Default password hashing algorithm in Keystone is suboptimal for large scale deployments

[Bogdan Dobrelya]

The default password hash bcrypt [0], since pike, has drastic degradations impacts on the overall scalability.

We need to change default password_hash_algorithm in hiera to pbkdf2_sha512. The user passwords need to be reset to take full effect.

[0] https://opendev.org/openstack/keystone/src/branch/master/keystone/conf/identity.py#L114

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/718015

[Bogdan Dobrelya (bogdando)]

to complete updates/upgrades automation, we should add optionally rotation for https://opendev.org/openstack/tripleo-ansible/src/branch/master/tripleo_ansible/playbooks/cli-update-deployment-plan.yaml

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/718055

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/718082

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/718443

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/718055
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=4349466878b52a233abef64a1904a9bc3ce63f4c
Submitter: Zuul
Branch: master

commit 4349466878b52a233abef64a1904a9bc3ce63f4c
Author: Bogdan Dobrelya <email address hidden>
Date: Tue Apr 7 12:55:28 2020 +0200

    Allow passwords to be reset (force rotated)

    Sometimes, passwords has to be force-updated. Allow
    doing that via cli-update-deployment-plan playbook.

    Related-Bug: #1871347

    Change-Id: I2644e5a75abf94b3150011956bad9304e0de7cdb
    Signed-off-by: Bogdan Dobrelya <email address hidden>

[OpenStack Infra (hudson-openstack)]

Change abandoned by Bogdan Dobrelya (bogdando) (<email address hidden>) on branch: master
Review: https://review.opendev.org/718082

[OpenStack Infra (hudson-openstack)]

Change abandoned by Bogdan Dobrelya (bogdando) (<email address hidden>) on branch: master
Review: https://review.opendev.org/718015

[OpenStack Infra (hudson-openstack)]

Change abandoned by Bogdan Dobrelya (bogdando) (<email address hidden>) on branch: master
Review: https://review.opendev.org/718443

[Marios Andreou (marios-b)]

This is an automated action. Bug status has been set to 'Incomplete' and target milestone has been removed due to inactivity. If you disagree please re-set these values and reach out to us on freenode #tripleo

[Launchpad Janitor (janitor)]

[Expired for tripleo because there has been no activity for 60 days.]