openstack
/
keystone
Code Issues Proposed changes
keystone/releasenotes/notes
History
Colleen Murphy 2f2736ebb2 Fix security issues with EC2 credentials 
This change addresses several issues in the creation and use of EC2/S3
credentials with keystone tokens.

1. Disable altering credential owner attributes or metadata

Without this patch, an authenticated user can create an EC2 credential
for themself for a project they have a role on, then update the
credential to target a user and project completely unrelated to them. In
the worst case, this could be the admin user and a project the admin
user has a role assignment on. A token granted for an altered credential
like this would allow the user to masquerade as the victim user. This
patch ensures that when updating a credential, the new form of the
credential is one the acting user has access to: if the system admin
user is changing the credential, the new user ID or project ID could be
anything, but regular users may only change the credential to be one
that they still own.

Relatedly, when a user uses an application credential or a trust to
create an EC2 credential, keystone automatically adds the trust ID or
application credential ID as metadata in the EC2 access blob so that it
knows how the token can be scoped when it is used. Without this patch, a
user who has created a credential in this way can update the access blob
to remove or alter this metadata and escalate their privileges to be
fully authorized for the trustor's, application credential creator's, or
OAuth1 access token authorizor's privileges on the project. This patch
fixes the issue by simply disallowing updates to keystone-controlled
metadata in the credential.

2. Respect token roles when creating EC2 credentials

Without this patch, a trustee, an application credential user, or an
OAuth1 access token holder could create an EC2 credential or an
application credential using any roles the trustor, application
credential creator, or access token authorizor had on the project,
regardless of whether the creator had delegated only a limited subset of
roles. This was because the trust_id attribute of the EC2 access blob
was ignored, and no metadata for the application credential or access
token was recorded either. This change ensures that the access
delegation resource is recorded in the metadata of the EC2 credential
when created and passed to the token provider when used for
authentication so that the token provider can look up the correct roles
for the request.

Change-Id: I39d0d705839fbe31ac518ac9a82959e108cb7c1d
Closes-bug: #1872733
Closes-bug: #1872755
Closes-bug: #1872735
(cherry picked from commit 37e9907a17)
 		2020-05-02 12:35:14 -07:00
..
.placeholder Add reno for release notes management 2015-11-10 16:10:00 -05:00
Assignment_V9_driver-c22be069f7baccb0.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
DomainSpecificRoles-fc5dd2ef74a1442c.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
Role_V9_driver-971c3aae14d9963d.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
V9ResourceDriver-26716f97c0cc1a80.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
add-bootstrap-cli-192500228cc6e574.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
add-description-to-role-88ab5bb8a96cc002.yaml Added support for a ``description`` attribute for Identity Roles 2018-09-06 05:09:10 +00:00
add-expires-at-int-to-trusts-60ae3c5d0c00808a.yaml Add expired_at_int column to trusts 2018-01-04 22:28:44 +01:00
add-limit-description-c1f42641d9c6c33d.yaml Limit description support 2018-05-08 10:59:41 +08:00
add-unified-limit-apis-c9ebc5116bc2cf93.yaml Add api-ref for unified limits 2018-01-25 16:33:25 +08:00
add_password_expires_at_to_user_response-22f14ab629c48bc2.yaml PCI-DSS Adds password_expires_at to API docs 2016-07-22 17:47:27 +00:00
admin_token-a5678d712783c145.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
admin_token-c634ec12fc714255.yaml Disable Admin tokens set to None 2016-02-16 20:00:34 +00:00
bootstrap-update-endpoint-7a63a2329822b6e7.yaml Support endpoint updates in bootstrap 2019-04-15 12:25:51 -07:00
bp-allow-expired-f5d845b9601bc1ef.yaml Readability/Typo Fixes in Release Notes 2017-02-08 00:31:19 +00:00
bp-application-credentials-c699f1f17c7d4e2f.yaml Add a release note for application credentials 2018-01-27 12:00:23 +01:00
bp-basic-default-roles-4ff6502b6ac57d48.yaml Ensure default roles created during bootstrap 2018-06-14 10:54:54 -04:00
bp-domain-config-as-stable-716ca5ab33c0cc42.yaml Mark the domain config via API as stable 2016-07-08 14:44:30 -07:00
bp-domain-config-default-82e42d946ee7cb43.yaml Fix a typo in core.py and bp-domain-config-default-82e42d946ee7cb43.yaml 2016-09-29 09:25:59 +08:00
bp-json-web-tokens-37ce3bcd1356cf1b.yaml Add JWS token provider documentation 2019-02-18 12:30:33 +00:00
bp-manage-migration-c398963a943a89fe.yaml Add expand, data migration and contract logic to keystone-manage 2016-08-18 10:37:56 +01:00
bp-mfa-auth-receipt-8b459431c1f360ce.yaml Implement auth receipts spec 2018-11-02 15:06:19 +01:00
bp-password-expires-validation-4b32fe7032595932.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bp-pci-dss-notifications-808a205a637bac25.yaml Revert "Fix wrong links" 2017-08-22 18:54:25 +00:00
bp-pci-dss-password-requirements-api-87bc724b2aa554f7.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bp-pci-dss-query-password-expired-users-a7c96a3843bb9abc.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bp-per-user-auth-plugin-reqs-feb95fd907be4b40.yaml Add MFA Rules Release Note 2017-01-31 22:07:37 +00:00
bp-policy-in-code-722372a27291b9cd.yaml Revert "Fix wrong links" 2017-08-22 18:54:25 +00:00
bp-shadow-mapping-06fc7c71a401d707.yaml Revert "Fix wrong links" 2017-08-22 18:54:25 +00:00
bp-strict-two-level-model.yaml Address nits in strict-two-level implementation 2018-07-26 16:35:19 +00:00
bp-support-federated-attr-94084d4073f50280.yaml Fix some typo in releasenotes 2017-02-27 10:14:14 +08:00
bp-system-scope-7d236ee5992d4e20.yaml Grant admin a role on the system during bootstrap 2018-02-13 21:37:31 +00:00
bp-upgrade-checks-0dc692a392a96879.yaml Implement scaffolding for upgrade checks 2018-10-17 16:54:53 -04:00
bp-url-safe-naming-ad90d6a659f5bf3c.yaml Add support for strict url safe option on new projects and domains 2016-01-19 03:47:31 +00:00
bp-whitelist-extension-for-app-creds-90e5bcd7b2b78b02.yaml Update API version for access rules 2019-09-14 03:14:45 -07:00
bug-1017606-98313bb4c1edf250.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1291157-00b5c714a097e84c.yaml Validate identity providers during token validation 2018-02-01 23:33:42 +00:00
bug-1473292-c21481e6aec29ec2.yaml Add abstract method in trusts base.py 2018-11-07 08:43:39 +05:30
bug-1490804-de58a9606edb31eb.yaml Add audit IDs to revocation events 2015-12-17 10:46:23 -06:00
bug-1519210-de76097c974f9c93.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
bug-1523369-4d42c841b6e7e54e.yaml Move release note from /keystone/releasenotes to /releasenotes 2017-03-24 16:41:36 -04:00
bug-1524030-0814724d5c2b7c8d.yaml Validate disabled domains and projects online 2017-11-27 23:06:10 +00:00
bug-1524030-ccff6b0ec9d1cbf2.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1535878-change-get_project-permission-e460af1256a2c056.yaml Change get_project permission 2016-02-11 12:21:24 +00:00
bug-1542417-d630b7886bb0b369.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
bug-1547684-911aed68a0d3df17.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1561054-dbe88b552a936a05.yaml Revert "Fix wrong links" 2017-08-22 18:54:25 +00:00
bug-1563101-134df5b99ea48f00.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1571878-1bcaea5337905af0.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1582585-a368ac5a252ec84f.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1590587-domain-specific-role-assignment-8f120604a6625852.yaml Project domain must match role domain for assignment 2016-09-07 11:43:53 -07:00
bug-1594482-52a5dd1d8477b694.yaml /services?name=<name> API fails when using list_limit 2016-06-21 14:22:19 -07:00
bug-1611102-e1348cbec9b1110a.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1613466-credential-update-ec2-type-8fb51ff3ad3a449c.yaml Fix credential update to ec2 type 2016-08-23 06:58:03 +00:00
bug-1615014-b30f606a2d202428.yaml Validate rolling upgrade is run in order 2017-06-27 20:54:04 +00:00
bug-1616424-c46ba773f7ac40ae.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1622310-c501cf77437fdfa6.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1636950-8fa1a47fce440977.yaml Fix some typo in releasenotes 2017-02-27 10:14:14 +08:00
bug-1638603-354ee4167e6e.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1641625-fe463874dc5edb10.yaml Add openstack_groups to assertion 2020-03-19 20:14:41 +05:30
bug-1641639-b9accc163e61ca15.yaml Replace UUID with id_generator for Federated users 2019-04-03 21:13:20 +00:00
bug-1641645-516709f9da3de26f.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1641654-8630ce7bcde43a7e.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1641660-f938267e1ec54071.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1641816-8b39f3f73359c778.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1642212-9964dfd3af0184bd.yaml Add --check to keystone-manage db_sync command 2017-02-09 19:45:02 +00:00
bug-1642348-83d4c86ad3984d75.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1642457-4533f9810a8cd927.yaml Handle disk write failure when doing Fernet key rotation 2016-12-26 10:17:01 +08:00
bug-1642687-5497fb56fe86806d.yaml Readability/Typo Fixes in Release Notes 2017-02-08 00:31:19 +00:00
bug-1642687-c7ab1c9be152db20.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1642692-d669c8fcf9e171d9.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1645487-ca22c216ec26cc9b.yaml PCI-DSS Force users to change password upon first use 2017-01-27 18:47:15 +00:00
bug-1649138-c53974f6bb0eab14.yaml Add anonymous bind to get_connection method 2017-01-12 04:02:24 +00:00
bug-1649446-efff94143823755d.yaml listing revoke events should be admin only 2017-01-09 21:12:47 +00:00
bug-1649616-b835d1dac3401e8c.yaml Fixing flushing tokens workflow 2017-07-10 17:10:38 -03:00
bug-1656076-c4422270f73b43b.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1659730-17834ba2dde668ae.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
bug-1659995-f3e716de743b7291.yaml Revise conf param in releasenotes 2017-03-03 09:58:02 +08:00
bug-1670382-ee851ba4f364d608.yaml Add group_members_are_ids to whitelisted options 2017-03-20 12:09:26 +00:00
bug-1676497-92271e25f642e2de.yaml Differentiate between dpkg and rpm for libssl-dev 2017-03-31 11:27:25 -04:00
bug-1684994-264fb8f182ced180.yaml Clarify LDAP invalid credentials exception 2017-06-29 16:17:06 -05:00
bug-1687593-95e1568291ecd70b.yaml Add a release note for bug 1687593 2017-07-13 22:43:44 +00:00
bug-1696574-15a728396350a95a.yaml Document and add release note for HEAD APIs 2017-06-27 21:15:44 +00:00
bug-1700852-de775d0eb2ddfdd1.yaml Cache list projects and domains for user 2017-08-09 14:45:58 +00:00
bug-1701324-739a31f38037f77b.yaml Remove duplicate roles from federated auth 2017-08-16 15:20:58 +00:00
bug-1702211-abb59adda73fd78e.yaml Add int storage of datetime for password created/expires 2017-08-15 16:29:18 +00:00
bug-1703369-9a901d627a1e0316.yaml fix identity:get_identity_providers typo 2017-07-11 17:51:57 -04:00
bug-1703666-b8a990f2bf5b62f0.yaml Fixing multi-region support in templated v3 catalog 2018-03-13 11:10:08 -07:00
bug-1704205-bc0570feeb3ec5c4.yaml Filter users and groups in ldap 2017-08-01 01:18:40 +05:30
bug-1705485-7a1ad17b9cc99b9d.yaml Replace git.openstack.org URLs with opendev.org URLs 2019-04-24 11:51:00 +08:00
bug-1718747-50d39fa87bdbb12b.yaml Delete SQL users before deleting domain 2018-02-08 21:19:02 +01:00
bug-1724645-a94659dfd0f45b9a.yaml Add new attribute to the federation protocol API 2019-07-19 10:46:23 -07:00
bug-1727099-1af277b35db34372.yaml Update the help message for unique_last_password_count 2017-11-24 08:52:12 +08:00
bug-1727726-0b47608811a2cd16.yaml Filter users/groups in ldap with whitespaces 2017-11-03 20:52:41 +05:30
bug-1728907-bab6769ab46bd8aa.yaml Handle empty token key files 2018-05-16 15:02:32 -05:00
bug-1729933-4a09201e9dface2a.yaml Region update extra support 2018-11-07 22:57:11 +00:00
bug-1733754-4d9d3042b8501ec6.yaml Add schema check for OS-TRUST:trust authentication 2017-11-24 01:35:17 +00:00
bug-1734244-1b4ea83baa72566d.yaml Fix 500 error when create trust with invalid role key 2017-11-27 15:11:34 +00:00
bug-1735250-b60332a7f288cf94.yaml Bump sqlalchemy minimum version to 1.1.0 2018-11-12 14:54:31 +08:00
bug-1736875-c790f568c5f4d671.yaml Add schema check for authorize request token 2018-01-10 14:32:16 +08:00
bug-1738895-342864cd0285bc42.yaml Fix list users by name 2018-02-03 15:50:29 +08:00
bug-1740951-82b7e4bd608742ab.yaml Expose a get_enforcer method for oslo.policy scripts 2018-01-03 20:47:56 +00:00
bug-1744195-a7154ac2e8556efc.yaml Enable foreign keys for unit test 2018-10-09 09:50:21 +08:00
bug-1746599-848a1163e52ac0a6.yaml Fix user email in federated shadow users 2018-03-22 19:26:08 +08:00
bug-1747694-48c8caa4871300e3.yaml Reorganize api-ref: v3-ext trust.inc 2018-02-07 19:01:20 +05:30
bug-1748027-decc2e11154b97cf.yaml Add explicit testing for project users and the user API 2019-03-21 18:44:02 +00:00
bug-1748970-eb63ad2030e296f3.yaml Fix querying role_assignment with system roles 2018-02-13 21:37:15 +00:00
bug-1749264-676ca02902bcd169.yaml Delete system role assignments when deleting users 2018-02-13 20:24:10 +00:00
bug-1749267-96153d2fa6868f67.yaml Delete system role assignments when deleting groups 2018-02-13 20:47:54 +00:00
bug-1750415-95ede3a9685b6e0c.yaml Populate application credential data in token 2018-02-19 22:41:12 +01:00
bug-1750660-e2a360ddd6790fc4.yaml Implement domain admin functionality for projects 2019-03-20 20:21:33 +00:00
bug-1750669-dfce859550126f03.yaml Make system admin policies consistent for grants 2019-03-25 19:30:03 +00:00
bug-1750673-b53f74944d767ae9.yaml Add role assignment testing for project users 2019-03-25 18:01:42 +00:00
bug-1750676-cf70c1a27b2c8de3.yaml Implement system scope and default roles for token API 2019-06-17 15:57:51 +00:00
bug-1750678-88a38851ca80fc64.yaml Remove system EC2 credentials from policy.v3cloudsample.json 2019-09-15 20:53:09 +05:30
bug-1751045-f950e3fb85e2b573.yaml Allow cleaning up non-existant group assignments 2018-04-09 16:08:34 +00:00
bug-1753584-e052bc7805f001b4.yaml Fix formatting of ImportError 2018-03-07 09:29:20 -06:00
bug-1753585-7e11213743754999.yaml LDAP attribute names non-case-sensitive 2018-10-01 17:35:27 +02:00
bug-1754048-correct-federated-domain-47cb889d88d7770a.yaml Report correct domain in federated user token 2019-06-06 10:13:01 -04:00
bug-1755874-9951f77c6d18431c.yaml Allow blocking users from self-service password change 2018-04-18 19:15:07 +00:00
bug-1756190-0e5d86d334555931.yaml Make tags filter match subset rather than exact 2018-03-27 13:38:47 -05:00
bug-1757022-664d0b0db1242bf8.yaml Fix keystone-manage mapping_purge with --type option 2018-06-26 19:15:38 +00:00
bug-1757151-43eb3baaa175f904.yaml Add scope documentation for service developers 2018-11-19 22:20:55 +00:00
bug-1759289-466cdf4514de3498.yaml Log warning when using token_flush 2018-03-29 20:15:55 +00:00
bug-1760205-87dedd6d8812db3f.yaml Invalidate the shadow user cache when deleting a user 2018-04-25 11:39:29 +08:00
bug-1760521-fec5c88af214401f.yaml Fix list_limit doesn't work correctly for domain 2018-04-03 14:26:59 +08:00
bug-1760809-711df870a9d67c0d.yaml Fix 500 error when deleting domain 2018-04-11 10:35:31 +08:00
bug-1763824-3d2f5169af9d42f.yaml Fix json schema nullable to add None to ENUM 2018-04-14 16:41:25 +00:00
bug-1765193-b40318b9fb5d1c7b.yaml Expose endpoint to return enforcement model 2018-07-11 10:03:42 +08:00
bug-1773967-b59517a09e0e6141.yaml Allows to use application credentials through group membership 2019-08-06 09:54:09 -07:00
bug-1774229-cb968e95c9d81c4d.yaml Clarify scope responses in authentication api ref 2018-06-07 16:51:01 +00:00
bug-1776504-keystone-conversion-to-flask-372a5654a55675c6.yaml Remove pre-flask legacy code 2018-10-15 10:56:26 -07:00
bug-1778109-ea15ce6a8207f857.yaml Fix duplicate role names in trusts bug 2018-06-21 15:01:00 -04:00
bug-1778945-b7f2db3052525ca8.yaml Simplify the token provider API 2018-07-13 14:45:56 +00:00
bug-1779889-12eb5edf4cc93a1d.yaml Add release note for service token documentation 2019-04-12 09:55:39 -07:00
bug-1779903-f2b22cf23a9e01f9.yaml Delete project limits when deleting project 2018-07-19 03:49:45 +00:00
bug-1780159-095ffa0e53be2464.yaml Invalidate 'computed assignments' cache when creating a project. 2018-07-11 08:47:41 +02:00
bug-1780503-70ca1ba3f428dd41.yaml Set initiator id as user_id for auth events 2018-08-09 20:19:42 +00:00
bug-1782704-0b053eaf5d801dee.yaml Allow for more robust config checking with keystone-manage 2018-08-07 14:24:12 +00:00
bug-1782922-db822fda486ac773.yaml Fixing dn_to_id function for cases were id is not in the DN 2019-07-19 17:48:05 -07:00
bug-1784536-9d1d1e149c605a1d.yaml Fix a bug that issue token with project-scope gets error 2018-08-14 02:43:24 +00:00
bug-1785164-2b7ed29266eb4792.yaml Add a release note for bug 1785164 2018-08-06 17:43:49 +00:00
bug-1787874-13499ec227b8e26c.yaml Address nits 2018-08-25 09:11:09 +08:00
bug-1788415-3190279e9c900f76.yaml Implement scope_type checking for credentials 2018-10-29 15:01:29 +00:00
bug-1788694-4dc8b3ec47fc6084.yaml Expand implied roles in system-scoped tokens 2018-10-12 16:57:55 +00:00
bug-1789450-9dec1383ffd3de01.yaml Add releasenote for bug fix 1789450 2018-09-21 21:34:58 +00:00
bug-1792026-2de8345a89e2256b.yaml Update api-ref to include user options 2018-11-20 13:25:39 +00:00
bug-1794376-53ce14528f00f01d.yaml Implement system admin role in domains API 2018-12-10 22:36:05 +00:00
bug-1794527-866b1caff67977f3.yaml Allow an explicit_domain_id parameter when creating a domain 2019-04-09 16:29:52 +00:00
bug-1794864-3116bf165a146be6.yaml Allow project users to retrieve domains 2019-01-21 20:46:05 +00:00
bug-1796887-eaea84e3f9a8ff9f.yaml Add caching on trust role validation to improve performance 2018-10-19 11:03:09 +02:00
bug-1801095-6e28d7a86719da74.yaml Added request_id and global_request_id to basic notifications 2019-02-06 09:50:20 +03:00
bug-1801873-0eb9a5ec3e801190.yaml Delete shadow users when domain is deleted 2019-03-25 20:56:55 +01:00
bug-1804292-0107869c7029f79e.yaml Remove region policies from policy.v3cloudsample.json 2019-02-11 17:52:11 +00:00
bug-1804446-1a281eadbb044070.yaml Update region policies to use system admin 2019-02-11 17:51:10 +00:00
bug-1804462-59ad43f98242dea0.yaml Remove service policies from policy.v3cloudsample.json 2019-03-04 15:39:27 +00:00
bug-1804463-74537652166cf656.yaml Update service policies for system admin 2019-02-22 16:53:52 +00:00
bug-1804482-aa95619320d098fa.yaml Remove endpoint policies from policy.v3cloudsample.json 2019-02-27 16:17:26 +00:00
bug-1804483-1d9ccfcb24f25f51.yaml Update endpoint policies for system admin 2019-01-08 22:32:20 +00:00
bug-1804516-24b0b10ed6fe0589.yaml Update idp policies for system admin 2019-01-08 22:15:32 +00:00
bug-1804517-a351aec088fee066.yaml Remove idp policies from policy.v3cloudsample.json 2019-02-25 22:03:35 +00:00
bug-1804519-8384a9ead261d4c2.yaml Remove mapping policies from policy.v3cloudsample.json 2019-02-19 01:49:28 +00:00
bug-1804520-d124599967923052.yaml Remove service provider policies from v3cloudsample.json 2019-01-25 16:31:30 +00:00
bug-1804521-3c0d9f567e8f532f.yaml Update mapping policies for system admin 2019-01-08 22:26:20 +00:00
bug-1804522-00df902cd2d74ee3.yaml Update service provider policies for system admin 2019-01-04 17:58:31 +00:00
bug-1804523-d1768909b13b167e.yaml Implement system admin role in protocol API 2019-01-08 20:39:34 +00:00
bug-1805363-0b85d71917ad09d1.yaml Implement system admin for OAUTH1 consumers 2019-09-13 22:26:48 +00:00
bug-1805366-670867516c6fc4bc.yaml Remove system Domain Config from policy.v3cloudsample.json 2019-09-15 20:39:19 +05:30
bug-1805368-ea32c2db2ae57225.yaml Implement domain admin support for grants 2019-09-11 08:24:21 -07:00
bug-1805369-ed98d3fcfafb5c43.yaml Add domain scope support for group policies 2019-03-27 17:15:00 +01:00
bug-1805371-249c8c9b562ab371.yaml Remove implied roles policies from v3cloudsample 2019-09-11 08:47:15 -07:00
bug-1805372-af4ebf4b19500b72.yaml Update limit policies for system admin 2019-01-09 14:56:48 +00:00
bug-1805400-c192be936d277ade.yaml Implement system scope for domain role management 2019-09-13 08:23:13 -07:00
bug-1805402-75d0d93f31af620f.yaml Update role policies for system admin 2019-01-08 20:48:28 +00:00
bug-1805403-c003627a64768716.yaml Implement system admin role in project API 2019-01-07 20:48:11 +00:00
bug-1805406-252b45d443af20b3.yaml Implement domain admin functionality for user API 2019-03-19 22:34:15 +00:00
bug-1805409-8bc6cc9f1c5bc672.yaml Implement system admin for policy association 2019-08-22 12:30:54 +00:00
bug-1805880-3fc6b30309a4370f.yaml Remove registered limit policies from policy.v3cloudsample.json 2019-01-08 18:17:02 +00:00
bug-1805880-0032024ea6b83563.yaml Remove limit policies from policy.v3cloudsample.json 2019-09-24 19:25:45 -07:00
bug-1806713-cf5feab23fc78a23.yaml Remove role policies from policy.v3cloudsample.json 2019-02-27 21:57:17 +00:00
bug-1806762-0b7356ace200a5d3.yaml Remove obsolete grant policies from policy.v3cloudsample.json 2019-09-14 09:39:21 +00:00
bug-1806762-08ff9eecdc03c554.yaml Remove policy.v3cloudsample.json 2019-10-02 20:26:05 +00:00
bug-1806762-09f414995924db23.yaml Consolidate user protection tests 2019-03-26 12:58:15 +00:00
bug-1806762-2092fee9f6c87dc3.yaml Remove redundant policies from v3cloudsample 2019-03-27 21:02:02 +01:00
bug-1806762-c3bfc71cb9bb94f3.yaml DRY: Remove redundant policies from policy.v3cloudsample.json 2019-04-02 19:09:53 +00:00
bug-1806762-daed3e27f58f0f6d.yaml Remove protocol policies from v3cloudsample.json 2019-02-28 16:24:56 +00:00
bug-1809116-b65502f3b606b060.yaml Add expiring user group memberships on mapped authentication 2020-04-07 19:30:57 -04:00
bug-1810393-5a7d379842c51d9b.yaml Invalidate shadow_federated_user cache when deleting protocol 2019-01-04 09:45:42 +08:00
bug-1811605-9d23080d7e949c25.yaml populate request context with X.509 tokenless cred information 2019-02-11 09:21:15 -08:00
bug-1813085-cf24b204e95fd7f5.yaml Handle special cases with msgpack and python3 2019-01-28 15:09:57 +00:00
bug-1814589-f3e7f554bee1c317.yaml Fixes incorrect params 2019-02-08 17:12:21 -08:00
bug-1815771-ae0e4118c552f01e.yaml Adds caching of credentials 2019-05-17 15:04:31 +02:00
bug-1816076-ba39508e6ade529e.yaml Update api-ref for federated objects in user 2020-04-10 00:49:35 +00:00
bug-1816927-e17f4e596e611380.yaml Add hint for order of keys during distribution 2019-03-11 13:18:24 +00:00
bug-1817313-c11481e6eed29ec2.yaml Raise METHOD NOT ALLOWED instead of 500 error on protocol CRUD 2019-03-28 22:07:01 +00:00
bug-1818725-96d698e22e648764.yaml implement system scope for application credential 2019-07-19 17:53:16 -07:00
bug-1818734-d753bfae60ffd030.yaml Add tests for project users interacting with endpoint_groups 2019-08-19 17:00:19 -07:00
bug-1818736-98ea186a074056f4.yaml Add tests for project users interacting with limits 2019-09-24 19:22:58 -07:00
bug-1818845-05f8c3af5ea9abc7.yaml Deprecate identity:revocation_list policy for removal 2019-07-23 17:21:19 +00:00
bug-1818846-d1a8c77d20659ad6.yaml Implement system admin for trusts API 2019-08-16 15:20:15 -07:00
bug-1819036-e2d24655c70d0aad.yaml Only validate tokens once per request 2019-03-20 19:17:33 +00:00
bug-1820333-356dcc8bf9f73fed.yaml PY3: Ensure LDAP searches use unicode attributes 2019-03-18 19:03:18 -04:00
bug-1823258-9f93dbdc0fa8441d.yaml Add immutable roles status check 2019-09-11 11:04:29 -07:00
bug-1823258-9649b56a440b5ae1.yaml Default to bootstrapping roles as immutable 2020-02-04 14:21:13 -08:00
bug-1831918-c70cf87ef086d871.yaml Add cadf auditing to credentials 2019-06-12 13:34:05 -07:00
bug-1832265-cb76ccf505c2d9d1.yaml token: consistently decode binary types 2019-07-04 07:55:43 +01:00
bug-1833739-f962e8caf3e22068.yaml Fix PostgreSQL specifc issue with credentials encoding 2019-09-18 11:43:52 +02:00
bug-1836568-66d853a1f22c5530.yaml Consolidate policy deprecation warnings 2019-09-19 11:10:35 -07:00
bug-1839133-24570c9fbacb530d.yaml Honor group_members_are_ids for user_enabled_emulation 2019-08-12 16:41:56 +02:00
bug-1839577-1226d86ea0744055.yaml Add support for previous TOTP windows 2019-08-14 13:16:59 +12:00
bug-1840291-35af1ac7ba06e166.yaml Add retry for DBDeadlock in credential delete 2019-08-19 21:06:40 +05:30
bug-1841486-425f367925f5e03f.yaml Federation mapping debug should show direct_maps values 2019-09-19 11:27:53 -07:00
bug-1843609-8498b132222596b7.yaml Make system tokens work with domain-specific drivers 2019-09-13 13:55:57 +00:00
bug-1844157-7808af9bcea0429d.yaml Use correct repo for initial version check 2019-09-16 11:27:57 -07:00
bug-1844194-48ae60db49f91bd4.yaml Add default roles and scope checking to project tags 2019-09-19 02:48:39 +00:00
bug-1844207-x27a31f3403xfd7y.yaml Add remote_id definition in _perform_auth 2019-09-16 23:19:42 -07:00
bug-1844461-08a8bdc5f613b88d.yaml Allow system/domain scope for assignment tree list 2019-09-20 16:15:16 +00:00
bug-1844664-905cf6cad2e032a7.yaml Implement scope type checking for Project Endpoints 2019-09-19 15:39:22 -07:00
bug-1848238-f6533644f7907358.yaml Fix release note link formatting 2019-12-30 08:57:50 -08:00
bug-1848342-317c9e4afa65a3ff.yaml Stop adding entry in local_user while updating ephemerals 2019-12-11 16:07:06 -03:00
bug-1855080-08b28181b7cb2470.yaml Fix credential list for project members 2019-12-04 16:42:17 -08:00
bug-1856881-277103af343187f1.yaml Ensure bootstrap handles multiple roles with the same name 2020-01-02 13:44:23 -06:00
bug-1856904-101af15bb48eb3ca.yaml Always have username in CADF initiator 2020-01-09 15:55:48 +00:00
bug-1856962-2c87d541da61c727.yaml Fix token auth error if federated_groups_id is empty list 2019-12-30 08:49:24 -08:00
bug-1858012-584267ada7e33f2c.yaml Fix role_assignments role.id filter 2020-01-02 09:24:54 -08:00
bug-1872733-2377f456a57ad32c.yaml Fix security issues with EC2 credentials 2020-05-02 12:35:14 -07:00
bug-1872735-0989e51d2248ce1e.yaml Fix security issues with EC2 credentials 2020-05-02 12:35:14 -07:00
bug-1872737-f8e1ad3b6705b766.yaml Check timestamp of signed EC2 token request 2020-04-30 20:25:13 +00:00
bug-1872755-2c81d3267b89f124.yaml Fix security issues with EC2 credentials 2020-05-02 12:35:14 -07:00
bug-1873290-ff7f8e4cee15b75a.yaml Ensure OAuth1 authorized roles are respected 2020-05-02 12:35:10 -07:00
bug1828565-0790c4c60ba34100.yaml Allow to filter endpoint groups by name 2019-07-18 08:57:50 +02:00
bug_1526462-df9a3f3974d9040f.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
bug_1543048_and_1668503-7ead4e15faaab778.yaml Support new hashing algorithms for securely storing password hashes 2017-05-18 20:03:25 -05:00
bug_1674415-e8a7345aa2b05ab7.yaml Error messages are not translating with locale. 2017-03-24 20:08:17 +00:00
bug_1688188-256e3572295231a1.yaml Handle auto-generated domains when creating IdPs 2017-07-27 20:20:00 +00:00
bug_1698900-f195125bf341d887.yaml Include a link in release note for bug 1698900 2017-08-22 17:14:23 +00:00
catalog-caching-12f2532cfb71325a.yaml Add release notes for mitaka thus far 2015-11-23 16:29:39 -05:00
catalog_project_id-519f5a70f9f7c4c6.yaml Allow project_id in catalog substitutions 2016-02-15 10:55:23 -06:00
convert-keystone-to-flask-80d980e239b662b0.yaml Add Flaskification release-note 2018-06-06 13:00:40 -07:00
deprecate-endpoint-policy-cfg-option-d018acab72a398a0.yaml fix up release notes, file deprecations under right title 2015-12-14 22:27:47 -05:00
deprecate-memcache-token-persistence-eac88c80147ea241.yaml Mark memcache and memcache_pool token deprecated 2016-01-19 21:45:48 -05:00
deprecate-policies-api-b104fbd1d2367b1b.yaml Deprecate policies API 2017-11-02 14:59:53 -04:00
deprecate-v2-apis-894284c17be881d2.yaml reorganize mitaka release notes 2016-05-18 17:33:32 +00:00
deprecated-as-of-mitaka-8534e43fa40c1d09.yaml reorganize mitaka release notes 2016-05-18 17:33:32 +00:00
deprecated-as-of-newton-be1d8dbcc6bdc68f.yaml Deprecate keystone.common.kvs 2016-05-12 23:30:15 -07:00
deprecated-as-of-ocata-a5b2f1e3e39f818e.yaml Merge "add additional deprecation warnings for KVS options" 2017-01-28 03:01:05 +00:00
deprecated-as-of-pike-506f9aca91674550.yaml Deprecate (and slate for removal) UUID tokens 2017-02-11 06:01:27 +00:00
deprecated-as-of-queens-8ad7f826e4f08f57.yaml Replace git.openstack.org URLs with opendev.org URLs 2019-04-24 11:51:00 +08:00
deprecated-as-of-rocky-60b2fa05d07d3a28.yaml Deprecate [token] infer_roles=False 2018-07-25 15:01:49 -04:00
deprecated-as-of-stein-0166965502cb3be2.yaml Deprecate eventlet related configuration 2018-10-31 01:13:13 +00:00
deprecated-as-of-train-de3fe41ff2251385.yaml Deprecate [federation] federated_domain_name 2019-07-16 19:31:31 +00:00
deprecated-socket_timeout-option-d3358b4f2310706c.yaml Deprecate keystone.conf.memcache socket_timeout 2019-08-01 12:07:38 +08:00
domain-level-limit-support-60e1e330d06227ed.yaml Release note for domain level limit 2019-02-19 11:09:13 +08:00
drop-project-id-fk-b683b414e1585be8.yaml Drop project.id foreign keys 2019-10-11 14:12:57 -07:00
enable-filter-idp-d0135f4615178cfc.yaml Support `id` and `enabled` attributes when listing service providers 2016-03-16 13:27:12 -04:00
enable-inherit-on-default-54ac435230261a6a.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
endpoints-from-endpoint_group-project-association-7271fba600322fb6.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
extensions-to-core-a0d270d216d47276.yaml Replace git.openstack.org URLs with opendev.org URLs 2019-04-24 11:51:00 +08:00
federation-group-ids-mapping-6c56120d65a5cb22.yaml Add release notes for mitaka-1 2015-12-01 17:32:49 -05:00
filter-mappings-by-entity-77162a146d375385.yaml Filter by entity_type in get_domain_mapping_list 2018-06-20 21:18:42 +03:00
httpd-keystone-d51b7335559b09c8.yaml fix up release notes, file deprecations under right title 2015-12-14 22:27:47 -05:00
identity_driver_new_change_password_method-e8c0e06795bca2d8.yaml PCI-DSS Minimum password age requirements 2016-08-16 21:47:49 +00:00
immutable-resource-options-bug-1807751-acc1e3c689484337.yaml Implement resource options for roles and projects 2019-09-09 22:07:30 +00:00
impl-templated-catalog-1d8f6333726b34f8.yaml Removes KVS catalog backend 2016-01-19 21:26:30 -05:00
implied-roles-026f401adc0f7fb6.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
implied-roles-stable-8b293e187c5620ad.yaml Mark the implied role API as stable 2018-03-16 16:04:27 +00:00
insecure_reponse-2a168230709bc8e7.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
integrate-osprofiler-ad0e16a542b12899.yaml Revert "Fix wrong links" 2017-08-22 18:54:25 +00:00
is-admin-24b34238c83b3a82.yaml Cleans up code for `is_admin` in tokens 2015-12-07 19:30:37 -03:00
ldap-conn-pool-enabled-90df94652f1ded53.yaml Enable LDAP connection pooling by default 2016-02-26 14:19:10 +00:00
ldap-emulation-91c4d535eb9c3d10.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
limits-api-refactor-05abf9e6c2e75852.yaml Unified limit update APIs Refactor 2018-06-15 09:05:35 +08:00
list_limit-ldap-support-5d31d51466fc49a6.yaml Add release note for list_limit support 2016-03-18 18:15:41 +03:00
list_role_assignment_names-33aedc1e521230b6.yaml Fix nits in include names patch 2016-01-22 08:25:38 -06:00
mapping_populate-521d92445505b8a3.yaml Add mapping_populate command 2016-08-23 20:52:10 +00:00
migration_squash-f655329ddad7fc2a.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
no-default-domain-2161ada44bf7a3f7.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
notify-on-user-group-membership-8c0136ee0484e255.yaml Add notifications to user/group membership 2016-03-09 17:20:33 +00:00
oauth1-headers-content-type-9a9245d9bbec8f8e.yaml Replace the content type with correct one 2016-08-16 21:26:06 +08:00
oslo.cache-a9ce47bfa8809efa.yaml Revert "Fix wrong links" 2017-08-22 18:54:25 +00:00
password-created_at-nullable-b3c284be50d93ef5.yaml Fixes migration where password created_at is nullable 2016-09-01 17:15:47 +00:00
policy_new_federated_projects_for_user-dcd7bd148efef049.yaml Concrete role assignments for federated users 2016-06-29 02:24:03 +00:00
pre-cache-tokens-73450934918af26b.yaml Pre-cache new tokens 2016-08-31 20:14:53 +03:00
project-tags-1e72a6779d9d02c5.yaml Add project tags api-ref documentation and reno 2017-10-17 17:56:29 -05:00
projects_as_domains-3ea8a58b4c2965e1.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
python3-support-e4189e0a1a6e2e4f.yaml Add python 3 release note. 2016-05-20 21:54:54 +00:00
remove-token-auth-middleware-5ea3b3734ce1d9e6.yaml Remove the TokenAuth middleware 2018-05-10 14:40:39 +00:00
remove-trust-auth-support-from-v2-de316c9ba46d556d.yaml Fix release note of removal of v2.0 trusts support 2016-02-11 06:39:26 +00:00
removed-as-of-mitaka-9ff14f87d0b98e7e.yaml Removed deprecated revoke KVS backend 2016-01-25 01:08:15 -08:00
removed-as-of-newton-721c06b5dcb1b34a.yaml remove deprecated revoke_by_expiration function 2016-05-22 14:39:58 +00:00
removed-as-of-ocata-436bb4b839e74494.yaml clean up release notes for ocata 2017-01-27 14:36:54 +00:00
removed-as-of-pike-deadbeefdeadbeef.yaml Remove loading drivers outside of their expected namespaces 2017-05-18 18:08:26 +00:00
removed-as-of-queens-94c04e88c08f89aa.yaml Remove duplicated release note 2017-12-29 10:10:30 +08:00
removed-as-of-rocky-f44c3ba7c3e73d01.yaml Remove enable config option of trust feature 2018-07-09 16:13:55 +08:00
removed-as-of-stein-5eb23253b72ab54e.yaml Clean up the create_arguments_apply methods 2019-01-14 09:38:34 +08:00
removed-as-of-train-92b2942a680eb859.yaml Remove [signing] config 2019-07-23 12:45:43 +00:00
removed-as-of-ussuri-d2f6ef8901ef54ed.yaml Stop testing Python 2 2019-11-01 08:57:08 +08:00
request_context-e143ba9c446a5952.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
resource-backend-sql-only-03154d8712b36bd0.yaml Resource backend is SQL only now 2017-08-14 19:01:02 +00:00
resource-driver-33793dd5080ee4d2.yaml Revert "Resource backend is SQL only now" 2019-10-11 14:13:04 -07:00
revert-v2-token-issued-for-non-default-domain-25ea5337f158ef13.yaml Add release note for revert of c4723550aa 2016-01-17 20:42:36 +00:00
s3-aws-v4-c6cb75ce8d2289d4.yaml Add release notes for mitaka thus far 2015-11-23 16:29:39 -05:00
scope-and-default-roles-a733c235731bb558.yaml Add release prelude about changing policies 2019-03-26 14:40:00 +01:00
support_encrypted_credentials_at_rest-93dcb67b3508e91a.yaml Document credential encryption 2016-08-31 21:28:42 +00:00
tenant_id_to_project_id-42d95d93011785cb.yaml Replace 'tenant_id' with 'project_id' 2019-02-04 16:17:52 +01:00
token-formatter-ec58aba00fa83706.yaml Move token_formatter to token 2018-01-19 16:17:47 -06:00
token-provider-refactor-a3a64146807daf36.yaml Remove needs_persistence property from token providers 2018-02-15 20:38:54 +00:00
totp-40d93231714c6a20.yaml Revert "Fix wrong links" 2017-08-22 18:54:25 +00:00
unified-limit-api-improvment-b34d18769d18a0a7.yaml Add release note for unified limit APIs changing 2018-10-31 03:29:47 +00:00
use-correct-inspect-8142e317c1e39c2a.yaml Use inspect instead of Inspector.from_engine() 2020-02-04 16:24:31 -05:00
use-pyldap-6e811c28bf350d6d.yaml Use PyLDAP instead of python-ldap 2016-05-18 02:38:34 -04:00
use-python-ldap-0318ff7798bdd98d.yaml Switch to python-ldap 2018-07-16 17:33:38 +02:00
v2-dep-d6e7ab2d08119549.yaml Give a prospective removal date for all v2 APIs 2017-02-27 15:27:58 +00:00
v3-endpoints-in-v2-list-b0439816938713d6.yaml Add release notes for mitaka thus far 2015-11-23 16:29:39 -05:00
v9FederationDriver-cbebcf5f97e1eae2.yaml Release note cleanup 2016-03-14 19:04:58 +00:00
x509-auth-df0a229780b8e3ff.yaml Release note cleanup 2016-03-14 19:04:58 +00:00