Token Scoping
Bug #1299039 reported by
Abu Shohel Ahmed
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Identity (keystone) |
Fix Released
|
Wishlist
|
Adam Young |
Bug Description
In Havana Stable release for both V2.0 an V3,
A scoped token can be used to get another scoped or un-scopped token. This can be exploited by anyone who has gained access to a scoped token.
For example,
1. userA is related to two projects: Project1, Project2
2. userA creates tokenA scoped by Project1
3. userA shares the tokenA to a third party (malicious).
4. Third party can now make a token creation call to create a new tokenB scoped under projectB using tokenA.
Although, we know that bearer token has all or nothing property, scoping the token can limit the exposure.
A scoped token should not be allowed to create another scoped token.
Changed in keystone: | |
assignee: | nobody → Priti Desai (priti-desai) |
To post a comment you must log in.
Subscribed Adam Young, who has looked into this before, and I believe found a blocker to changing this behavior?