openstack/openstack-manuals
Code Issues Proposed changes
openstack-manuals/doc/admin-guide/source/identity-token-binding.rst
Steve Martinelli 0b2753f924 Rename admin-guide files: keystone -> identity 
Most of the files in the admin guide do not use the project's
code name, with keystone being an exception. Let's rename
them to identity.

Change-Id: I82fec895ef84b027db727d311a52a480b5830eab
2016-10-12 15:53:13 +00:00

1.7 KiB
Raw Blame History

Configure Identity service for token binding

Token binding embeds information from an external authentication mechanism, such as a Kerberos server or X.509 certificate, inside a token. By using token binding, a client can enforce the use of a specified external authentication mechanism with the token. This additional security mechanism ensures that if a token is stolen, for example, it is not usable without external authentication.

You configure the authentication types for a token binding in the keystone.conf file:

[token]
bind = kerberos

or

[token]
bind = x509

Currently kerberos and x509 are supported.

To enforce checking of token binding, set the enforce_token_bind option to one of these modes:

  • disabled

    Disables token bind checking.

  • permissive

    Enables bind checking. If a token is bound to an unknown authentication mechanism, the server ignores it. The default is this mode.

  • strict

    Enables bind checking. If a token is bound to an unknown authentication mechanism, the server rejects it.

  • required

    Enables bind checking. Requires use of at least authentication mechanism for tokens.

  • kerberos

    Enables bind checking. Requires use of kerberos as the authentication mechanism for tokens:

    [token]
enforce_token_bind = kerberos
  • x509

    Enables bind checking. Requires use of X.509 as the authentication mechanism for tokens:

    [token]
enforce_token_bind = x509