diff --git a/openstack-identity-api/pom.xml b/openstack-identity-api/pom.xml index ba7b315d..a33a6ab9 100644 --- a/openstack-identity-api/pom.xml +++ b/openstack-identity-api/pom.xml @@ -33,7 +33,7 @@ UTF-8 - 1.0.6-SNAPSHOT + 1.0.9-SNAPSHOT @@ -156,6 +156,14 @@ + + + + + + @@ -256,7 +264,32 @@ - + + HP-IDM + + generate-pdf + generate-webhelp + + generate-sources + + HP-IDM/HP-IDM.xml + 1 + hp-idm.pdf + http://docs.rackspacecloud.com/openstack-extensions/auth/hp-idm/content + 0 + + + + + + + + + + + + + true diff --git a/openstack-identity-api/src/docbkx/HP-IDM/HP-IDM-admin.wadl b/openstack-identity-api/src/docbkx/HP-IDM/HP-IDM-admin.wadl new file mode 100644 index 00000000..d2a78172 --- /dev/null +++ b/openstack-identity-api/src/docbkx/HP-IDM/HP-IDM-admin.wadl @@ -0,0 +1,150 @@ + + + + + + + + + + %common; +]> + + + + + + + + + + + + + + + + + + + You need a valid admin token for access. + + + + + + + + + + + + + + + + + + + +

+ Check that a token is valid and that it belongs to a supplied tenant + and services and return the permissions relevant to a particular client. +

+

+ Valid tokens will exist in the + /tokens/{tokenId} path and invalid + tokens will not. In other words, a user should expect an + itemNotFound (404) fault for an + invalid token. +

+

+ If 'HP-IDM-serviceId' is provided, it must be a comma-separated string of + service IDs. If any of the service IDs is invalid or if there are no + roles associated with the service IDs, a user should expect a 401. +

+ + + + +

+ Validates a token has the supplied tenant in scope. +

+ + + + +

+ If provided, filter the roles to be returned by the given service IDs. +

+ + + + + + + + + + + + + + + + &commonFaults; + &getFaults; + + + +

+ Check that a token is valid and that it belongs to a particular tenant and services + (For performance). +

+

+ Valid tokens will exist in the + /tokens/{tokenId} path and invalid + tokens will not. In other words, a user should expect an + itemNotFound (404) fault for an + invalid token. +

+

+ If `belongsTo` is provided, validates that a token has a specific tenant in scope. +

+

+ If 'HP-IDM-serviceId' is provided, it must be a comma-separated string of + service IDs. If any of the service ID is invalid or if there are no + roles associated with the service IDs, a user should expect a 401. +

+

+ No response body is returned for this method. +

+ + + + +

+ Validates a token has the supplied tenant in scope. (for performance). +

+ + + + +

+ Check the roles against the given service IDs. +

+ + + + + &commonFaults; + &getFaults; + + diff --git a/openstack-identity-api/src/docbkx/HP-IDM/HP-IDM.xml b/openstack-identity-api/src/docbkx/HP-IDM/HP-IDM.xml new file mode 100644 index 00000000..4edbc9a7 --- /dev/null +++ b/openstack-identity-api/src/docbkx/HP-IDM/HP-IDM.xml @@ -0,0 +1,275 @@ + + + + + + + + GET'> + PUT'> + POST'> + DELETE'> + + + + + +]> + + OpenStack Identity HP-IDM Extension + &ALIAS; + + + + + + + + HP + + + + 2011 + Hewlett-Packard Development Company L.P. + + OpenStack Identity + &PUB_DATE; + + + Copyright details are filled in by the template. + + + + + HP-IDM Extension For Token Validation. + + + + + 2011-12-21 + + + + + Initial version. + + + + + + + + + About This Extension + + + Name + + HP-IDM Extension + + + + Namespace + + &NAMESPACE; + + + + Alias + + &ALIAS; + + + + Contact + + + + Guang + Yee + + guang.yee@hp.com + + + + + Status + + ALPHA + + + + Last Update + + &PUB_DATE; + + + + Dependencies + + Keystone API v2.0 (2011-12-21) + + + + Doc Link (PDF) + + + + https://github.com/openstack/keystone/raw/master/content/admin/HP-IDM-admin-devguide.pdf + + + + + + Doc Link (WADL) + + + + https://raw.github.com/openstack/keystone/master/keystone/content/admin/HP-IDM-admin.wadl + + + + + + Short Description + + + + HP-IDM Admin Extension to Keystone V2.0 API adds capability + to filter roles with optional service IDs for token validation + to mitigate security risks with role name conflicts. + + + + + + + + + Sample Valid Token Request + + + + Sample Valid Token Request With Global Service ID Specified + + + + Extension Query Response: XML + + + + Extension Query Response: JSON + + +
+ Document Change History + + The most recent changes to this document are described + below. + + + +
+ + + Summary of Changes + + + HP-IDM Admin Extension to Keystone V2.0 API adds capability to filter roles + with optional service IDs for token validation to mitigate security risks + with role name conflicts. + See + + https://bugs.launchpad.net/keystone/+bug/890411 + + for more details. + +
+ New Headers + + None. +
+
+ New Faults + + None. +
+
+ New Resources + + + No new resource. HP-IDM Extension merely introduced a new optional HP-IDM-serviceId parameter for the validate token operations. The following APIs are affected. + +
+ Validate Tokens With The New Optional HP-IDM-serviceId Parameter + + The following are a list of operations on templates. + + + + + +
+
+
+ New Actions + + None. +
+
+ New States + + None. +
+ + diff --git a/openstack-identity-api/src/docbkx/HP-IDM/samples/ext_query.json b/openstack-identity-api/src/docbkx/HP-IDM/samples/ext_query.json new file mode 100644 index 00000000..6e382b67 --- /dev/null +++ b/openstack-identity-api/src/docbkx/HP-IDM/samples/ext_query.json @@ -0,0 +1,22 @@ +{ + "extension": { + "name": "HP Token Validation Extension", + "namespace": "http://docs.openstack.org/identity/api/ext/HP-IDM/v1.0", + "alias": "HP-IDM", + "updated": "2011-12-06T19:00:00-00:00", + "description": "Validate token with the optional HP-IDM-serviceId parameter so that only the roles associated with the given service IDs are returned. See https://bugs.launchpad.net/keystone/+bug/890411 for more details.", + "links": [ + { + "rel": "describedby", + "type": "application/pdf", + "href": "https://github.com/openstack/keystone/raw/master/keystone/content/admin/HP-IDM-admin-devguide.pdf" + }, + { + "rel": "describedby", + "type": "application/vnd.sun.wadl+xml", + "href": "https://raw.github.com/openstack/keystone/master/keystone/content/admin/HP-IDM-admin.wadl" + } + ] + } +} + diff --git a/openstack-identity-api/src/docbkx/HP-IDM/samples/ext_query.xml b/openstack-identity-api/src/docbkx/HP-IDM/samples/ext_query.xml new file mode 100644 index 00000000..7c91e389 --- /dev/null +++ b/openstack-identity-api/src/docbkx/HP-IDM/samples/ext_query.xml @@ -0,0 +1,21 @@ + + + + + Validate token with the optional HP-IDM-serviceId parameter so that only the roles associated with the given service IDs are returned. See https://bugs.launchpad.net/keystone/+bug/890411 for more details. + + + + + + diff --git a/openstack-identity-api/src/docbkx/HP-IDM/samples/sample_request.txt b/openstack-identity-api/src/docbkx/HP-IDM/samples/sample_request.txt new file mode 100755 index 00000000..22bf022a --- /dev/null +++ b/openstack-identity-api/src/docbkx/HP-IDM/samples/sample_request.txt @@ -0,0 +1,4 @@ +GET /v2.0/tokens/ab48a9efdfedb23ty3494?belongsTo=1&HP-IDM-serviceId=1,2 HTTP/1.1 +X-Auth-Token: 999888777666 +Host: identity.api.openstack.org +Accept: application/json diff --git a/openstack-identity-api/src/docbkx/HP-IDM/samples/sample_request_with_global_sid.txt b/openstack-identity-api/src/docbkx/HP-IDM/samples/sample_request_with_global_sid.txt new file mode 100755 index 00000000..48acdccf --- /dev/null +++ b/openstack-identity-api/src/docbkx/HP-IDM/samples/sample_request_with_global_sid.txt @@ -0,0 +1,4 @@ +GET /v2.0/tokens/ab48a9efdfedb23ty3494?belongsTo=1&HP-IDM-serviceId=1,2,global HTTP/1.1 +X-Auth-Token: 999888777666 +Host: identity.api.openstack.org +Accept: application/json