Python Keystone has a following policy for listing credentials: "identity:list_credentials": "(rule:admin_required) or (role:reader and system_scope:all) or user_id:%(target.credential.user_id)s". On our side we properly allow admin, system reader listing credentials and anybody with the member role missing enforcing that the regular user would be only allowed to see own credentials. While the "credential.show" policy would still block the credentials from being returned it enables regular user to perform a DDoS attack by simply scanning through all credentials in the system.
The listing policy need to be modified replacing the "member" role with the "credential.user_id not null and match user's own user_id"
Python Keystone has a following policy for listing credentials:
"identity:list_credentials": "(rule:admin_required) or (role:reader and system_scope:all) or user_id:%(target.credential.user_id)s". On our side we properly allow admin, system reader listing credentials and anybody with the member role missing enforcing that the regular user would be only allowed to see own credentials. While the "credential.show" policy would still block the credentials from being returned it enables regular user to perform a DDoS attack by simply scanning through all credentials in the system.The listing policy need to be modified replacing the "member" role with the "credential.user_id not null and match user's own user_id"