Security checklist should ensure that PKI tokens aren't used with an insecure hashing algorithm

[Chris MacNaughton]

The charm should configure the token hashing algorithm to use SHA256 per the OpenStack Security Guide[1] and then validate it with the action.

[1]: https://docs.openstack.org/security-guide/identity/checklist.html#check-identity-04-does-identity-use-strong-hashing-algorithms-for-pki-tokens

[Frode Nordahl (fnordahl)]

Support for PKI tokens was removed from the charms in the 18.08 release. Would not the fact that we do not support PKI tokens give us a green light for that bullet?

[Chris MacNaughton (chris.macnaughton)]

Indeed, I created this bug as a tracking bug to target for the security guide - as the charm does have an action to assert that it is setup correctly. Somewhat annoyingly, it didn't link from Gerrit - https://review.openstack.org/#/c/644513/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/644513
Committed: https://git.openstack.org/cgit/openstack/charm-keystone/commit/?id=165e875e59cf66742e22e2360adf80e703c44b4a
Submitter: Zuul
Branch: master

commit 165e875e59cf66742e22e2360adf80e703c44b4a
Author: Chris MacNaughton <email address hidden>
Date: Tue Mar 19 09:49:07 2019 +0100

    Correct token hashing check

    When using the PKI token provider, it is necessary to
    ensure that a secure hashing algorithm is used. The
    charms never configure a PKI provider but the checklist
    action is still a valid runtime check.

    Change-Id: If0869124e4fcf7af68f636b9e4d3027c83407a4f
    Closes-Bug: 1820813
    Func-Test-PR: https://github.com/openstack-charmers/zaza/pull/200