Table Of Contents

Previous topic

Networking

Next topic

API Endpoint

This Page

Psst... hey. You're reading the latest content, but it might be out of sync with code. You can read Nova 2011.2 docs or all OpenStack docs too.

Authentication and Authorization

The nova.quota Module

Quotas for instances, volumes, and floating ips.

exception nova.quota.QuotaError(message='Unknown', code=None)

Bases: nova.exception.ApiError

Quota Exceeded.

nova.quota.allowed_fixed_ips(context, requested_fixed_ips)

Check quota and return min(requested, allowed) fixed ips.

nova.quota.allowed_floating_ips(context, requested_floating_ips)

Check quota and return min(requested, allowed) floating ips.

nova.quota.allowed_injected_file_content_bytes(context, requested_bytes)

Return the number of bytes allowed per injected file content.

nova.quota.allowed_injected_file_path_bytes(context)

Return the number of bytes allowed in an injected file path.

nova.quota.allowed_injected_files(context, requested_injected_files)

Return the number of injected files allowed.

nova.quota.allowed_instances(context, requested_instances, instance_type)

Check quota and return min(requested_instances, allowed_instances).

nova.quota.allowed_metadata_items(context, requested_metadata_items)

Return the number of metadata items allowed.

nova.quota.allowed_security_group_rules(context, security_group_id, requested_rules)

Check quota and return min(requested, allowed) sec group rules.

nova.quota.allowed_security_groups(context, requested_security_groups)

Check quota and return min(requested, allowed) security groups.

nova.quota.allowed_volumes(context, requested_volumes, size)

Check quota and return min(requested_volumes, allowed_volumes).

nova.quota.get_project_quotas(context, project_id)

The nova.auth.signer Module

Utility class for parsing signed AMI manifests.

class nova.auth.signer.Signer(secret_key)

Bases: object

Hacked up code from boto/connection.py

Signer.generate(params, verb, server_string, path)

Generate auth string according to what SignatureVersion is given.

Signer.s3_authorization(headers, verb, path)

Generate S3 authorization string.

Auth Manager

The nova.auth.manager Module

WARNING: This code is deprecated and will be removed. Keystone is the recommended solution for auth management.

Nova authentication management

class nova.auth.manager.AuthBase

Bases: object

Base class for objects relating to auth

Objects derived from this class should be stupid data objects with an id member. They may optionally contain methods that delegate to AuthManager, but should not implement logic themselves.

classmethod AuthBase.safe_id(obj)

Safely get object id.

This method will return the id of the object if the object is of this class, otherwise it will return the original object. This allows methods to accept objects or ids as paramaters.

class nova.auth.manager.AuthManager(driver=None, *args, **kwargs)

Bases: object

Manager Singleton for dealing with Users, Projects, and Keypairs

Methods accept objects or ids.

AuthManager uses a driver object to make requests to the data backend. See ldapdriver for reference.

AuthManager also manages associated data related to Auth objects that need to be more accessible, such as vpn ips and ports.

AuthManager.add_role(user, role, project=None)

Adds role for user

If project is not specified, adds a global role. If project is specified, adds a local role.

The ‘projectmanager’ role is special and can’t be added or removed.

@type user: User or uid @param user: User to which to add role.

@type role: str @param role: Role to add.

@type project: Project or project_id @param project: Project in which to add local role.

AuthManager.add_to_project(user, project)

Add user to project

AuthManager.authenticate(access, signature, params, verb='GET', server_string='127.0.0.1:8773', path='/', check_type='ec2', headers=None)

Authenticates AWS request using access key and signature

If the project is not specified, attempts to authenticate to a project with the same name as the user. This way, older tools that have no project knowledge will still work.

@type access: str @param access: Access key for user in the form “access:project”.

@type signature: str @param signature: Signature of the request.

@type params: list of str @param params: Web paramaters used for the signature.

@type verb: str @param verb: Web request verb (‘GET’ or ‘POST’).

@type server_string: str @param server_string: Web request server string.

@type path: str @param path: Web request path.

@type check_type: str @param check_type: Type of signature to check. ‘ec2’ for EC2, ‘s3’ for

S3. Any other value will cause signature not to be checked.

@type headers: list @param headers: HTTP headers passed with the request (only needed for

s3 signature checks)

@rtype: tuple (User, Project) @return: User and project that the request represents.

AuthManager.create_project(name, manager_user, description=None, member_users=None)

Create a project

@type name: str @param name: Name of the project to create. The name will also be used as the project id.

@type manager_user: User or uid @param manager_user: This user will be the project manager.

@type description: str @param project: Description of the project. If no description is specified, the name of the project will be used.

@type member_users: list of User or uid @param: Initial project members. The project manager will always be added as a member, even if he isn’t specified in this list.

@rtype: Project @return: The new project.

AuthManager.create_user(name, access=None, secret=None, admin=False)

Creates a user

@type name: str @param name: Name of the user to create.

@type access: str @param access: Access Key (defaults to a random uuid)

@type secret: str @param secret: Secret Key (defaults to a random uuid)

@type admin: bool @param admin: Whether to set the admin flag. The admin flag gives superuser status regardless of roles specifed for the user.

@type create_project: bool @param: Whether to create a project for the user with the same name.

@rtype: User @return: The new user.

AuthManager.delete_project(project)

Deletes a project

AuthManager.delete_user(user)

Deletes a user

Additionally deletes all users key_pairs

AuthManager.get_access_key(user, project)

Get an access key that includes user and project

AuthManager.get_active_roles(user, project=None)

Get all active roles for context

AuthManager.get_credentials(user, project=None, use_dmz=True)

Get credential zip for user in project

AuthManager.get_environment_rc(user, project=None, use_dmz=True)

Get environment rc for user in project

AuthManager.get_project(pid)

Get project object by id

static AuthManager.get_project_vpn_data(project)

Gets vpn ip and port for project

@type project: Project or project_id @param project: Project from which to get associated vpn data

@rvalue: tuple of (str, str) @return: A tuple containing (ip, port) or None, None if vpn has not been allocated for user.

AuthManager.get_projects(user=None)

Retrieves list of projects, optionally filtered by user

static AuthManager.get_roles(project_roles=True)

Get list of allowed roles

AuthManager.get_user(uid)

Retrieves a user by id

AuthManager.get_user_from_access_key(access_key)

Retrieves a user by access key

AuthManager.get_user_roles(user, project=None)

Get user global or per-project roles

AuthManager.get_users()

Retrieves a list of all users

AuthManager.has_role(user, role, project=None)

Checks existence of role for user

If project is not specified, checks for a global role. If project is specified, checks for the union of the global role and the project role.

Role ‘projectmanager’ only works for projects and simply checks to see if the user is the project_manager of the specified project. It is the same as calling is_project_manager(user, project).

@type user: User or uid @param user: User to check.

@type role: str @param role: Role to check.

@type project: Project or project_id @param project: Project in which to look for local role.

@rtype: bool @return: True if the user has the role.

AuthManager.is_admin(user)

Checks for admin status, allowing user to access all projects

@type user: User or uid @param user: User to check.

@rtype: bool @return: True for admin.

AuthManager.is_project_manager(user, project)

Checks if user is project manager

AuthManager.is_project_member(user, project)

Checks to see if user is a member of project

AuthManager.is_superuser(user)

Checks for superuser status, allowing user to bypass authorization

@type user: User or uid @param user: User to check.

@rtype: bool @return: True for superuser.

AuthManager.modify_project(project, manager_user=None, description=None)

Modify a project

@type name: Project or project_id @param project: The project to modify.

@type manager_user: User or uid @param manager_user: This user will be the new project manager.

@type description: str @param project: This will be the new description of the project.

AuthManager.modify_user(user, access_key=None, secret_key=None, admin=None)

Modify credentials for a user

AuthManager.remove_from_project(user, project)

Removes a user from a project

AuthManager.remove_role(user, role, project=None)

Removes role for user

If project is not specified, removes a global role. If project is specified, removes a local role.

The ‘projectmanager’ role is special and can’t be added or removed.

@type user: User or uid @param user: User from which to remove role.

@type role: str @param role: Role to remove.

@type project: Project or project_id @param project: Project in which to remove local role.

class nova.auth.manager.Project(id, name, project_manager_id, description, member_ids)

Bases: nova.auth.manager.AuthBase

Represents a Project returned from the datastore

Project.add_role(user, role)
Project.get_credentials(user)
Project.has_manager(user)
Project.has_member(user)
Project.has_role(user, role)
Project.project_manager
Project.remove_role(user, role)
Project.vpn_ip
Project.vpn_port
class nova.auth.manager.User(id, name, access, secret, admin)

Bases: nova.auth.manager.AuthBase

Object representing a user

The following attributes are defined: :id: A system identifier for the user. A string (for LDAP) :name: The user name, potentially in some more friendly format :access: The ‘username’ for EC2 authentication :secret: The ‘password’ for EC2 authenticatoin :admin: ???

User.add_role(role)
User.has_role(role)
User.is_admin()
User.is_project_manager(project)
User.is_project_member(project)
User.is_superuser()
User.remove_role(role)

The nova.auth.ldapdriver Driver

Auth driver for ldap. Includes FakeLdapDriver.

It should be easy to create a replacement for this driver supporting other backends by creating another class that exposes the same public methods.

class nova.auth.ldapdriver.FakeLdapDriver

Bases: nova.auth.ldapdriver.LdapDriver

Fake Ldap Auth driver

class nova.auth.ldapdriver.LDAPWrapper(ldap, url, user, password)

Bases: object

LDAPWrapper.add_s(*args, **kwargs)
LDAPWrapper.connect()
LDAPWrapper.delete_s(*args, **kwargs)
LDAPWrapper.modify_s(*args, **kwargs)
LDAPWrapper.search_s(*args, **kwargs)
class nova.auth.ldapdriver.LdapDriver

Bases: object

Ldap Auth driver

Defines enter and exit and therefore supports the with/as syntax.

LdapDriver.add_role(*args, **kwargs)

Add role for user (or user and project)

LdapDriver.add_to_project(*args, **kwargs)

Add user to project

LdapDriver.create_project(*args, **kwargs)

Create a project

LdapDriver.create_user(*args, **kwargs)

Create a user

LdapDriver.delete_project(*args, **kwargs)

Delete a project

LdapDriver.delete_user(*args, **kwargs)

Delete a user

LdapDriver.get_project(*args, **kwargs)

Retrieve project by id

LdapDriver.get_projects(*args, **kwargs)

Retrieve list of projects

LdapDriver.get_user(*args, **kwargs)

Retrieve user by id

LdapDriver.get_user_from_access_key(*args, **kwargs)

Retrieve user by access key

LdapDriver.get_user_roles(*args, **kwargs)

Retrieve list of roles for user (or user and project)

LdapDriver.get_users(*args, **kwargs)

Retrieve list of users

LdapDriver.has_role(*args, **kwargs)

Check if user has role

If project is specified, it checks for local role, otherwise it checks for global role

LdapDriver.is_in_project(*args, **kwargs)

Check if user is in project

LdapDriver.modify_project(*args, **kwargs)

Modify an existing project

LdapDriver.modify_user(*args, **kwargs)

Modify an existing user

LdapDriver.remove_from_project(*args, **kwargs)

Remove user from project

LdapDriver.remove_role(*args, **kwargs)

Remove role for user (or user and project)

nova.auth.ldapdriver.sanitize(fn)

Decorator to sanitize all args

The nova.auth.dbdriver Driver

Auth driver using the DB as its backend.

class nova.auth.dbdriver.DbDriver

Bases: object

DB Auth driver

Defines enter and exit and therefore supports the with/as syntax.

DbDriver.add_role(uid, role, project_id=None)

Add role for user (or user and project)

DbDriver.add_to_project(uid, project_id)

Add user to project

DbDriver.create_project(name, manager_uid, description=None, member_uids=None)

Create a project

DbDriver.create_user(name, access_key, secret_key, is_admin)

Create a user

DbDriver.delete_project(project_id)

Delete a project

DbDriver.delete_user(id)

Delete a user

DbDriver.get_project(pid)

Retrieve project by id

DbDriver.get_projects(uid=None)

Retrieve list of projects

DbDriver.get_user(uid)

Retrieve user by id

DbDriver.get_user_from_access_key(access)

Retrieve user by access key

DbDriver.get_user_roles(uid, project_id=None)

Retrieve list of roles for user (or user and project)

DbDriver.get_users()

Retrieve list of users

DbDriver.has_role(uid, role, project_id=None)

Check if user has role

If project is specified, it checks for local role, otherwise it checks for global role

DbDriver.is_in_project(uid, project_id)

Check if user is in project

DbDriver.modify_project(project_id, manager_uid=None, description=None)

Modify an existing project

DbDriver.modify_user(uid, access_key=None, secret_key=None, admin=None)

Modify an existing user

DbDriver.remove_from_project(uid, project_id)

Remove user from project

DbDriver.remove_role(uid, role, project_id=None)

Remove role for user (or user and project)

Tests

The auth_unittest Module

The access_unittest Module

The quota_unittest Module

Legacy Docs

Nova provides RBAC (Role-based access control) of the AWS-type APIs. We define the following roles:

Roles-Based Access Control of AWS-style APIs using SAML Assertions “Achieving FIPS 199 Moderate certification of a hybrid cloud environment using CloudAudit and declarative C.I.A. classifications”

Introduction

We will investigate one method for integrating an AWS-style API with US eAuthentication-compatible federated authentication systems, to achieve access controls and limits based on traditional operational roles. Additionally, we will look at how combining this approach, with an implementation of the CloudAudit APIs, will allow us to achieve a certification under FIPS 199 Moderate classification for a hybrid cloud environment.

Relationship of US eAuth to RBAC

Typical implementations of US eAuth authentication systems are structured as follows:

[ MS Active Directory or other federated LDAP user store ]
      --> backends to…
[ SUN Identity Manager or other SAML Policy Controller ]
      --> maps URLs to groups…
[ Apache Policy Agent in front of eAuth-secured Web Application ]

In more ideal implementations, the remainder of the application-specific account information is stored either in extended schema on the LDAP server itself, via the use of a translucent LDAP proxy, or in an independent datastore keyed off of the UID provided via SAML assertion.

Roles

AWS API calls are traditionally secured via Access and Secret Keys, which are used to sign API calls, along with traditional timestamps to prevent replay attacks. The APIs can be logically grouped into sets that align with five typical roles:

  • Base User
  • System Administrator/Developer (currently have the same permissions)
  • Network Administrator
  • Project Manager
  • Cloud Administrator/IT-Security (currently have the same permissions)

There is an additional, conceptual end-user that may or may not have API access:

  • (EXTERNAL) End-user / Third-party User

Basic operations are available to any :

  • Describe Instances
  • Describe Images
  • Describe Volumes
  • Describe Keypairs
  • Create Keypair
  • Delete Keypair
  • Create, Upload, Delete: Buckets and Keys (Object Store)

System Administrators/Developers/Project Manager:

  • Create, Attach, Delete Volume (Block Store)
  • Launch, Reboot, Terminate Instance
  • Register/Unregister Machine Image (project-wide)
  • Request / Review CloudAudit Scans

Project Manager:

  • Add and remove other users (currently no api)
  • Set roles (currently no api)

Network Administrator:

  • Change Machine Image properties (public / private)
  • Change Firewall Rules, define Security Groups
  • Allocate, Associate, Deassociate Public IP addresses

Cloud Administrator/IT-Security:

  • All permissions

Enhancements

  • SAML Token passing
  • REST interfaces
  • SOAP interfaces

Wrapping the SAML token into the API calls. Then store the UID (fetched via backchannel) into the instance metadata, providing end-to-end auditability of ownership and responsibility, without PII.

CloudAudit APIs

  • Request formats
  • Response formats
  • Stateless asynchronous queries

CloudAudit queries may spawn long-running processes (similar to launching instances, etc.) They need to return a ReservationId in the same fashion, which can be returned in further queries for updates. RBAC of CloudAudit API calls is critical, since detailed system information is a system vulnerability.

Type declarations

  • Data declarations – Volumes and Objects
  • System declarations – Instances

Existing API calls to launch instances specific a single, combined “type” flag. We propose to extend this with three additional type declarations, mapping to the “Confidentiality, Integrity, Availability” classifications of FIPS 199. An example API call would look like:

RunInstances type=m1.large number=1 secgroup=default key=mykey confidentiality=low integrity=low availability=low

These additional parameters would also apply to creation of block storage volumes (along with the existing parameter of ‘size’), and creation of object storage ‘buckets’. (C.I.A. classifications on a bucket would be inherited by the keys within this bucket.)

Request Brokering

  • Cloud Interop
  • IMF Registration / PubSub
  • Digital C&A

Establishing declarative semantics for individual API calls will allow the cloud environment to seamlessly proxy these API calls to external, third-party vendors – when the requested CIA levels match.

See related work within the Infrastructure 2.0 working group for more information on how the IMF Metadata specification could be utilized to manage registration of these vendors and their C&A credentials.

Dirty Cloud – Hybrid Data Centers

  • CloudAudit bridge interfaces
  • Anything in the ARP table

A hybrid cloud environment provides dedicated, potentially co-located physical hardware with a network interconnect to the project or users’ cloud virtual network.

This interconnect is typically a bridged VPN connection. Any machines that can be bridged into a hybrid environment in this fashion (at Layer 2) must implement a minimum version of the CloudAudit spec, such that they can be queried to provide a complete picture of the IT-sec runtime environment.

Network discovery protocols (ARP, CDP) can be applied in this case, and existing protocols (SNMP location data, DNS LOC records) overloaded to provide CloudAudit information.

The Details

  • Preliminary Roles Definitions
  • Categorization of available API calls
  • SAML assertion vocabulary

System limits

The following limits need to be defined and enforced:

  • Total number of instances allowed (user / project)
  • Total number of instances, per instance type (user / project)
  • Total number of volumes (user / project)
  • Maximum size of volume
  • Cumulative size of all volumes
  • Total use of object storage (GB)
  • Total number of Public IPs

Further Challenges

  • Prioritization of users / jobs in shared computing environments
  • Incident response planning
  • Limit launch of instances to specific security groups based on AMI
  • Store AMIs in LDAP for added property control