Bug 1041961

Summary: [RFE][keystone]: Keystone should use keystoneclient authtoken middleware
Product: Red Hat OpenStack Reporter: RHOS Integration <rhos-integ>
Component: RFEsAssignee: RHOS Maint <rhos-maint>
Status: CLOSED UPSTREAM QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: markmc, yeylon
Target Milestone: ---Keywords: FutureFeature
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
URL: https://blueprints.launchpad.net/keystone/+spec/use-keystoneclient
Whiteboard: upstream_milestone_none upstream_status_unknown upstream_definition_superseded
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-19 17:16:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description RHOS Integration 2013-12-12 20:18:44 UTC 
Cloned from launchpad blueprint https://blueprints.launchpad.net/keystone/+spec/use-keystoneclient.

Description:

Token checking/validating in keystone for authenticated functions is spread over a wide range of files, some which check admin, some which retrieve the token data some which actually authenticate and some which don't. 

This is ludicrous, we have auth token middleware that we provide to other applications, the authenticated sections of keystone should also rely on this mechanism. This would involve figuring out providing certificates to the middleware for pki tokens, properly understanding what requires authentication and at what level. This would hopefully also mean that we may not have a need to save the token metadata to the database, we could simply rely on the signed token passed to keystone in the way that other projects do and simply save token data for revocation purposes. 

Specification URL (additional information):

None