Keystone should support pre-hashed passwords

[Tyler North]

Passwords should be allowed to be pre-hashed upon user creation for better security.

A user may want to store passwords in a script file, and it is much safer for these to be hashed beforehand so that the password is not in plaintext.

This was implemented in keystone at one point
https://git.openstack.org/cgit/openstack/keystone/commit/?id=e492bbc68ef41b276a0a18c6dbeda242d46b66f4

[Tyler North (ty-north)]

https://review.openstack.org/#/c/140104/

[Morgan Fainberg (mdrnstm)]

Is this request specific to the LDAP backend or in general? The referenced change was that keystone was hashing the passwords and then submitting the hash to LDAP. This doesn't work very well for a number of reasons (one of which is that we're not guaranteed that the hashing algorithm is supported on the LDAP server, it is better to let LDAP hash the password[s]).

In general, the answer is that Keystone should not be hashing the password and asking ldap to blindly store it. Some LDAP implementations won't allow this.

[Jeremy Stanley (fungi)]

This is pretty clearly a security hardening request and not a security vulnerability report, so i've adjusted its classification accordingly.

[Launchpad Janitor (janitor)]

[Expired for Keystone because there has been no activity for 60 days.]