openstack
/
keystone
Code Issues Proposed changes
keystone/keystone/tests/unit
History
Lance Bragstad 0edf1fe46c Implement encryption of credentials at rest 
This commit implements credential encryption through the following changes:

 - additive schema change to store key hashes for credentials
 - database migration to encrypt all pre-existing credentials
 - contractive schema change to remove unencrypted credential column
 - added code to the credential Manager to handle credential encryption

All credentials will be encrypted by default. There will not be a way to store
unencrypted credentials in keystone from this point forward.

Note that this implementation uses database triggers in the migration process.
If operators use the traditional offline migration method, it would be more
reliable if we didn't try to setup and tear down triggers, as they'll never be
used anyway. This makes it so that expand and contract migrations can skip
anything related to triggers.

Co-Authored-By: Werner Mendizabal <nonameentername@gmail.com>

bp credential-encryption

Depends-On: I433da9a257daa21ec3b5996b2bca571211f1fbba
Depends-On: Id3e8922adc154cfec5f7a36613e22eb0b49eeffe
Change-Id: I31b7539db436ad270462cfaa3b14213e0ed1fc04
 		2016-09-02 04:25:49 +00:00
..
assignment Fix some typos in comments 2016-08-26 12:17:00 +02:00
auth Use mockpatch fixtures from fixtures 2016-04-12 21:15:12 -05:00
backend Replace keystone.common.config with keystone.conf package 2016-06-24 17:02:15 +00:00
catalog Move the catalog abstract base class and common code out of core 2016-05-06 21:58:38 +00:00
common Distributed cache namespace to invalidate regions 2016-08-29 16:38:55 +00:00
config_files Add entrypoint for mapped auth method 2016-08-19 19:44:55 -07:00
contrib Use request.environ through auth and federation 2016-07-06 10:39:42 +10:00
credential Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
external Adds interface tests for timeutils 2015-09-23 12:43:37 +00:00
identity Shadowing a nonlocal_user incorrectly creates a local_user 2016-08-20 02:57:25 +00:00
ksfixtures Make KeyRepository shareable 2016-08-18 15:21:55 +00:00
policy Create unit tests for the policy drivers 2016-08-09 11:59:20 -03:00
resource Fix typo in the file 2016-08-14 00:53:55 +08:00
saml2 Add openstack_user_domain to assertion 2015-05-04 14:33:48 -03:00
schema Rename v2 token schema used for validation 2016-03-10 21:41:22 +00:00
tests Adds a skip method to identify useless skips 2016-06-29 19:48:12 +00:00
token Make KeyRepository shareable 2016-08-18 15:21:55 +00:00
trust Use more specific asserts in tests 2016-08-04 12:48:08 +02:00
__init__.py enable ldap tests for py3 2016-05-18 12:07:23 -04:00
core.py Remove unused global variable from unit tests 2016-08-25 14:09:37 +00:00
default_catalog.templates Move existing tests to unit 2015-02-13 15:54:29 -06:00
default_fixtures.py Make all fixture project_ids into uuids 2016-05-03 21:51:47 +00:00
fakeldap.py Replace keystone.common.config with keystone.conf package 2016-06-24 17:02:15 +00:00
federation_fixtures.py Move existing tests to unit 2015-02-13 15:54:29 -06:00
filtering.py Replace keystone.common.config with keystone.conf package 2016-06-24 17:02:15 +00:00
identity_mapping.py Use the new enginefacade from oslo.db 2016-02-24 08:20:12 -08:00
mapping_fixtures.py Relax the requirement for mappings to result in group memberships 2016-09-01 03:24:27 +00:00
rest.py remove test utilities related to adding extensions 2016-08-05 21:16:17 -07:00
test_associate_project_endpoint_extension.py Fix D400 PEP257 2016-04-21 15:25:34 +00:00
test_auth.py Pre-cache new tokens 2016-08-31 20:14:53 +03:00
test_auth_plugin.py Add entrypoint for mapped auth method 2016-08-19 19:44:55 -07:00
test_backend_endpoint_policy.py Use new_policy_ref consistently 2015-12-09 10:18:36 -08:00
test_backend_endpoint_policy_sql.py Fixes the SQL model tests 2015-03-08 05:34:48 +00:00
test_backend_federation_sql.py Add relay_state_prefix to Service Provider 2015-03-28 06:29:00 +00:00
test_backend_id_mapping_sql.py Added cache for id mapping manager 2016-07-20 10:57:13 +08:00
test_backend_kvs.py Only run KvsTokenCacheInvalidation against uuid 2016-07-22 16:13:49 +00:00
test_backend_ldap.py Merge "Removes duplicate ldap test setup" 2016-08-18 04:53:20 +00:00
test_backend_ldap_pool.py Pass request to v2 token authenticate 2016-07-15 13:33:39 +10:00
test_backend_rules.py Split policy backend tests 2016-03-04 15:32:42 -03:00
test_backend_sql.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_backend_templated.py Move logic for catalog driver differences to manager 2016-07-11 11:45:07 +01:00
test_catalog.py Remove unfixable FIXME 2015-12-09 15:21:09 -03:00
test_cert_setup.py Pass a request to controllers instead of a context 2016-06-08 14:56:52 +10:00
test_cli.py Add mapping_populate command 2016-08-23 20:52:10 +00:00
test_config.py Replace keystone.common.config with keystone.conf package 2016-06-24 17:02:15 +00:00
test_contrib_s3_core.py Fix string conversion in s3 handler for python 2 2015-11-18 13:25:27 +03:00
test_contrib_simple_cert.py Fixes to get cert tests running in Py3 2016-03-02 02:11:02 +00:00
test_credential.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_driver_hints.py Use assertTrue/False instead of assertEqual(T/F) 2015-11-02 09:10:38 +00:00
test_entry_points.py Added CORS support to Keystone 2016-02-10 06:00:00 -08:00
test_exception.py Adds a custom deepcopy handler 2016-07-28 20:58:44 +00:00
test_hacking_checks.py Handle Py35 fix of ast.node.col_offset bug 2016-07-19 13:51:32 -07:00
test_kvs.py Fix D400 PEP257 2016-04-21 15:25:34 +00:00
test_ldap_livetest.py Replace keystone.common.config with keystone.conf package 2016-06-24 17:02:15 +00:00
test_ldap_pool_livetest.py Pass request to v2 token authenticate 2016-07-15 13:33:39 +10:00
test_ldap_tls_livetest.py Replace keystone.common.config with keystone.conf package 2016-06-24 17:02:15 +00:00
test_middleware.py Skip middleware request processing for admin token 2016-08-02 19:47:32 -07:00
test_no_admin_token_auth.py Deprecate keystone.common.kvs 2016-05-12 23:30:15 -07:00
test_policy.py Remove test_invalid_policy_raises_error 2016-05-03 12:46:29 +00:00
test_revoke.py Merge "Replace revoke tree with linear search" 2016-05-25 15:13:43 +00:00
test_sql_banned_operations.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_sql_upgrade.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_token_bind.py Change tests to use common name for keystone.tests.unit 2015-09-04 18:21:42 +00:00
test_token_provider.py Make KeyRepository shareable 2016-08-18 15:21:55 +00:00
test_url_middleware.py Fix D401 PEP8 violation. 2016-04-14 20:08:52 +00:00
test_v2.py Make KeyRepository shareable 2016-08-18 15:21:55 +00:00
test_v2_controller.py Use request.params instead of context['query_string'] 2016-06-29 04:46:57 +10:00
test_v2_validation.py Add schema validation to create user v2 2016-08-04 19:33:17 +00:00
test_v3.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_v3_assignment.py Distributed cache namespace to invalidate regions 2016-08-29 16:38:55 +00:00
test_v3_auth.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_v3_catalog.py Move logic for catalog driver differences to manager 2016-07-11 11:45:07 +01:00
test_v3_credential.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_v3_domain_config.py Replace keystone.common.config with keystone.conf package 2016-06-24 17:02:15 +00:00
test_v3_endpoint_policy.py Use new_policy_ref consistently 2015-12-09 10:18:36 -08:00
test_v3_federation.py Relax the requirement for mappings to result in group memberships 2016-09-01 03:24:27 +00:00
test_v3_filters.py Fix some typos in comments 2016-08-26 12:17:00 +02:00
test_v3_identity.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_v3_oauth1.py Merge "Make KeyRepository shareable" 2016-08-21 05:27:53 +00:00
test_v3_os_revoke.py Use more specific asserts in tests 2016-08-04 12:48:08 +02:00
test_v3_policy.py Implement HEAD method for all v3 GET actions 2016-03-22 10:27:53 -07:00
test_v3_protection.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_v3_resource.py Implement encryption of credentials at rest 2016-09-02 04:25:49 +00:00
test_v3_trust.py Validate impersonation in trust redelegation 2016-06-20 12:19:06 +00:00
test_validation.py PCI-DSS Password strength requirements 2016-07-14 15:10:33 +00:00
test_versions.py Report v2.0 as deprecated in version discovery 2016-08-04 23:59:38 +03:00
test_wsgi.py Merge "Use http_client constants instead of hardcoding" 2016-07-09 00:53:19 +00:00
utils.py Add new functionality to @wip 2016-05-22 16:06:50 +00:00