Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1362122

Summary:	[RFE] Keystone password management (for PCI-DSS)
Product:	Red Hat OpenStack	Reporter:	David Sanz <dsanzmor>
Component:	openstack-keystone	Assignee:	Adam Young <ayoung>
Status:	CLOSED ERRATA	QA Contact:	Rodrigo Duarte <rduartes>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0 (Kilo)	CC:	dsanzmor, Egarciad, jdennis, jschluet, kbasil, mfuruta, molasaga, nkinder, ochalups, rduartes, srevivo
Target Milestone:	rc	Keywords:	FutureFeature, Triaged
Target Release:	10.0 (Newton)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-keystone-10.0.0-2.el7ost	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1429533 (view as bug list)		Environment:
Last Closed:	2016-12-14 15:47:46 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1429533

Description David Sanz 2016-08-01 10:33:12 UTC

When using mysql as backend authentication, there’s no password verification when creating a new user or when user change its own password.
The PCI guide require some quality requirements regarding the password management, for example:

Password Maximum Age
Password Strength Minimum Digit Characters
Password Minimum Length
Password Strength Minimum Uppercase Characters
Password Strength Minimum Lowercase Characters

Those requirements should be configurables by the administrator, and mandatory for users when they try to change their own password.

Use Case:

Bank regulatory process require that all systems related to transaction management have restrictions about password management.

Comment 2 Adam Young 2016-08-05 18:00:24 UTC

PCI work is happening upstream. We are  likely to have a better situation in the Newton release.

http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/keystone/newton/pci-dss.rst

See the set of posted changes in the Blueprint.

https://blueprints.launchpad.net/keystone/+spec/pci-dss

Please update this bug accordingly;  MAake RFEs fro things not covered, and tracker bugs for the features in upstream that you care about.

Comment 5 Rodrigo Duarte 2016-10-07 18:26:52 UTC

A couple of bugs have been reported upstream for this feature [1][2]. [1] has already been merged and backported to stable/newton [3][4], [2] has already been merged [5] but the backport has not been merged yet [6].

[1] https://bugs.launchpad.net/keystone/+bug/1628692
[2] https://bugs.launchpad.net/keystone/+bug/1630092

[3] https://review.openstack.org/#/c/379018/ (master fix for bug [1])
[4] https://review.openstack.org/#/c/379607/ (stable/newton for bug [1])

[5] https://review.openstack.org/#/c/379030/ (master fix for bug [2])
[6] https://review.openstack.org/#/c/383846/ (stable/newton for bug [2])

Comment 8 Nathan Kinder 2016-10-21 15:51:18 UTC

The final patch for this merged upstream into stable/newton (see comment#5, item#6 for the review link).

Comment 9 Rodrigo Duarte 2016-11-04 22:29:39 UTC

verified for openstack-keystone-10.0.0-2.el7ost.

Comment 16 errata-xmlrpc 2016-12-14 15:47:46 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2948.html