Identity Program Specifications

Project Documentation:

• Specification Template

keystone

Ocata approved specs:

• Allow retrieving an expired token
• Devstack Plugin for Keystone
• Drop Support for Driver Versioning
• Fernet Key Store
• Native SAML in keystone
• Auth plugin to support Multi-Factor Auth via password + TOTP
• PCI-DSS Query Password Expired Users
• PCI-DSS Notifications
• Shadow mapping

Backlog:

• Backlog Instructions
• Alembic Migrations
• Centralized Policies Distribution Mechanism
• Centralized Policies Fetch and Cache
• Decouple Auth from API Version
• Materialized path - materialize-project-hierarchy
• Microversions
• model-timestamps
• Default Policy File
• Expand endpoint filters to Service Providers

Ongoing:

• Functional Testing
• Object Dependency Lifecycle
• Role Check From Keystonemiddleware
• Unified model for assignments, OAuth and trusts

keystoneauth

keystoneauth approved specs for the Newton release:

• None

keystoneclient

keystoneclient approved specs for the Newton release:

• None

keystonemiddleware

keystonemiddleware approved specs for the Newton release:

• None

Backlog:

• Add Endpoint Filter Enforcement to Keystonemiddleware
• Request Helpers

Implemented Identity Program Specifications

keystone

Newton implemented specs:

• Support Credential Encryption
• keystone-manage doctor
• LDAP preprocessing
• Migration commands for rolling upgrades
• Security Hardening: PCI-DSS
• Python3.4 Compatibility
• Shadow users (Newton): Unified identity for multiple authentication sources
• Fix tests to run on non-SQLite databases

Mitaka implemented specs:

• Add is_domain to the token for projects acting as a domain
• Bootstrap via CLI
• Allow Retrieval of Default Domain Configuration Options
• Domain Specific Roles
• Direct users mapping using group ids
• Implied Roles - Assign one Role, get many
• Annotate Tokens for the admin project
• Add names to list assignments
• List Assignments for a Project Tree
• Improve List Role Assignments API Performance
• Remove role metadata structures
• Reseller Use Case
• Shadow users: Unified identity for multiple authentication sources
• Support TOTP Authentication
• Project Tree Deletion
• Optionally enforce URL-safe domain and project names

Liberty implemented specs:

• New attributes for SAML Assertion generated by keystone IdP
• Data Driven Assignment Unit Testing
• Make storing of extra SQL attributes optional
• Identity Provider Specific WebSSO
• Tokenless Authorization with X.509 Client SSL Certificate
• List credentials by type
• Stable Keystone Driver Interfaces

Kilo implemented specs:

• IETF ABFAB federation
• CADF Everywhere
• Domain Configuration Storage
• Explicitly Unscoped Tokens
• Direct users mapping for federated authentication
• Scope federation tokens with token authentication method
• IdP ID registration and validation
• Federated Service Providers in Keystone
• Keystone Lightweight Tokens - KLWT
• Enhance Federation mapping algorithms
• OpenID Connect federation
• Split-up Assignments, making the Role-Assignment piece pluggable
• New query params to retrieve the project hierarchy
• Deprecated items that are removed as of the Kilo release
• Replace the concept of extensions
• Rescoping Spec - From Unscoped to Scoped
• Allow Redelegation via Trusts
• Web Single Sign On Portal

Juno implemented specs:

• Audit Support for Keystone Federation
• Retrieve Authentication Scoped Data
• Multi-Attribute Endpoint Grouping
• Endpoint Policy Extension
• Add foreign key to region table in endpoint table
• Filter credentials by user ID
• Standardizing the federation process
• Stand alone service catalog
• Hierarchical Projects
• Use JSON Home for Version/Extension discovery
• API Validation
• Keystone to Keystone federation
• Cross-backend IDs for User and Group Entities
• Non-Persistent Tokens
• Role Assignment Notifications

keystoneauth

• None

keystoneclient

Mitaka implemented specs:

• Deprecate keystone CLI

Liberty implemented specs:

• Deprecations

keystonemiddleware

Kilo implemented specs:

• Adding audit middleware to keystonemiddleware

Juno implemented specs:

• Service Token Composite Authorization
• Split Identity Middleware into a Distinct Package

Indices and tables

• Search Page