2026.2 Series Release Notes¶

5.17.0¶

Added a v3websso authentication plugin, keystoneauth1.identity.v3.WebSSO, which implements the identity service’s WebSSO protocol. The plugin opens the WebSSO endpoint in the user’s browser and receives the resulting unscoped token on a loopback listener, letting a client authenticate against an external identity provider without holding any credentials of its own.

The callback URL, by default http://localhost:9990/auth/websso/, must be listed in the identity service’s [federation] trusted_dashboard option.

When two auth plugins register the same keystoneauth1.plugin entry-point name with one being an in-tree plugin and one an out-of-tree implementation of the same name, the out-of-tree implementation is now preferred. This lets deployers override a plugin shipped by keystoneauth1 with their own package.

Add support for configuring TLS cipher suites and minimum TLS protocol version on Session objects. Two new parameters are available: tls_ciphers accepts an OpenSSL cipher string to restrict the allowed cipher suites, and tls_min_version accepts a float (1.2 or 1.3) to enforce a minimum TLS protocol version. When neither is specified, the default ciphers from the OpenSSL library are used and the highest protocol version supported by both client and server is negotiated. These can be set via the Session constructor, oslo.config options (tls-ciphers, tls-min-version), CLI arguments (--tls-ciphers, --tls-min-version), or environment variables (OS_TLS_CIPHERS, OS_TLS_MIN_VERSION).

The v3websso plugin’s loopback callback is open to login CSRF. While a login is in progress, another page open in the user’s browser can submit a form to the callback port and have its own token accepted. The protocol offers no way to prevent this, because the identity service requires the callback’s origin to match a trusted_dashboard entry exactly and so it cannot carry a nonce. The listener binds to loopback only, runs only for the duration of a login, and stops at the first token it accepts. See the plugin documentation for details.

Federated authentication plugins now retain the unscoped token they obtain and expose it, so a single authentication - including a single interactive login - can be rescoped to any project, domain or system rather than costing a fresh authentication each time. The new get_unscoped_cache_id, get_unscoped_auth_state and set_unscoped_auth_state methods on keystoneauth1.plugin.BaseAuthPlugin let a caller identify, store and restore that unscoped token independently of the scope, and the new interactive_unscoped_auth class attribute tells a caller whether obtaining it requires the user to complete a login. The defaults on BaseAuthPlugin let any plugin be queried without knowing which kind it is.

Federated plugins no longer discard their unscoped token after rescoping; it is held for the lifetime of the plugin so that it can be reused. It is dropped when the plugin is invalidated, so an unscoped token the identity service has rejected is not reused.

BaseIdentityPlugin.get_cache_id() now terminates each of the elements that it hashes. The key and value of each element used to be hashed one after another with nothing in between, so plugins with different elements could produce the same cache id: one scoped to a project named a with the trust b hashed the same bytes as one scoped to a project named atrust_idb. Two plugins that agree on their cache id are taken to be the same identity, so either could be handed a token that was issued for the other. The cache ids a plugin returns change with this, so authentication state already cached under the old ones is not reused.

Federated authentication plugins now honour system_scope. The rescoping step that every federated plugin performs after obtaining an unscoped token considered every other scope but not this one, so asking a plugin such as v3oidcpassword, v3samlpassword, v3fedkerb or Keystone to Keystone for a system-scoped token silently produced an unscoped one instead. Requests made with it were then refused by the service being called rather than by the identity service, which gave no indication of the real cause.

The timeout option now accepts float values, in addition to integer values, for more fine-grained tuning.