Basic-Auth
Registered by
Adam Young
Passing in the userid/password in the body of a request is at odds with the way that the browsers expect authentication to work. Keystone should be able to accept userid and password via basic-auth in order to allow browser based operations against Keystone. Once created, the token can live in a secure cookie. TO prevent XSRF attacks, a standard header will enforce that the referring web page must be Keystone itself. A future extension will deal with CORS support.
Blueprint information
- Status:
- Complete
- Approver:
- None
- Priority:
- Low
- Drafter:
- Adam Young
- Direction:
- Needs approval
- Assignee:
- Adam Young
- Definition:
- Obsolete
- Series goal:
- None
- Implementation:
-
Unknown
- Milestone target:
- None
- Started by
- Completed by
- Adam Young
Related branches
Related bugs
Sprints
Whiteboard
Gerrit topic: https:/
Addressed by: https:/
Basic-Auth middleware
Can be done via Apache an Federation talking direct to the Database
(?)
Work Items
Dependency tree
* Blueprints in grey have been implemented.
