Implement Token Binding.

[OpenStack Infra]

https://review.openstack.org/35093
commit 8e90214b294ce345f59fb7b7d61f9e89349f128d
Author: Jamie Lennox <email address hidden>
Date: Mon Jun 17 04:22:06 2013 +0000

    Implement Token Binding.

    Brings token binding to keystone server. There are a number of places
    where the location or hardcoding of binding checks are not optimal
    however fixing them will require having a proper authentication plugin
    scheme so just assume that they will be moved when that happens.

    DocImpact
    Implements: blueprint authentication-tied-to-token
    Change-Id: Ib34e5e0b6bd83837f6addbd45d4c5b828ce2f3bd

[Tom Fifield (fifieldt)]

Need to add this text:

Token Binding
-------------

Token binding refers to the practice of embedding information from external
authentication providers (like a company's Kerberos server) inside the token
such that a client may enforce that the token only be used in conjunction with
that specified authentication. This is an additional security mechanism as it
means that if a token is stolen it will not be usable without also providing the
external authentication.

To activate token binding you must specify the types of authentication that
token binding should be used for in ``keystone.conf`` e.g.::

    [token]
    bind = kerberos

Currently only ``kerberos`` is supported.

To enforce checking of token binding the ``enforce_token_bind`` parameter
should be set to one of the following modes:

* ``disabled`` disable token bind checking
* ``permissive`` enable bind checking, if a token is bound to a mechanism that
  is unknown to the server then ignore it. This is the default.
* ``strict`` enable bind checking, if a token is bound to a mechanism that is
  unknown to the server then this token should be rejected.
* ``required`` enable bind checking and require that at least 1 bind mechanism
  is used for tokens.
* named enable bind checking and require that the specified authentication
  mechanism is used. e.g.::

    [token]
    enforce_token_bind = kerberos

  *Do not* set ``enforce_token_bind = named`` as there is not an authentication
  mechanism called ``named``.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/63293

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/63293
Committed: https://git.openstack.org/cgit/openstack/openstack-manuals/commit/?id=9d93c4f71f6f4f92ce7ac9c1e152d11de1fbde51
Submitter: Jenkins
Branch: master

commit 9d93c4f71f6f4f92ce7ac9c1e152d11de1fbde51
Author: Tom Fifield <email address hidden>
Date: Fri Dec 20 11:32:45 2013 +0800

    Add section on Keystone Token Binding

    Havana added this feature, here are the docs.

    Change-Id: I9c8c785f3eed91cc688f49e7dda7228cc1ff5216
    Closes-Bug: 1196775

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/havana
Review: https://review.openstack.org/63505

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/63505
Committed: https://git.openstack.org/cgit/openstack/openstack-manuals/commit/?id=95a3bcb4f46b992eba250c60e1ae729e29688a2b
Submitter: Jenkins
Branch: stable/havana

commit 95a3bcb4f46b992eba250c60e1ae729e29688a2b
Author: Tom Fifield <email address hidden>
Date: Fri Dec 20 11:32:45 2013 +0800

    Add section on Keystone Token Binding

    Havana added this feature, here are the docs.

    Change-Id: I9c8c785f3eed91cc688f49e7dda7228cc1ff5216
    Closes-Bug: 1196775
    (cherry picked from commit 9d93c4f71f6f4f92ce7ac9c1e152d11de1fbde51)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-manuals 15.0.0 release.