openstack keystone tokens and CDMI server

[Ilja Livenson]

Hi,

I'm working on integrating openstack keystone authentication (crypto-based) into a CDMI server.

Technically speaking, the credential information from keystone is propagated via a custom header, parsed by the server. Could anyone help me to understand what is the most correct way for making it CDMI-compliant? It's basically a parallel method digest/basic rest authn.

thanks,

Ilya

[byte_2702]

Hello Ilya,

I don't know OpenStack that much and I don't work or SNIA. Regarding to the official ISO/IEC CDMI 1.0.2 specification, CDMI supports HTTP basic authentication, Cipher Suites and digital certificates (X.509v3) via HTTP and/or HTTP over TLS. They suggest HTTP over TLS. The HTTP basic authentication is described in RFC 2616 and RFC 2617 (http://www.rfc-editor.org/search/rfc_search.php), Cipher suites in RFC 2246 and digital certiicates in RFC 3280. If the authentification is successful, the server shall respond with HTTP status code 200, otherwise with HTTP status code 401.

More detailed information in the ISO/IEC CDMI 1.0.2 specification on pages 218-223 (the document has 228 pages and has the number ISO/IEC 17826:2012(E)).

I hope that helps, Jana

[Mark Carlson]

You might want to look at:

https://github.com/osaddon/cdmi

Although I doubt it has been updated for the latest Keystone - but they may accept your put-backs.

At this point, this would be an additional authentication scheme to the standard ones in CDMI, so would not have anything to do with compliance. As Jana says, the only schemes that are compliant are listed as she says.

-- mark

--
You received this message because you are subscribed to the Google Groups "SNIA Cloud" group.
To unsubscribe from this group and stop receiving emails from it, send an email to snia-cloud+...@googlegroups.com.
To post to this group, send email to snia-...@googlegroups.com.
Visit this group at http://groups.google.com/group/snia-cloud.
For more options, visit https://groups.google.com/groups/opt_out.

[Ilja Livenson]

Hi, Jana, Mark

thanks for replies!

@Jana: Right, I've read that much, however when integration task is at hands, exact compliancy becomes a bit of an obstacle.

@Mark: does the phrase 'at this point' hint at the ongoing work to make OpenStack integration smoother? :)

thanks,

Ilya

[Mark Carlson]

For CDMI 1.1 - we are separating out the security section from CDMI proper and pointing to a future Storage Security Standard in the works from SNIA.

-- mark

[byte_2702]

Hi Mark,

Have you seen my other post?
I'm having problems with the current CDMI RI.
It gives me two wrong results regarding your test file. I use the original CDMI RI, with no changes.
The same problem occurs on different computers.
So my question was if the CDMI RI is wrong or if I only have that problem.
Or does someone else could execute the current CDMI RI without any problems?

We try to connect CDMI with a mass-storage management system.

Many thanks, Jana

[Mark Carlson]

Hi Jana,

I did receive your other email on the broken tests. We may have introduced a regression in the latest version.

I will look into it in my copious free time ;-)

-- mark

[byte_2702]

Many thanks to you!!! :-)))

[David Slik]

CDMI is designed on top of HTTP, so any HTTP header-based authentication mechanism can be used together with CDMI. Like with HTTP Basic and Digest, once you get the user's principal, you evaluate it against the domain associated with the object being accessed, and use the result to evaluate the ACL.

Thanks,

David Slik

Technical Director, Object Storage, NetApp, Inc.
Co-chair, SNIA Cloud Storage Technical Working Group

Cell: 562.457.8459 | www.netapp.com