Bug 1041958

Summary: [RFE][keystone]: Store the token HASH in Secure Cookie for HTML clients
Product: Red Hat OpenStack Reporter: RHOS Integration <rhos-integ>
Component: RFEsAssignee: RHOS Maint <rhos-maint>
Status: CLOSED UPSTREAM QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: markmc, yeylon
Target Milestone: ---Keywords: FutureFeature
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
URL: https://blueprints.launchpad.net/keystone/+spec/tokens-in-secure-cookie
Whiteboard: upstream_milestone_none upstream_status_unknown upstream_definition_obsolete
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-19 17:06:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description RHOS Integration 2013-12-12 20:17:43 UTC 
Cloned from launchpad blueprint https://blueprints.launchpad.net/keystone/+spec/tokens-in-secure-cookie.

Description:

In order to implement HATEOAS, Keystone clients will need to be able to authenticate, and to have the authentication stick across multiple requests.  Passing it in a custom Header does not work with web browsers.

If the HTML request specifies an accepted content type of  HTML or XHTML,  the token HASH should be stored in a secure Cookie.  Additional requests to Keystone will then check for the presence and validity of the HASH in order  to continue to authenticate  the user requests.

Only unscoped token issued will be stored in the Secure cookies.
Requesting an additional unscoped token will replace the unscope token in the the cookie, but will not extend the lifetime unless it is accompanied by valid credentials used to issue a token in the first place.




Specification URL (additional information):

None