Quotas for instances, volumes, and floating ips.
Check quota and return min(requested, allowed) floating ips.
Return the number of bytes allowed per injected file content.
Return the number of bytes allowed in an injected file path.
Return the number of injected files allowed.
Check quota and return min(requested_instances, allowed_instances).
Return the number of metadata items allowed.
Check quota and return min(requested_volumes, allowed_volumes).
Utility class for parsing signed AMI manifests.
Bases: object
Hacked up code from boto/connection.py
Generate auth string according to what SignatureVersion is given.
The signature method must be SHA1 or SHA256.
Generate S3 authorization string.
WARNING: This code is deprecated and will be removed. Keystone is the recommended solution for auth management.
Nova authentication management
Bases: object
Base class for objects relating to auth
Objects derived from this class should be stupid data objects with an id member. They may optionally contain methods that delegate to AuthManager, but should not implement logic themselves.
Safely get object id.
This method will return the id of the object if the object is of this class, otherwise it will return the original object. This allows methods to accept objects or ids as parameters.
Bases: object
Manager Singleton for dealing with Users, Projects, and Keypairs
Methods accept objects or ids.
AuthManager uses a driver object to make requests to the data backend. See ldapdriver for reference.
AuthManager also manages associated data related to Auth objects that need to be more accessible, such as vpn ips and ports.
Adds role for user
If project is not specified, adds a global role. If project is specified, adds a local role.
The ‘projectmanager’ role is special and can’t be added or removed.
Parameters: |
|
---|
Add user to project
Authenticates AWS request using access key and signature
If the project is not specified, attempts to authenticate to a project with the same name as the user. This way, older tools that have no project knowledge will still work.
Parameters: |
|
---|---|
Return type: | tuple (User, Project) |
Returns: | User and project that the request represents. |
Create a project
Parameters: | name (str) – Name of the project to create. The name will also be |
---|
used as the project id.
Parameters: |
|
---|
specified, the name of the project will be used.
Param : | Initial project members. The project manager will always be |
---|
added as a member, even if he isn’t specified in this list.
Return type: | Project |
---|---|
Returns: | The new project. |
Creates a user
Parameters: |
|
---|
superuser status regardless of roles specified for the user.
Param : | Whether to create a project for the user with the same name. |
---|---|
Return type: | User |
Returns: | The new user. |
Deletes a project
Deletes a user
Additionally deletes all users key_pairs
Get an access key that includes user and project
Get all active roles for context
Get credential zip for user in project
Get environment rc for user in project
Get project object by id
Gets vpn ip and port for project
Parameters: | project (Project or project_id) – Project from which to get associated vpn data |
---|---|
Rvalue : | tuple of (str, str) |
Returns: | A tuple containing (ip, port) or None, None if vpn has not been allocated for user. |
Retrieves list of projects, optionally filtered by user
Get list of allowed roles
Retrieves a user by id
Retrieves a user by access key
Get user global or per-project roles
Retrieves a list of all users
Checks existence of role for user
If project is not specified, checks for a global role. If project is specified, checks for the union of the global role and the project role.
Role ‘projectmanager’ only works for projects and simply checks to see if the user is the project_manager of the specified project. It is the same as calling is_project_manager(user, project).
Parameters: |
|
---|---|
Return type: | bool |
Returns: | True if the user has the role. |
Checks for admin status, allowing user to access all projects
Parameters: | user (User or uid) – User to check. |
---|---|
Return type: | bool |
Returns: | True for admin. |
Checks if user is project manager
Checks to see if user is a member of project
Checks for superuser status, allowing user to bypass authorization
Parameters: | user (User or uid) – User to check. |
---|---|
Return type: | bool |
Returns: | True for superuser. |
Modify a project
Parameters: |
|
---|
Modify credentials for a user
Removes a user from a project
Removes role for user
If project is not specified, removes a global role. If project is specified, removes a local role.
The ‘projectmanager’ role is special and can’t be added or removed.
Parameters: |
|
---|
Bases: nova.auth.manager.AuthBase
Represents a Project returned from the datastore
Bases: nova.auth.manager.AuthBase
Object representing a user
The following attributes are defined:
Auth driver for ldap. Includes FakeLdapDriver.
It should be easy to create a replacement for this driver supporting other backends by creating another class that exposes the same public methods.
Bases: nova.auth.ldapdriver.LdapDriver
Fake Ldap Auth driver
Bases: object
Bases: object
Ldap Auth driver
Defines enter and exit and therefore supports the with/as syntax.
Add role for user (or user and project)
Add user to project
Create a project
Create a user
Delete a project
Delete a user
Retrieve project by id
Retrieve list of projects
Retrieve user by id
Retrieve user by access key
Retrieve list of roles for user (or user and project)
Retrieve list of users
Check if user has role
If project is specified, it checks for local role, otherwise it checks for global role
Check if user is in project
Modify an existing project
Modify an existing user
Remove user from project
Remove role for user (or user and project)
Decorator to sanitize all args
Auth driver using the DB as its backend.
Bases: object
DB Auth driver
Defines enter and exit and therefore supports the with/as syntax.
Add role for user (or user and project)
Add user to project
Create a project
Create a user
Delete a project
Delete a user
Retrieve project by id
Retrieve list of projects
Retrieve user by id
Retrieve user by access key
Retrieve list of roles for user (or user and project)
Retrieve list of users
Check if user has role
If project is specified, it checks for local role, otherwise it checks for global role
Check if user is in project
Modify an existing project
Modify an existing user
Remove user from project
Remove role for user (or user and project)
Nova provides RBAC (Role-based access control) of the AWS-type APIs. We define the following roles:
Roles-Based Access Control of AWS-style APIs using SAML Assertions “Achieving FIPS 199 Moderate certification of a hybrid cloud environment using CloudAudit and declarative C.I.A. classifications”
We will investigate one method for integrating an AWS-style API with US eAuthentication-compatible federated authentication systems, to achieve access controls and limits based on traditional operational roles. Additionally, we will look at how combining this approach, with an implementation of the CloudAudit APIs, will allow us to achieve a certification under FIPS 199 Moderate classification for a hybrid cloud environment.
Typical implementations of US eAuth authentication systems are structured as follows:
[ MS Active Directory or other federated LDAP user store ]
--> backends to…
[ SUN Identity Manager or other SAML Policy Controller ]
--> maps URLs to groups…
[ Apache Policy Agent in front of eAuth-secured Web Application ]
In more ideal implementations, the remainder of the application-specific account information is stored either in extended schema on the LDAP server itself, via the use of a translucent LDAP proxy, or in an independent datastore keyed off of the UID provided via SAML assertion.
AWS API calls are traditionally secured via Access and Secret Keys, which are used to sign API calls, along with traditional timestamps to prevent replay attacks. The APIs can be logically grouped into sets that align with five typical roles:
There is an additional, conceptual end-user that may or may not have API access:
Basic operations are available to any :
System Administrators/Developers/Project Manager:
Project Manager:
Network Administrator:
Cloud Administrator/IT-Security:
Wrapping the SAML token into the API calls. Then store the UID (fetched via backchannel) into the instance metadata, providing end-to-end auditability of ownership and responsibility, without PII.
CloudAudit queries may spawn long-running processes (similar to launching instances, etc.) They need to return a ReservationId in the same fashion, which can be returned in further queries for updates. RBAC of CloudAudit API calls is critical, since detailed system information is a system vulnerability.
Existing API calls to launch instances specific a single, combined “type” flag. We propose to extend this with three additional type declarations, mapping to the “Confidentiality, Integrity, Availability” classifications of FIPS 199. An example API call would look like:
RunInstances type=m1.large number=1 secgroup=default key=mykey confidentiality=low integrity=low availability=low
These additional parameters would also apply to creation of block storage volumes (along with the existing parameter of ‘size’), and creation of object storage ‘buckets’. (C.I.A. classifications on a bucket would be inherited by the keys within this bucket.)
Establishing declarative semantics for individual API calls will allow the cloud environment to seamlessly proxy these API calls to external, third-party vendors – when the requested CIA levels match.
See related work within the Infrastructure 2.0 working group for more information on how the IMF Metadata specification could be utilized to manage registration of these vendors and their C&A credentials.
A hybrid cloud environment provides dedicated, potentially co-located physical hardware with a network interconnect to the project or users’ cloud virtual network.
This interconnect is typically a bridged VPN connection. Any machines that can be bridged into a hybrid environment in this fashion (at Layer 2) must implement a minimum version of the CloudAudit spec, such that they can be queried to provide a complete picture of the IT-sec runtime environment.
Network discovery protocols (ARP, CDP) can be applied in this case, and existing protocols (SNMP location data, DNS LOC records) overloaded to provide CloudAudit information.
The following limits need to be defined and enforced: