auth_token middleware hashes tokens with configurable algorithm

[OpenStack Infra]

https://review.openstack.org/80398

Dear documentation bug triager. This bug was created here because we did not know how to map the project name "openstack/python-keystoneclient" to a launchpad project name. This indicates that the notify_impact config needs tweaks. You can ask the OpenStack infra team (#openstack-infra on freenode) for help if you need to.

commit 22db04bb6bee3ab15a90510bb6c1780d2a254300
Author: Brant Knudson <email address hidden>
Date: Tue May 6 19:36:59 2014 -0500

    auth_token middleware hashes tokens with configurable algorithm

    The auth_token middleware always hashed PKI Tokens with MD5. This
    change makes it so that PKI tokens can be hashed with SHA256 or any
    other algorithm supported by hashlib.new(). This is for security
    hardening.

    auth_token has a new config option 'hash_algorithms' that is set
    to the list of algorithms that will be used for hashing PKI tokens.
    This will typically be set to a single hash algorithm which must
    match the hash algorithm set in Keystone. Otherwise the tokens
    in the revocation list will not match, leading to revoked tokens
    being still usable.

    During a transition from one algorithm to another,
    'hash_algorithms' is set to both the new algorithm and the old
    algorithm. Both of the hash algorithms will be used to match
    against the revocation list and cache. Once the tokens using the
    old algorithm have expired the old algorithm can be removed from
    the list.

    'hash_algorithms' defaults to ['md5'] for backwards compatibility.

    DocImpact
    SecurityImpact
    Closes-Bug: #1174499

    Change-Id: Ie524125dc5f6f1076bfd47db3a414b178e4dac80

[Gauvain Pocentek (gpocentek)]

This will need to be reflected in the config-ref for all the projects, since they all use keystone_authtoken.

The security guide might be impacted by this too?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/103423

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/103423
Committed: https://git.openstack.org/cgit/openstack/openstack-manuals/commit/?id=b88212e06202b056a5f4e28e68ecf26c5ca61dec
Submitter: Jenkins
Branch: master

commit b88212e06202b056a5f4e28e68ecf26c5ca61dec
Author: Gauvain Pocentek <email address hidden>
Date: Sat Jun 28 22:08:00 2014 +0200

    config reference update for juno-1

    Generate the config tables with the autohelp script and include the new
    tables in the config ref sections.

    For consistency, use the 'database' and 'auth_token' keywords in all
    projects.

    Split the LBaaS tables.

    Closes-Bug: #1327802
    Closes-Bug: #1331180
    Closes-Bug: #1331175
    Closes-Bug: #1330279
    Closes-Bug: #1323946
    Closes-Bug: #1323437
    Closes-Bug: #1322075
    Closes-Bug: #1321621
    Closes-Bug: #1319564
    Closes-Bug: #1318081
    Closes-Bug: #1311474
    Change-Id: I5602dda76fdf929d9124f5aa67d31ca4ac17c6d5

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-manuals 15.0.0 release.