It would be good to tighten up horizon logins. With modern keystone this shouldn't be especially hard. Example:
https://ask.openstack.org/en/question/53047/how-to-implement-2-factor-authentication-in-horizon/
= Keystone
== kilo
Apply {F3324919}
In /etc/keystone.conf
* Set password = keystone.auth.plugins.passwordoath.PasswordOATH in the [auth] section
* Add an [oath] section with mysql details,
```
[oath]
dbuser = wiki_user
dbpass = s3kr3t
dbname = labswiki
dbhost = localhost
```
== liberty
Apply {F3414052}
In /etc/keystone.conf
* Add an [oath] section with mysql details,
```
[oath]
dbuser = wiki_user
dbpass = s3kr3t
dbname = labswiki
dbhost = localhost
```
== Testing
If you're just setting this up for testing (i.e. in devstack), you can add enough mediawiki/OATHAuth database configuration to get it working with,
```
create database labswiki; use labswiki;
CREATE TABLE `oathauth_users` ( `id` int(11) NOT NULL, `secret` varchar(255) CHARACTER SET utf8 COLLATE utf8_bin NOT NULL, PRIMARY KEY (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE TABLE `user` ( `user_id` int(10) unsigned NOT NULL AUTO_INCREMENT, `user_name` varchar(255) CHARACTER SET utf8 COLLATE utf8_bin NOT NULL DEFAULT '', PRIMARY KEY (`user_id`) ) ENGINE=InnoDB AUTO_INCREMENT=235 DEFAULT CHARSET=utf8;
insert into user values (1,'admin'),(2,'user');
insert into oathauth_users values (1,'7XNRULECJPMYBOM4'),(2,'BL3R67WWTZ33OAJ2');
grant all on labswiki.* to 'wiki_user'@'localhost' identified by 's3kr3ts';
flush privileges;
```
If you're using devstack, you'll probably want to add to your local.conf,
```
ENABLED_SERVICES=key,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,cinder,c-sch,c-api,c-vol,n-sch,n-novnc,n-xvnc,n-cauth,horizon,mysql,rabbit,ldap
KEYSTONE_IDENTITY_BACKEND=ldap
```