[RFE] General baremetal node auth and token passing mechanism

[Vladyslav Drok]

Goals of this proposal are:
1) Improving baremetal node authentication
2) Secure way for passing auth token to node

Define security levels for node auth:
0 - no auth
1 - auth with hardware id (like S/N of bios, hdd etc.)
3 - auth with user pre-share key
This value should be stored in node secure storage.

1) Before deploy user sets some values for node in secure storage via Ironic API,
like this:

{
   "hardware_id": sha1(sha1(hardware_id) + node_uuid)
   "user_key": sha1(sha1(user_key) + node_uuid)
    ....
   "vendor_sn": sha1(sha1(vendor_sn) + node_uuid)
}

2) Node pass own info via special API method for node

{
   "hardware_id": sha1(hardware_id)
   "user_key": sha1(sha1(user_key)
    ....
   "vendor_sn": sha1(sha1(vendor_sn) + node_uuid)
}

3) Ironic compares this data sets, and disallow operation with node if 1 or more keys does not match or too few parameters for defined security level.

4) Ironic uses Keystone OS-OAUTH1 extension for grant temporary access to the API,
(should validate request token from node):
http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-oauth1-ext.html#authorize-request-token-put-os-oauth1authorizerequest_token_id

[Vladyslav Drok (vdrok)]

Depends on bug 1526745

[Jim Rollenhagen (jim-rollenhagen)]

This will need a spec.

[Julia Kreger (juliaashleykreger)]

The base idea here was implemented as part of agent token, however that did not increase the burden for authentication of nodes. Although, when combined with aspects like Vmedia based deployments, that likely is more than sufficient security. As such, marking resolved. If more in-depth baremetal node authentication is desired, we can move forward with a new request.