IscsiChapSupport


 * Launchpad Entry: CinderSpec:iscsi-chap
 * Created: 13 Aug 2012
 * Contributors: Vincent Hou

Summary
CHAP(Challenge-Handshake Authentication Protocol) is an authentication scheme used by Point to Point Protocol (PPP) servers to validate the identity of remote clients. It can applied in iSCSI to authenticate the initiators or the targets. There are several types of CHAP, including one-way authentication, two-way authentication and reverse authentication. At the beginning of this blueprint, one-way CHAP authentication, via which the target authenticates the initiators, will be implemented first.

Release Note
This feature plans to be finished in G version.

User stories
For one-way CHAP authentication, the user can create a volume with a username and a password, enable the authentication of a volume by binding to a username and a password and disbale the authentication of a volume by unbinding the username and the password.

Example of a target description to be saved:

 backing-store /dev/stack-volumes/volume-XXXXXXXXXXXXXXXXXXXXXXXXXX incominguser username password

As the first stepstone, no change need to be done to the current API. When a volume is created with tdtadm or ietadm, a username and a password will be generated by the driver and saved into the configuration file and the database.

Implementation
When a volume is created, a pair of username and password should be generated. The username and password will be saved into the configuration file and the database automatically for the VM to initialize the connection to the volume.