ceph/src/auth/scheme.txt

   1
   2 client_name = foo   (mon has some corresponding shared secret)
   3 client_addr = ip address, port, pid
   4
   5
   6 monitor has:
   7
   8 client_auth {
   9        client_name;
  10        client capabilities;
  11        client secret;
  12 };
  13 map<client_name, client_auth> users;
  14
  15 struct secret {
  16         bufferlist secret;
  17         utime_t created;
  18 };
  19 map<entity_name, secret> entity_secrets;
  20
  21 struct service_secret_set {
  22        secret[3];
  23 };
  24 map<string, service_secret_set> svc_secrets;
  25
  26 /*
  27 svcsecret will be a rotating key.  we regenerate every time T, and keep
  28 keys for 3*T.  client always get the second-newest key.  all 3 are
  29 considered valid.  clients and services renew/reverify key at least one
  30 every time T.
  31 */
  32
  33
  34 client_ticket {
  35        client_addr;
  36        map<svc name or type, blob> client_capabilities;
  37 };
  38
  39
  40
  41 authenticate principle:
  42
  43 C->M : client_name, client_addr.  authenticate me.
  44  ...monitor does lookup in database...
  45 M->C : A= {client/mon session key, validity}^clientsecret
  46        B= {client ticket, validity, client/mon session key}^monsecret
  47
  48
  49 authorize principle to do something on monitor:
  50
  51 C->M : B, {client_addr, timestamp}^client/mon session key.  do foo (assign id)
  52 M->C : result.  and {timestamp+1}^client/mon session key
  53
  54
  55 authorize for service:
  56
  57 C->M : B, {client_addr, timestamp}^client/mon session key.  authorize me!
  58 M->C : E= {svc ticket}^svcsecret
  59        F= {svc session key, validity}^client/mon session key
  60
  61 svc ticket = (client addr, validity, svc session key)
  62
  63
  64 on opening session to service:
  65
  66 C->O : E + {client_addr, timestamp}^svc session key
  67 O->C : {timestamp+1}^svc session key
  68
  69
  70
  71
  72
  73 To authenticate:
  74
  75  client -> auth:
  76    {client_name, client_addr}^client_secret
  77  auth -> client:
  78    {session key, validity, nonce}^client_secret
  79    {client_ticket, session key}^service_secret  ... "enc_ticket"
  80
  81 where client_ticket is { client_addr, created, expires, none, capabilities }.
  82
  83 To gain access using our ticket:
  84
  85
  86
  87