Bug 1263015

Summary:	[RFE] tokenless auth with x509 client cert
Product:	Red Hat OpenStack	Reporter:	Nathan Kinder <nkinder>
Component:	openstack-keystone	Assignee:	Nathan Kinder <nkinder>
Status:	CLOSED ERRATA	QA Contact:	Rodrigo Duarte <rduartes>
Severity:	low	Docs Contact:
Priority:	low
Version:	8.0 (Liberty)	CC:	ayoung, jschluet, nbarcet, nkinder, nlevinki, sclewis, yeylon
Target Milestone:	beta	Keywords:	FutureFeature
Target Release:	8.0 (Liberty)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-keystone-8.0.0-1.el7ost	Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-04-07 21:08:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1296011

Description Nathan Kinder 2015-09-14 22:17:48 UTC

This feature adds the ability for services to authenticate to Keystone with a X.509 client certificate, without needing to obtain a token from Keystone.

Upstream blueprint: https://blueprints.launchpad.net/keystone/+spec/keystone-tokenless-authz-with-x509-ssl-client-cert

Upstream spec: http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/liberty/keystone-tokenless-authz-with-x509-ssl-client-cert.rst

Comment 6 Rodrigo Duarte 2016-02-19 19:25:19 UTC

This hasn't support yet in keystonemiddleware (via keystoneauth), so it shouldn't work for the services.

We might test it for a regular user and make the calls via cURL.

Comment 8 Rodrigo Duarte 2016-04-05 15:04:50 UTC

This feature also relies in keystone to be running in httpd, which is not a reality yet for OSPD (and won't be for the 8 release).

Comment 9 nlevinki 2016-04-06 06:49:03 UTC

Moving it to RHOS9, since httpd support will land in this release

Comment 11 errata-xmlrpc 2016-04-07 21:08:38 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-0603.html