Hello, I've been looking at options for doing multi-factor auth (MFA) on our infrastructure and I'm just wanting to know if the option I've decided to go with seems sensible.
As context, we are running stock Keystone (to be backed by LDAP), we wanted to be able to enable MFA on a per user basis, and a user with MFA enabled should either be blocked from using the APIs or required MFA to use the APIs. I was looking at the current TOTP module in keystone, but seeing as that simply adds another optional Auth method to keystone it seems fairly useless for our needs. Unless I'm missing something, there seems to be no way in Keystone to enforce "use these two auth methods together". Is that the case? If not, it is something that has been considered? Or it is assumed people will write their own auth plugins rather than combining existing ones? >From there I went toward writing our own Keystone Auth plugin and had a lot of success with that. The current iteration is a combination of the password and totp plugins where for users with TOTP credentials we expect a 6 digit password appended to the password. In the config I then replace the default password plugin with my own. In testing this seems to work as intended. All normal users are unaffected while users with a TOTP credential now must append their passcode to their password. I've made a blueprint for this plugin: https://blueprints.launchpad.net/keystone/+spec/password-totp-plugin and the code I am currently testing is in the associated review: https://review.openstack.org/#/c/343422/ If this plugin is useful to others, and this seemed like a sensible solution, I will write some unit tests and work on getting it merged. So, my main question, does this plugin seem like a sensible solution to MFA in OpenStack in the way we needed or are there other paths I should be going down? Cheers, -Adrian Turjak __________________________________________________________________________ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev