Hello Keystone Devs,
I've been playing with an interesting idea in regards to the
authentications plugins in Keystone as I was curious if I could achieve
per user IP rules for authentication with the existing setup we have.
In short, yes, and here is an example plugin that seems to work:
http://paste.openstack.org/show/589067/
The idea, allow a user to set a bunch of IP addresses (as CIDR) from
which they can authenticate. These are user controlled and added as a
'credential' with type 'CIDR'. The keystone plugin will then simply
compare the source ip against the credentials setup for that user. It
does this before actually checking password. It is simple, and it works.
Once you have a token the CIDR rules don't matter as otherwise APIs
checking for valid tokens might be affected, but I don't think that's an
issue.
One problem is that it will not work for Horizon, as Horizon pollutes
the source ip with its own, but for service accounts this is fantastic
as they never need to access horizon. It would be nice to fix this, but
I'm not sure if there is a good way to do so, other than updating
Horizon to authenticate entirely in javascript directly to Keystone,
which would be a huge effort.
An additional problem is that with the current way keystone auth plugins
work, there is no way to nicely layer and enforce the plugins together.
So if we wanted to have password + TOTP + CIDR, it would need to be a
single plugin that combined all three. This is doable, but messy because
rather than simply defining a combined layering of plugins, you need to
write new ones all the time. I think we need to better address combing
auth plugins, but that is a different topic, although one which may need
to precede any additional auth plugins. I do have some vague ideas
around this problem, but I'll flesh those out as a spec at some stage I
think.
The above problem aside, is there any interest in Keystone for a plugin
such as this?
Provided I find nothing hugely wrong in testing, we will likely use
something like this in our deployment, although contrary to the plugin
layering problem, I will probably write a combined custom plugin for
password+TOTP+CIDR rather than wait for a longer term solution.
I think user authentication limited by per user IP rules is hugely
powerful, and very useful. Although it does limit Horizon access, it is
still useful for service accounts which cannot use TOTP, thus allowing a
MFA-lite option which can be limited to specific ip address ranges. Or
if you are really paranoid and don't use Horizon, you can do CIDR and
TOTP for admin accounts (or even run your own local Horizon so it uses
your ip).
Any thoughts?
Cheers,
Adrian Turjak
__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
