. i\u0027ll rework this.","commit_id":"2a295f326093e4fadcc2bec7fdc92ff58f932b15"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"12c32911a04e95667501905d08d045727416d3a2","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Hierarchical Roles : https://review.openstack.org/#/c/125704"},{"line_number":64,"context_line":"Policy by URL : https://review.openstack.org/#/c/192422"},{"line_number":65,"context_line":"unified policy file : https://review.openstack.org/#/c/134656"},{"line_number":66,"context_line":"Endpoint_ID from URL : https://review.openstack.org/#/c/199844"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_792eba43","line":66,"updated":"2015-09-09 18:58:49.000000000","message":"Dynamic Policies wiki:  https://wiki.openstack.org/wiki/DynamicPolicies","commit_id":"2a295f326093e4fadcc2bec7fdc92ff58f932b15"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"7b5616cd020921146e7bbd47bee8fb90a12e37dd","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Hierarchical Roles : https://review.openstack.org/#/c/125704"},{"line_number":64,"context_line":"Policy by URL : https://review.openstack.org/#/c/192422"},{"line_number":65,"context_line":"unified policy file : https://review.openstack.org/#/c/134656"},{"line_number":66,"context_line":"Endpoint_ID from URL : https://review.openstack.org/#/c/199844"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_34279b13","line":66,"in_reply_to":"da20952f_792eba43","updated":"2015-09-11 13:39:22.000000000","message":"i\u0027ll add this if we keep the dynamic policy language, but it sounds like it might be best to just remove it.","commit_id":"2a295f326093e4fadcc2bec7fdc92ff58f932b15"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e8c6d545d1815541620e43a6b30279e609d5943d","unresolved":false,"context_lines":[{"line_number":28,"context_line":"are delegated through the trust."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"There are other ways that a compromised token can be misused, but the"},{"line_number":31,"context_line":"issue of trust documented here appears most critical."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This behavior is intrinsic to the bearer token model used within"},{"line_number":34,"context_line":"Keystone / OpenStack."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"da20952f_8ecbeb71","line":31,"updated":"2015-09-11 16:04:35.000000000","message":"This is the one bit of this OSSN I find a bit silly... which is also sort of the basis for the entire OSSN. Anyway, this particular statement is an unfounded opinion that I wholeheartedly disagree with. If bearer tokens are being systematically compromised in any manner, malicious trust creation would not be anywhere near the top of my list of concerns. All resources accessible to the compromised user are immediately vulnerable, nevermind bothering to delegate any of that authorization to the malicious user... they already have the authorization because they have a bearer token. At best, I would envision this \"attack vector\" to provide a means of slightly obscuring / misdirecting the audit trail.","commit_id":"e1095f1958e692fcc0790727222e3671bf0abf61"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"7be82737f9c5013a80a549749cd82fcec87c470e","unresolved":false,"context_lines":[{"line_number":28,"context_line":"are delegated through the trust."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"There are other ways that a compromised token can be misused, but the"},{"line_number":31,"context_line":"issue of trust documented here appears most critical."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This behavior is intrinsic to the bearer token model used within"},{"line_number":34,"context_line":"Keystone / OpenStack."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"ba15a1d1_22988869","line":31,"in_reply_to":"da20952f_8ecbeb71","updated":"2015-09-17 17:56:43.000000000","message":"I agree with this.  I think this issue is worth having an OSSN for, as it\u0027s trying to point out that creation of a trust with an intercepted token can allow for unintended access even after the intercepted token has expired.  Keystone tokens are bearer tokens, so all other sorts of immediate damage can be done if a token is intercepted.\n\nI think we should update this note to not label this trust issue as \"most critical\".  It\u0027s simply an issue that one should be aware of, which may not be obvious.","commit_id":"e1095f1958e692fcc0790727222e3671bf0abf61"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e8c6d545d1815541620e43a6b30279e609d5943d","unresolved":false,"context_lines":[{"line_number":31,"context_line":"issue of trust documented here appears most critical."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This behavior is intrinsic to the bearer token model used within"},{"line_number":34,"context_line":"Keystone / OpenStack."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"#### Recommended Actions ###"},{"line_number":37,"context_line":"The following steps are recommended to reduce exposure, based on the"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"da20952f_8e79ab31","line":34,"updated":"2015-09-11 16:04:35.000000000","message":"++","commit_id":"e1095f1958e692fcc0790727222e3671bf0abf61"}]}