@@ -19,6 +19,8 @@ import (

 	"github.com/openshift/origin/pkg/oauth/registry/test"

 	"github.com/openshift/origin/pkg/oauth/server/osinserver"

 	"github.com/openshift/origin/pkg/oauth/server/osinserver/registrystorage"

+	userapi "github.com/openshift/origin/pkg/user/api"

+	usertest "github.com/openshift/origin/pkg/user/registry/test"

 )

 type testHandlers struct {

@@ -245,7 +247,8 @@ func TestRegistryAndServer(t *testing.T) {

 func TestAuthenticateTokenNotFound(t *testing.T) {

 	tokenRegistry := &test.AccessTokenRegistry{Err: apierrs.NewNotFound("AccessToken", "token")}

-	tokenAuthenticator := NewTokenAuthenticator(tokenRegistry)

+	userRegistry := usertest.NewUserRegistry()

+	tokenAuthenticator := NewTokenAuthenticator(tokenRegistry, userRegistry)

 	userInfo, found, err := tokenAuthenticator.AuthenticateToken("token")

 	if found {

@@ -263,7 +266,8 @@ func TestAuthenticateTokenNotFound(t *testing.T) {

 }

 func TestAuthenticateTokenOtherGetError(t *testing.T) {

 	tokenRegistry := &test.AccessTokenRegistry{Err: errors.New("get error")}

-	tokenAuthenticator := NewTokenAuthenticator(tokenRegistry)

+	userRegistry := usertest.NewUserRegistry()

+	tokenAuthenticator := NewTokenAuthenticator(tokenRegistry, userRegistry)

 	userInfo, found, err := tokenAuthenticator.AuthenticateToken("token")

 	if found {

@@ -287,7 +291,8 @@ func TestAuthenticateTokenExpired(t *testing.T) {

 			ExpiresIn:  600, // 10 minutes

 		},

 	}

-	tokenAuthenticator := NewTokenAuthenticator(tokenRegistry)

+	userRegistry := usertest.NewUserRegistry()

+	tokenAuthenticator := NewTokenAuthenticator(tokenRegistry, userRegistry)

 	userInfo, found, err := tokenAuthenticator.AuthenticateToken("token")

 	if found {

@@ -306,9 +311,14 @@ func TestAuthenticateTokenValidated(t *testing.T) {

 		AccessToken: &oapi.OAuthAccessToken{

 			ObjectMeta: kapi.ObjectMeta{CreationTimestamp: util.Time{time.Now()}},

 			ExpiresIn:  600, // 10 minutes

+			UserName:   "foo",

+			UserUID:    string("bar"),

 		},

 	}

-	tokenAuthenticator := NewTokenAuthenticator(tokenRegistry)

+	userRegistry := usertest.NewUserRegistry()

+	userRegistry.Get["foo"] = &userapi.User{ObjectMeta: kapi.ObjectMeta{UID: "bar"}}

+

+	tokenAuthenticator := NewTokenAuthenticator(tokenRegistry, userRegistry)

 	userInfo, found, err := tokenAuthenticator.AuthenticateToken("token")

 	if !found {

@@ -2,35 +2,51 @@ package registry

 import (

 	"errors"

+	"fmt"

 	"time"

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/api"

-	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

+	kuser "github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/oauth/registry/oauthaccesstoken"

+	"github.com/openshift/origin/pkg/user/registry/user"

 )

 type TokenAuthenticator struct {

-	registry oauthaccesstoken.Registry

+	tokens oauthaccesstoken.Registry

+	users  user.Registry

 }

 var ErrExpired = errors.New("Token is expired")

-func NewTokenAuthenticator(registry oauthaccesstoken.Registry) *TokenAuthenticator {

+func NewTokenAuthenticator(tokens oauthaccesstoken.Registry, users user.Registry) *TokenAuthenticator {

 	return &TokenAuthenticator{

-		registry: registry,

+		tokens: tokens,

+		users:  users,

 	}

 }

-func (a *TokenAuthenticator) AuthenticateToken(value string) (user.Info, bool, error) {

-	token, err := a.registry.GetAccessToken(api.NewContext(), value)

+func (a *TokenAuthenticator) AuthenticateToken(value string) (kuser.Info, bool, error) {

+	ctx := api.NewContext()

+

+	token, err := a.tokens.GetAccessToken(ctx, value)

 	if err != nil {

 		return nil, false, err

 	}

 	if token.CreationTimestamp.Time.Add(time.Duration(token.ExpiresIn) * time.Second).Before(time.Now()) {

 		return nil, false, ErrExpired

 	}

-	return &user.DefaultInfo{

-		Name: token.UserName,

-		UID:  token.UserUID,

+

+	u, err := a.users.GetUser(ctx, token.UserName)

+	if err != nil {

+		return nil, false, err

+	}

+	if string(u.UID) != token.UserUID {

+		return nil, false, fmt.Errorf("user.UID (%s) does not match token.userUID (%s)", u.UID, token.UserUID)

+	}

+

+	return &kuser.DefaultInfo{

+		Name:   u.Name,

+		UID:    string(u.UID),

+		Groups: u.Groups,

 	}, true, nil

 }

@@ -5,27 +5,37 @@ import (

 	kuser "github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	authapi "github.com/openshift/origin/pkg/auth/api"

+	"github.com/openshift/origin/pkg/user/registry/user"

 	"github.com/openshift/origin/pkg/user/registry/useridentitymapping"

 )

 type lookupIdentityMapper struct {

-	registry useridentitymapping.Registry

+	mappings useridentitymapping.Registry

+	users    user.Registry

 }

 // NewLookupIdentityMapper returns a mapper that will look up existing mappings for identities

-func NewLookupIdentityMapper(registry useridentitymapping.Registry) authapi.UserIdentityMapper {

-	return &lookupIdentityMapper{registry}

+func NewLookupIdentityMapper(mappings useridentitymapping.Registry, users user.Registry) authapi.UserIdentityMapper {

+	return &lookupIdentityMapper{mappings, users}

 }

 // UserFor returns info about the user for whom identity info has been provided

 func (p *lookupIdentityMapper) UserFor(info authapi.UserIdentityInfo) (kuser.Info, error) {

-	mapping, err := p.registry.GetUserIdentityMapping(kapi.NewContext(), info.GetIdentityName())

+	ctx := kapi.NewContext()

+

+	mapping, err := p.mappings.GetUserIdentityMapping(ctx, info.GetIdentityName())

+	if err != nil {

+		return nil, err

+	}

+

+	u, err := p.users.GetUser(ctx, mapping.User.Name)

 	if err != nil {

 		return nil, err

 	}

 	return &kuser.DefaultInfo{

-		Name: mapping.User.Name,

-		UID:  string(mapping.User.UID),

+		Name:   u.Name,

+		UID:    string(u.UID),

+		Groups: u.Groups,

 	}, nil

 }

@@ -112,8 +112,9 @@ func (p *provisioningIdentityMapper) createIdentityAndMapping(ctx kapi.Context,

 	}

 	return &kuser.DefaultInfo{

-		Name: persistedUser.Name,

-		UID:  string(persistedUser.UID),

+		Name:   persistedUser.Name,

+		UID:    string(persistedUser.UID),

+		Groups: persistedUser.Groups,

 	}, nil

 }

@@ -182,8 +183,9 @@ func (p *provisioningIdentityMapper) getMapping(ctx kapi.Context, identity *user

 		return nil, kerrs.NewNotFound("UserIdentityMapping", identity.Name)

 	}

 	return &kuser.DefaultInfo{

-		Name: u.Name,

-		UID:  string(u.UID),

+		Name:   u.Name,

+		UID:    string(u.UID),

+		Groups: u.Groups,

 	}, nil

 }

@@ -41,6 +41,8 @@ import (

 	accesstokenregistry "github.com/openshift/origin/pkg/oauth/registry/oauthaccesstoken"

 	accesstokenetcd "github.com/openshift/origin/pkg/oauth/registry/oauthaccesstoken/etcd"

 	projectauth "github.com/openshift/origin/pkg/project/auth"

+	userregistry "github.com/openshift/origin/pkg/user/registry/user"

+	useretcd "github.com/openshift/origin/pkg/user/registry/user/etcd"

 )

 const (

@@ -181,12 +183,12 @@ func newAuthenticator(servingInfo configapi.ServingInfo, etcdHelper tools.EtcdHe

 	// Allow token as access_token param for WebSockets

 	// TODO: make the param name configurable

 	// TODO: limit this authenticator to watch methods, if possible

-	// TODO: prevent access_token param from getting logged, if possible

 	authenticators = append(authenticators, paramtoken.New("access_token", tokenAuthenticator, true))

 	if configapi.UseTLS(servingInfo) {

 		// build cert authenticator

-		// TODO: add cert users to etcd?

+		// TODO: add "system:" prefix in authenticator, limit cert to username

+		// TODO: add "system:" prefix to groups in authenticator, limit cert to group name

 		opts := x509request.DefaultVerifyOptions()

 		opts.Roots = apiClientCAs

 		certauth := x509request.New(opts, x509request.SubjectToUserConversion)

@@ -240,7 +242,11 @@ func newAuthorizationAttributeBuilder(requestContextMapper kapi.RequestContextMa

 func getEtcdTokenAuthenticator(etcdHelper tools.EtcdHelper) authenticator.Token {

 	accessTokenStorage := accesstokenetcd.NewREST(etcdHelper)

 	accessTokenRegistry := accesstokenregistry.NewRegistry(accessTokenStorage)

-	return authnregistry.NewTokenAuthenticator(accessTokenRegistry)

+

+	userStorage := useretcd.NewREST(etcdHelper)

+	userRegistry := userregistry.NewRegistry(userStorage)

+

+	return authnregistry.NewTokenAuthenticator(accessTokenRegistry, userRegistry)

 }

 // KubeClient returns the kubernetes client object

@@ -12,6 +12,8 @@ type User struct {

 	FullName string

 	Identities []string

+

+	Groups []string

 }

 type UserList struct {

@@ -12,6 +12,8 @@ type User struct {

 	FullName string `json:"fullName,omitempty"`

 	Identities []string `json:"identities"`

+

+	Groups []string `json:"groups"`

 }

 type UserList struct {

@@ -12,6 +12,8 @@ type User struct {

 	FullName string `json:"fullName,omitempty"`

 	Identities []string `json:"identities"`

+

+	Groups []string `json:"groups"`

 }

 type UserList struct {

@@ -57,6 +57,28 @@ func ValidateIdentityName(name string, _ bool) (bool, string) {

 	return true, ""

 }

+func ValidateGroupName(name string, _ bool) (bool, string) {

+	if strings.Contains(name, "%") {

+		return false, `may not contain "%"`

+	}

+	if strings.Contains(name, "/") {

+		return false, `may not contain "/"`

+	}

+	if strings.Contains(name, ":") {

+		return false, `may not contain ":"`

+	}

+	if name == ".." {

+		return false, `may not equal ".."`

+	}

+	if name == "." {

+		return false, `may not equal "."`

+	}

+	if name == "~" {

+		return false, `may not equal "~"`

+	}

+	return true, ""

+}

+

 func ValidateIdentityProviderName(name string) (bool, string) {

 	if strings.Contains(name, "%") {

 		return false, `may not contain "%"`

@@ -83,6 +105,13 @@ func ValidateUser(user *api.User) fielderrors.ValidationErrorList {

 			allErrs = append(allErrs, fielderrors.NewFieldInvalid(fmt.Sprintf("identities[%d]", index), identity, msg))

 		}

 	}

+

+	for index, group := range user.Groups {

+		if ok, msg := ValidateGroupName(group, false); !ok {

+			allErrs = append(allErrs, fielderrors.NewFieldInvalid(fmt.Sprintf("groups[%d]", index), group, msg))

+		}

+	}

+

 	return allErrs

 }

@@ -93,7 +93,7 @@ func TestUserInitialization(t *testing.T) {

 	identityRegistry := identityregistry.NewRegistry(identityetcd.NewREST(etcdHelper))

 	useridentityMappingRegistry := useridentitymapping.NewRegistry(useridentitymapping.NewREST(userRegistry, identityRegistry))

-	lookup := identitymapper.NewLookupIdentityMapper(useridentityMappingRegistry)

+	lookup := identitymapper.NewLookupIdentityMapper(useridentityMappingRegistry, userRegistry)

 	provisioner := identitymapper.NewAlwaysCreateUserIdentityToUserMapper(identityRegistry, userRegistry)

 	testcases := map[string]struct {