Audit Support for Keystone Federation

bp audit-support-for-federation

Keystone is expanding its support for federated identity to enable it to have a more seamless integration into enterprise environments and to leverage existing identity providers. The extra complexity associated with authentication and authorization in federated Keystone deployments demands suitable audit support to ensure the OpenStack environment is used in a compliant fashion. In this blueprint we describe proposed auditing support for Keystone federated identity operations using the DMTF Cloud Auditing Data Federation (CADF) Open Standard, and leveraging PyCADF.

Problem Description

For Keystone, we need to define and implement support for new CADF audit event records that capture the authentication and authorization behavior associated with the mapping of federated attributes to group-based role assignments. Also, for auditing purposes, we need to capture the user identity information that is derived from external identity providers. This is crucial because in the federated identity model for Keystone, user information is ephemeral and no longer stored in Keystone directly.

Proposed Change

Proposed change is to add new CADF based audit event notifications for operations associated with federated identity. We intend to reuse the existing notification work from Icehouse release.

The data within the notification will be comprised of information relating to the federated user and the identity provider. Information such as: username, userid, identity provider, protocol, and groups that the user was mapped to, should be included within the notification.

For more details on what actions will trigger a notifications, please refer to the Notifications Impact section of this specification.

Alternatives

NONE

Data Model Impact

NONE

REST API Impact

NONE

Security Impact

Auditing records need to be designed so that they do not accidentally publish sensitive data, such as token information or passwords.

Notifications Impact

New CADF notifications will need to be created for the following events:

• Federated user attempts to authenticate and retrieve an unscoped token.
• Federated user attempts to retrieve a list of projects.
• Federated user attempts to retrieve a list of domains.
• Federated user attempts to authenticate and retrieve a scoped token.

Other End User Impact

NONE

Performance Impact

Performance should be marginally impacted if the CADF event notification for federation support is enabled.

Other Deployer Impact

NONE

Developer Impact

NONE

Implementation

Assignee(s)

Primary assignee:

• btopol

Other contributors:

• stevemar
• chungg
• mrutkows

Work Items

• Define new audit event formats.
• Implement notifications for the new events.
• Create unit tests for the new events.
• Document new notifications events.

Dependencies

No new dependencies, however we will be using the PyCADF library, which is already a required library for Keystone.

Testing

Unit tests will be added for the new events.

Documentation Impact

New audit events that have been added should be documented here.

References

• DMTF Cloud Auditing Data Federation (CADF) Open Standard
• PyCADF library
• Notification Documentation for Keystone