f006188e70
changed such to so changed some wording around sentence added , removed the added mode Change-Id: I175ee91bcb67f03e6068d0df7f0924134b1b2816
58 lines
2.3 KiB
XML
58 lines
2.3 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink" version="5.0"
|
|
xml:id="keystone-token-binding">
|
|
<title>Configure Identity service for token binding</title>
|
|
<para>Token binding embeds information from an external
|
|
authentication mechanism, such as a Kerberos server, inside a
|
|
token. By using token binding, a client can enforce the use of a
|
|
specified external authentication mechanism with the token. This
|
|
additional security mechanism ensures that if a token is stolen,
|
|
for example, it is not usable without external
|
|
authentication.</para>
|
|
<para>You configure the authentication types for a token binding in
|
|
the <filename>keystone.conf</filename> file:</para>
|
|
<programlisting language="ini">[token]
|
|
bind = kerberos</programlisting>
|
|
<para>Currently only <literal>kerberos</literal> is
|
|
supported.</para>
|
|
<para>To enforce checking of token binding, set the
|
|
<option>enforce_token_bind</option> option to one of these
|
|
modes:</para>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para><literal>disabled</literal></para>
|
|
<para>Disables token bind checking.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><literal>permissive</literal></para>
|
|
<para>Enables bind checking. If a token is bound to an unknown
|
|
authentication mechanism, the server ignores it. The default
|
|
is this mode.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><literal>strict</literal></para>
|
|
<para>Enables bind checking. If a token is bound to an unknown
|
|
authentication mechanism, the server rejects it.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><literal>required</literal></para>
|
|
<para>Enables bind checking. Requires use of at least
|
|
authentication mechanism for tokens.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><literal>named</literal></para>
|
|
<para>Enables bind checking. Requires use of the specified
|
|
authentication mechanism for tokens:</para>
|
|
<programlisting language="ini">[token]
|
|
enforce_token_bind = kerberos</programlisting>
|
|
</listitem>
|
|
</itemizedlist>
|
|
<note>
|
|
<para>Do not set <literal>enforce_token_bind = named</literal>.
|
|
The <literal>named</literal> authentication mechanism does not
|
|
exist.</para>
|
|
</note>
|
|
</section>
|