Bug 1042204

Summary:	[RFE][heat]: OAuth credentials resource
Product:	Red Hat OpenStack	Reporter:	RHOS Integration <rhos-integ>
Component:	RFEs	Assignee:	RHOS Maint <rhos-maint>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	markmc, yeylon
Target Milestone:	---	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
URL:	https://blueprints.launchpad.net/heat/+spec/oauth-credentials-resource
Whiteboard:	upstream_milestone_next upstream_status_not-started upstream_definition_obsolete
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-19 17:16:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description RHOS Integration 2013-12-12 21:21:53 UTC

Cloned from launchpad blueprint https://blueprints.launchpad.net/heat/+spec/oauth-credentials-resource.

Description:

To be able to delegate access to instances or other services in Heat would be interesting. One first step  would be a OS::Keystone::OAuthCredentials resources, that instances could use to request a token when needed.

We need to create:
 * Create a consumer using Heat service user credentials. It could be global, per stack or per resource.
 * Create a request token for the consumer per resource.
 * Authorize the request token using the user credentials.
 * Create the access token.

The key and the secret of the access token are then required to retrieve a regular keystone token by other resources. They need to be exposed as attributes. Roles can be taken as inputs, with the user role as default.

it depends on https://blueprints.launchpad.net/python-keystoneclient/+spec/add-oauth-support for keystone-client support.

Specification URL (additional information):

None