Lockout reflects user UUID

[Arjen]

Intro
-----
While performing a penetration test on a new OpenStack install of version Train, we found an issue that could lead to an information disclosure.

Description
-----------
In this test situation we had a valid user for a project. After supplying an existing username with an incorrect password for a few times (at the /auth/tokens endpoint, as used by the CLI), the account is (temporarily) locked out. The JSON error response contains the user ID (not the username itself). This user ID could potentially be used in later attacks.

Precondition
------------
- Valid username for a project

Discovered on October 8, 2020 by Arjen Zijlstra (<email address hidden>) and Arthur Donkers ([e-mail])

[Jeremy Stanley (fungi)]

Since this report concerns a possible security risk, an incomplete
security advisory task has been added while the core security
reviewers for the affected project or projects confirm the bug and
discuss the scope of any vulnerability along with potential
solutions.

[Arjen (i2rcnasjfnk3)]

While I was writing a report for another issue (indefinite lockout) I noticed a duplicate. When reading the issue, I noticed the issue reported here was actually mentioned over there as well: https://bugs.launchpad.net/keystone/+bug/1688137

[Jeremy Stanley (fungi)]

Thanks for spotting that. I'm making this report public and marking it as a duplicate of bug 1688137, further discussion should happen there instead.