{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11626","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11626/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11626/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11626/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/11626","id":96187812,"number":11626,"title":"Proposal: Plugin to integrate with keystone for authentication and authorization","user":{"login":"uruddarraju","id":2271582,"avatar_url":"https://avatars.githubusercontent.com/u/2271582?v=3","gravatar_id":"","url":"https://api.github.com/users/uruddarraju","html_url":"https://github.com/uruddarraju","followers_url":"https://api.github.com/users/uruddarraju/followers","following_url":"https://api.github.com/users/uruddarraju/following{/other_user}","gists_url":"https://api.github.com/users/uruddarraju/gists{/gist_id}","starred_url":"https://api.github.com/users/uruddarraju/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/uruddarraju/subscriptions","organizations_url":"https://api.github.com/users/uruddarraju/orgs","repos_url":"https://api.github.com/users/uruddarraju/repos","events_url":"https://api.github.com/users/uruddarraju/events{/privacy}","received_events_url":"https://api.github.com/users/uruddarraju/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":29,"created_at":"2015-07-20T23:27:34Z","updated_at":"2015-07-22T17:40:17Z","closed_at":null,"body":"[Keystone](http://docs.openstack.org/developer/keystone/) is an identity and token management system in [Openstack](https://www.openstack.org/). It is used to authenticate and authorize users, maintains project user relationships. It is an abstraction on top of directory services like LDAP and supports various authentication mechanisms like username-password, token-based and AWS EC2 type credentials.\r\n\r\n## Proposal\r\n\r\n### Authentication\r\nUse keystone to validate the identity of a user using his username-password, API key or an authentication token. Plan to create a new authentication plugin to talk to keystone and validate the user's credentials\r\n\r\n#### Workflow:\r\n\r\n - User gets an un-scoped keystone token using the keystone api directly. \r\n - The user then sets this token as his password in kubeconfig, and he uses this for all his requests sent to the apiserver\r\n - Kube's authentication plugin would then validate this token against keystone to see if it is valid.\r\n - If the token is validated, authentication passes, else it fails\r\n\r\n### Authorization:\r\nMap Kubernetes' namespaces to keystone projects and used ACLs based on keystone to validate if a user has access to resources within the namespace. This enables us to have multi-tenant clusters, which don't actually require network isolation as of now (to keep it simple). We plan to create a new authorization plugin to do this.\r\n\r\n#### Workflow\r\n - The object and its attributes (object type, name, namespace etc) and the user name is passed on to the authorization module\r\n - Do a `keystone user-list --tenant <namespace> ` (an equivalent HTTP request) and check if the user belongs to the tenant\r\n - If the above step passes, authorize the user, else fail the request\r\n\r\nAny feedback is highly appreciated."},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/123803534","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/11626#issuecomment-123803534","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11626","id":123803534,"user":{"login":"uruddarraju","id":2271582,"avatar_url":"https://avatars.githubusercontent.com/u/2271582?v=3","gravatar_id":"","url":"https://api.github.com/users/uruddarraju","html_url":"https://github.com/uruddarraju","followers_url":"https://api.github.com/users/uruddarraju/followers","following_url":"https://api.github.com/users/uruddarraju/following{/other_user}","gists_url":"https://api.github.com/users/uruddarraju/gists{/gist_id}","starred_url":"https://api.github.com/users/uruddarraju/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/uruddarraju/subscriptions","organizations_url":"https://api.github.com/users/uruddarraju/orgs","repos_url":"https://api.github.com/users/uruddarraju/repos","events_url":"https://api.github.com/users/uruddarraju/events{/privacy}","received_events_url":"https://api.github.com/users/uruddarraju/received_events","type":"User","site_admin":false},"created_at":"2015-07-22T17:40:17Z","updated_at":"2015-07-22T17:40:17Z","body":"@liggitt that is exactly what I needed. Any idea when this can be merged ? "}}