Bug 1110589 – [RFE][keystone]: Allow Redelegation via Trusts

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1110589 - [RFE][keystone]: Allow Redelegation via Trusts

Summary:	[RFE][keystone]: Allow Redelegation via Trusts

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	openstack-keystone (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	Unspecified Unspecified

Priority	medium Severity medium
Target Milestone:	Upstream M2
Target Release:	7.0 (Kilo)
Assigned To:	Nathan Kinder
QA Contact:	yeylon@redhat.com
Docs Contact:

URL:	https://blueprints.launchpad.net/keys...
Whiteboard:	upstream_milestone_kilo-2 upstream_de...
Keywords:	FutureFeature, OtherQA

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2014-06-18 00:05 EDT by RHOS Integration
Modified:	2016-04-26 19:12 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:	openstack-keystone-2015.1.0-1.el7ost
Doc Type:	Enhancement
Doc Text:	The Identity Service (keystone) now allows for re-delegation of trusts. This allows a trustee with a trust token to create another trust to delegate their roles to others. In addition, a counter enumerates the number of times a trust can be re-delegated. This feature allows a trustee to re-delegate the roles contained in its trust token to another trustee. The user creating the initial trust can control if a trust can be re-delegated when this is necessary. Consequently, trusts can now be re-delegated if the original trust allows it.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-08-05 09:12:36 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHEA-2015:1548	normal	SHIPPED_LIVE	Red Hat Enterprise Linux OpenStack Platform Enhancement Advisory	2015-08-05 13:07:06 EDT

Groups: None (edit)

Description RHOS Integration 2014-06-18 00:05:44 EDT

Cloned from launchpad blueprint https://blueprints.launchpad.net/keystone/+spec/trusts-redelegation.

Description:

Add support to trusts such that redelegation between consumers of trusts
(trustees, which are services for the currently expected use-cases) is
possible.

Specification URL (additional information):

None

Comment 2 Mike Abrams 2015-03-20 05:39:46 EDT

Nathan, need more on the success criteria here; i've read the full spec here but still feel i need some direction on how to test.  thx a lot.

Comment 3 Nathan Kinder 2015-03-20 12:32:26 EDT

(In reply to Mike Abrams from comment #2)
> Nathan, need more on the success criteria here; i've read the full spec here
> but still feel i need some direction on how to test.  thx a lot.

So this new "allow_redelegation" setting essentially just lets you
create a trust using a trust token.  This previously was not possible.
Aditionally, there is a counter to say how many times a trust can be
redelegated . You should do some basic tests for this:

- Attempt to create a trust to redelegate using a trust token when
allow_redelegation is not set (should fail - negative test).

- Attempt to create a trust to redelegate using a trust token when
allow_redelegation is set, then execute that new trust (should pass).

- Set a counter for the max number of delegations to something like 2,
then make sure if can only be chained that many times.

Comment 10 errata-xmlrpc 2015-08-05 09:12:36 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2015:1548

Note You need to log in before you can comment on or make changes to this bug.