)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"8b97db047340cd6c1d11d92cdbedf155a687adbb","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This blueprint details the work required to add a driver for"},{"line_number":10,"context_line":"Authenticated Encryption Tokens."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"bp ae-tokens"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Ifa2d1f1c3ccf11654b3e5c7be1e2389baadd21c5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":21,"id":"3a961159_24637fdd","line":12,"updated":"2014-12-09 15:49:44.000000000","message":"Blueprint not found on launchpad.","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"994b56de54764490450797269cc06b850b06a6e9","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This blueprint details the work required to add a driver for"},{"line_number":10,"context_line":"Authenticated Encryption Tokens."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"bp ae-tokens"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Ifa2d1f1c3ccf11654b3e5c7be1e2389baadd21c5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":21,"id":"3a961159_f03f3fd4","line":12,"in_reply_to":"3a961159_24637fdd","updated":"2014-12-10 20:00:21.000000000","message":"it won\u0027t be found until it\u0027s approved.","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"}],"specs/kilo/ae-tokens.rst":[{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"cfe7d3b289e361cec7eaa92d2a27dd608f2cb6a0","unresolved":false,"context_lines":[{"line_number":32,"context_line":"AE tokens will provide a way for deployers to avoid performance and"},{"line_number":33,"context_line":"maintenance of tokens backends by using an Authenticated Encrypted token"},{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user. The user can then use this AE token to"},{"line_number":37,"context_line":"in a normal UUID workflow. When Keystone receives an AE token from a user or"},{"line_number":38,"context_line":"a service, it can validate the token by decrypting the token and verifying"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_f6b27a92","line":35,"updated":"2014-10-28 03:34:33.000000000","message":"Can you please elaborate the minimum data? Is role part of data?  If so how is the middleware going to decrypt it?","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1248a102fe616ab4e65e39a5e6b7dccc2393963b","unresolved":false,"context_lines":[{"line_number":32,"context_line":"AE tokens will provide a way for deployers to avoid performance and"},{"line_number":33,"context_line":"maintenance of tokens backends by using an Authenticated Encrypted token"},{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user. The user can then use this AE token to"},{"line_number":37,"context_line":"in a normal UUID workflow. When Keystone receives an AE token from a user or"},{"line_number":38,"context_line":"a service, it can validate the token by decrypting the token and verifying"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_01db2d7c","line":35,"in_reply_to":"9aa7fdbe_f6b27a92","updated":"2014-10-28 14:10:30.000000000","message":"Done","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b24a448240ec204c9f791bf2d23f71db161ec663","unresolved":false,"context_lines":[{"line_number":37,"context_line":"in a normal UUID workflow. When Keystone receives an AE token from a user or"},{"line_number":38,"context_line":"a service, it can validate the token by decrypting the token and verifying"},{"line_number":39,"context_line":"the information inside the token. This doesn\u0027t require the AE token driver"},{"line_number":40,"context_line":"to look up any information from a token backend."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"This driver will only require minimum data to verify the user\u0027s"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_7733e9f5","line":40,"updated":"2014-10-28 00:34:30.000000000","message":"So the tokens are still bearer tokens in this case?","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1248a102fe616ab4e65e39a5e6b7dccc2393963b","unresolved":false,"context_lines":[{"line_number":37,"context_line":"in a normal UUID workflow. When Keystone receives an AE token from a user or"},{"line_number":38,"context_line":"a service, it can validate the token by decrypting the token and verifying"},{"line_number":39,"context_line":"the information inside the token. This doesn\u0027t require the AE token driver"},{"line_number":40,"context_line":"to look up any information from a token backend."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"This driver will only require minimum data to verify the user\u0027s"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_81d63d4d","line":40,"in_reply_to":"9aa7fdbe_7733e9f5","updated":"2014-10-28 14:10:30.000000000","message":"Yes","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b24a448240ec204c9f791bf2d23f71db161ec663","unresolved":false,"context_lines":[{"line_number":43,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":44,"context_line":"identity. The hash of the data will result in the user\u0027s token. The workflow"},{"line_number":45,"context_line":"for the user doesn\u0027t change from the current workflow. The token size will"},{"line_number":46,"context_line":"be bigger but not at big as a PKI token."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_b777119f","line":46,"updated":"2014-10-28 00:34:30.000000000","message":"How will this be different than PKI tokens without the catalog? Is this symmetrical encryption or asymmetrical. In the latter category this is PKI just encrypted instead of just \"signed\".","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1248a102fe616ab4e65e39a5e6b7dccc2393963b","unresolved":false,"context_lines":[{"line_number":43,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":44,"context_line":"identity. The hash of the data will result in the user\u0027s token. The workflow"},{"line_number":45,"context_line":"for the user doesn\u0027t change from the current workflow. The token size will"},{"line_number":46,"context_line":"be bigger but not at big as a PKI token."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_e1cc696c","line":46,"in_reply_to":"9aa7fdbe_b777119f","updated":"2014-10-28 14:10:30.000000000","message":"The token will be built with less data so it will be smaller than PKI tokens. Symmetrical encryption could be used in this case since Keystone will be the only service encrypting (authenticate) and decrypting (validate) the information. The validation of the contents of the token isn\u0027t done other services.","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b24a448240ec204c9f791bf2d23f71db161ec663","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Token revocation can be handled through revocation rules. When a user"},{"line_number":52,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":53,"context_line":"expression that will describe a token to revoke. An example being,"},{"line_number":54,"context_line":"revoke all tokens from user XYZ before this point in time. The next time the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_f76d19cd","line":51,"updated":"2014-10-28 00:34:30.000000000","message":"This already exists as \"revocation events\". Suggest just leveraging that code instead of adding a new \"regular expression\" system.","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1248a102fe616ab4e65e39a5e6b7dccc2393963b","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Token revocation can be handled through revocation rules. When a user"},{"line_number":52,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":53,"context_line":"expression that will describe a token to revoke. An example being,"},{"line_number":54,"context_line":"revoke all tokens from user XYZ before this point in time. The next time the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_41ec55bb","line":51,"in_reply_to":"9aa7fdbe_f76d19cd","updated":"2014-10-28 14:10:30.000000000","message":"Done","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"cfe7d3b289e361cec7eaa92d2a27dd608f2cb6a0","unresolved":false,"context_lines":[{"line_number":49,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Token revocation can be handled through revocation rules. When a user"},{"line_number":52,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":53,"context_line":"expression that will describe a token to revoke. An example being,"},{"line_number":54,"context_line":"revoke all tokens from user XYZ before this point in time. The next time the"},{"line_number":55,"context_line":"user sends the now revoked token to Keystone, the validate call will check"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_56526635","line":52,"updated":"2014-10-28 03:34:33.000000000","message":"+1","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b24a448240ec204c9f791bf2d23f71db161ec663","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Alternatives"},{"line_number":61,"context_line":"------------"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Keeps things as is and maintain token storage."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Security Impact"},{"line_number":66,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_5766e5ed","line":63,"updated":"2014-10-28 00:34:30.000000000","message":"Suggest changing to \"None\" as there isn\u0027t really an alternative that affects keystone.","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1248a102fe616ab4e65e39a5e6b7dccc2393963b","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Alternatives"},{"line_number":61,"context_line":"------------"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Keeps things as is and maintain token storage."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Security Impact"},{"line_number":66,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_e141c9a9","line":63,"in_reply_to":"9aa7fdbe_5766e5ed","updated":"2014-10-28 14:10:30.000000000","message":"Done","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b24a448240ec204c9f791bf2d23f71db161ec663","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"  Yes, when Keystone receives an authenticate request,"},{"line_number":84,"context_line":"  all information required to verify a user will have to be compressed and"},{"line_number":85,"context_line":"  hashed, the result being the token."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":88,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_97e12d2c","line":85,"updated":"2014-10-28 00:34:30.000000000","message":"Hashing is a 1-way process. Hashed data it wouldn\u0027t be possible to reverse it and get the relevant authz information we need. I\u0027m not sure if you\u0027re expecting to use the hashed value and then need to lookup the data or use a non-hashed value which works like PKI tokens today do.","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1248a102fe616ab4e65e39a5e6b7dccc2393963b","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"  Yes, when Keystone receives an authenticate request,"},{"line_number":84,"context_line":"  all information required to verify a user will have to be compressed and"},{"line_number":85,"context_line":"  hashed, the result being the token."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":88,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_214831cb","line":85,"in_reply_to":"9aa7fdbe_97e12d2c","updated":"2014-10-28 14:10:30.000000000","message":"Done","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b24a448240ec204c9f791bf2d23f71db161ec663","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Other End User Impact"},{"line_number":113,"context_line":"---------------------"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"End users will notice an increase in token size if electing to use AE tokens."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Performance Impact"},{"line_number":118,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_f7c999ac","line":115,"updated":"2014-10-28 00:34:30.000000000","message":"Increase over which form of tokens? UUID? PKI? PKIZ? PKI/PKIZ without catalog? This is likely a deployer choice not an end user choice.","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1248a102fe616ab4e65e39a5e6b7dccc2393963b","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Other End User Impact"},{"line_number":113,"context_line":"---------------------"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"End users will notice an increase in token size if electing to use AE tokens."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Performance Impact"},{"line_number":118,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_211f51b8","line":115,"in_reply_to":"9aa7fdbe_f7c999ac","updated":"2014-10-28 14:10:30.000000000","message":"AE tokens will be larger than UUID tokens, but smaller than PKI tokens, as noted above.","commit_id":"8396f6409b3e750c5d8e056c9add33d5433fc035"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f5b49fb490dbc7a87ecee75536a988f20370ec68","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Authenticated Encrypted Tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_b13b7a37","line":11,"updated":"2014-10-29 23:21:28.000000000","message":"is the link correct? doesn\u0027t seem to work for me","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6becbffc8088be3884a2bd4a7d5432530589d6cc","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Authenticated Encrypted Tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_2d2f10a3","line":11,"in_reply_to":"7a8c0949_b13b7a37","updated":"2014-10-30 22:20:13.000000000","message":"Once the spec is approved, we will create the launchpad entry.","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"a28db18eb7518a6abf25c053870891ccccec0594","unresolved":false,"context_lines":[{"line_number":33,"context_line":"maintenance of tokens backends by using an Authenticated Encrypted token"},{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user (``user_id``, ``expires_at``,"},{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_d922f5b7","line":36,"updated":"2014-10-28 16:27:27.000000000","message":"Can you please explain how the user is going to get role information?  I\u0027m still confused.  If I understood correctly ,  token id  encryption of ( user {user_id.....} and  the token body is going to remain same. Is this correct?","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6216f2adec625c414ea3af4785e8a5d658aa40e7","unresolved":false,"context_lines":[{"line_number":33,"context_line":"maintenance of tokens backends by using an Authenticated Encrypted token"},{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user (``user_id``, ``expires_at``,"},{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_fd16bc47","line":36,"in_reply_to":"9aa7fdbe_d922f5b7","updated":"2014-10-28 20:19:55.000000000","message":"The role information can be populated similar to how it is when using UUID tokens. The roles for a user don\u0027t have to be in the encrypted token. After extracting the user information from the token (i.e. the validation process), the user_id can be used to get the roles for a user from the assignment API.","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f5b49fb490dbc7a87ecee75536a988f20370ec68","unresolved":false,"context_lines":[{"line_number":33,"context_line":"maintenance of tokens backends by using an Authenticated Encrypted token"},{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user (``user_id``, ``expires_at``,"},{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_51d176cc","line":36,"in_reply_to":"9aa7fdbe_fd16bc47","updated":"2014-10-29 23:21:28.000000000","message":"user_id, expires_at, created_at, auth_type, and scope","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"a28db18eb7518a6abf25c053870891ccccec0594","unresolved":false,"context_lines":[{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"},{"line_number":40,"context_line":"information inside the token. This doesn\u0027t require the AE token driver to"},{"line_number":41,"context_line":"look up any information from a token backend."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_94f594ee","line":40,"updated":"2014-10-28 16:27:27.000000000","message":"There are 2 problems with the tokens\n\n1) Too many tokens are created in  DB  and lookup is costly\n2) Too many token validation request.  ( network overhead)\n\n1) UUID token has both the problems.\n2) PKI token solves the second one by doing validation in the client side. When PKI was designed,  2) was considered a major issue\n3) Non persistence token  solves both 1) and 2)\n4) AE tokens solves 1) , but introduces 2)\n\nCan you please explain what problem does  AE token solve better that Non persistent PKI token?","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6becbffc8088be3884a2bd4a7d5432530589d6cc","unresolved":false,"context_lines":[{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"},{"line_number":40,"context_line":"information inside the token. This doesn\u0027t require the AE token driver to"},{"line_number":41,"context_line":"look up any information from a token backend."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_2d063021","line":40,"in_reply_to":"9aa7fdbe_74a007a6","updated":"2014-10-30 22:20:13.000000000","message":"I would be careful saying they are \"non-persistent UUID\" tokens since AE tokens do carry some set of information *in* the token, it\u0027s just a super minimal set.","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6216f2adec625c414ea3af4785e8a5d658aa40e7","unresolved":false,"context_lines":[{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"},{"line_number":40,"context_line":"information inside the token. This doesn\u0027t require the AE token driver to"},{"line_number":41,"context_line":"look up any information from a token backend."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_c2ff5932","line":40,"in_reply_to":"9aa7fdbe_94f594ee","updated":"2014-10-28 20:19:55.000000000","message":"Yes, we are working towards a non-persistent PKI token, but many of the questions about how we are going to do it are still unanswered, since non-persistent tokens are dependent on a PKI solution that scales. PKI introduces a problem where the token exceeds some acceptable length, whether that be for user experience or technical limits of how the token is transferred. \n\nAuthenticated Encrypted tokens would remove the I/O operations from a token perspective, so fixing #1. It would also not introduce the token size issue that PKI has the ability to introduce, so tokens wouldn\u0027t get bigger as your deployment grows. There is also a significant amount of deployer overhead for setting up Keystone for PKI and according to a user survey, many deployers switched from PKI (the default at the time [1]) to UUID [2]. So it seems users would be more inclined use UUID tokens even though they are prone to problems #1 and #2 versus PKI tokens that require additional setup and possibly introduce very large tokens. \n\n\n[1] https://review.openstack.org/#/c/110488/\n[2] https://www.surveymonkey.com/results/SM-LX589JF8/","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"f7980e9270fd7108de7e9c7be090fd6c41781bba","unresolved":false,"context_lines":[{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"},{"line_number":40,"context_line":"information inside the token. This doesn\u0027t require the AE token driver to"},{"line_number":41,"context_line":"look up any information from a token backend."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_74a007a6","line":40,"in_reply_to":"9aa7fdbe_c2ff5932","updated":"2014-10-29 20:42:54.000000000","message":"Got it.   I believe you are saying\n\nAE is non persistent UUID wheres original proposal put forward by Morgan was for PKI.  Basically we are reusing that code base to do non persistent UUID","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f5b49fb490dbc7a87ecee75536a988f20370ec68","unresolved":false,"context_lines":[{"line_number":57,"context_line":"user sends the now revoked token to Keystone, the validate call will check"},{"line_number":58,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":59,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":60,"context_line":"rules can be cleaned up anytime after the default token expiration time."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Alternatives"},{"line_number":63,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_7172f2e6","line":60,"updated":"2014-10-29 23:21:28.000000000","message":"Just to be clear. We are still persisting revocation information. Just that revocation is not a common occurrence, and therefore the amount of data we have to persist is far less.\n\nHeck, depending on a particular deployment, you may be able to tolerate short term risk with short-lived tokens.","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6becbffc8088be3884a2bd4a7d5432530589d6cc","unresolved":false,"context_lines":[{"line_number":57,"context_line":"user sends the now revoked token to Keystone, the validate call will check"},{"line_number":58,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":59,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":60,"context_line":"rules can be cleaned up anytime after the default token expiration time."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Alternatives"},{"line_number":63,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_8d4f2492","line":60,"in_reply_to":"7a8c0949_7172f2e6","updated":"2014-10-30 22:20:13.000000000","message":"Yes, revocation list information would still be stored, but that could be cleared out some arbitrary time after max token life.","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f5b49fb490dbc7a87ecee75536a988f20370ec68","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"  Yes, tokens will be hashed and returned instead of stored in a token backend."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":78,"context_line":"  a new way to access sensitive information or a new way to login?"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_f17d02b3","line":75,"updated":"2014-10-29 23:21:28.000000000","message":"hashed? you mean encrypted (and possibly compressed) right?","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6becbffc8088be3884a2bd4a7d5432530589d6cc","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"  Yes, tokens will be hashed and returned instead of stored in a token backend."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":78,"context_line":"  a new way to access sensitive information or a new way to login?"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_ad44e074","line":75,"in_reply_to":"7a8c0949_f17d02b3","updated":"2014-10-30 22:20:13.000000000","message":"Yes, I can fix that","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"56eb9354be0c0c8b2da7c5f5ade13d4168f225ac","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  It shouldn\u0027t, all the same data will be required for authenticating and"},{"line_number":81,"context_line":"  validating against Keystone."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"  Yes, when Keystone receives an authenticate request,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_8e53bb6b","line":82,"updated":"2014-10-29 21:50:33.000000000","message":"Can you please explain how are  you planning to keep encryption keys safe?  Unless it kept safe, I can recreate the token_id with different expiry value.\n\nSo far keystone never dealt with keeping secure information","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"81acbd904b45765c5ef15a21f748a045bdf500ba","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  It shouldn\u0027t, all the same data will be required for authenticating and"},{"line_number":81,"context_line":"  validating against Keystone."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"  Yes, when Keystone receives an authenticate request,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_f692429e","line":82,"in_reply_to":"7a8c0949_51441674","updated":"2014-10-30 15:49:51.000000000","message":"My question is , do we really need public key infrastructure for encryption?\nAs of now we are using public key cert infrastructure for signing and not for encryption. Both are different","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"91219e8bb30392b7e86bb04311de70642e835f5a","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  It shouldn\u0027t, all the same data will be required for authenticating and"},{"line_number":81,"context_line":"  validating against Keystone."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"  Yes, when Keystone receives an authenticate request,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_0810824d","line":82,"in_reply_to":"7a8c0949_761d7273","updated":"2014-10-30 22:21:10.000000000","message":"That is the main issue.  Since only few fields are used for encryption (user_id, expiry etc) , If  I know the key or  key is compromised I can easily create tokens. Since tokens are not persisted in keystone, keystone have no clue who created the token.","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6becbffc8088be3884a2bd4a7d5432530589d6cc","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  It shouldn\u0027t, all the same data will be required for authenticating and"},{"line_number":81,"context_line":"  validating against Keystone."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"  Yes, when Keystone receives an authenticate request,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_cd492c8d","line":82,"in_reply_to":"7a8c0949_761d7273","updated":"2014-10-30 22:20:13.000000000","message":"gyee, yes, exactly","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f5b49fb490dbc7a87ecee75536a988f20370ec68","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  It shouldn\u0027t, all the same data will be required for authenticating and"},{"line_number":81,"context_line":"  validating against Keystone."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"  Yes, when Keystone receives an authenticate request,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_51441674","line":82,"in_reply_to":"7a8c0949_8e53bb6b","updated":"2014-10-29 23:21:28.000000000","message":"this is the same as PKI token signing key management","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"2c5fd1b4ed6ce76d8cb3189fed38480e05401059","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  It shouldn\u0027t, all the same data will be required for authenticating and"},{"line_number":81,"context_line":"  validating against Keystone."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"  Yes, when Keystone receives an authenticate request,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_761d7273","line":82,"in_reply_to":"7a8c0949_f692429e","updated":"2014-10-30 16:15:28.000000000","message":"This should be symmetric key encryption as only Keystone will be doing the encrypting and decrypting. Heck, it could even be done with just HMAC if the content is not deem sensitive.","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f5b49fb490dbc7a87ecee75536a988f20370ec68","unresolved":false,"context_lines":[{"line_number":125,"context_line":"increases in scale. Instead of scaling a persistent storage solution for"},{"line_number":126,"context_line":"tokens, an alternative would be to use AE tokens and scale up compute power."},{"line_number":127,"context_line":"Since the tokens never have to be written to a backend,"},{"line_number":128,"context_line":"CPU operations will have better performance versus I/O operations."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Other Deployer Impact"},{"line_number":131,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_71403257","line":128,"updated":"2014-10-29 23:21:28.000000000","message":"performance should be on par with UUID tokens. Give or take, token decryption versus DB lookup should be roughly the same. Depends on env, token decryption may even be faster.\n\nIt should be nice to have an example of the size differential between AE and UUID token to give reviewers some idea.","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6becbffc8088be3884a2bd4a7d5432530589d6cc","unresolved":false,"context_lines":[{"line_number":125,"context_line":"increases in scale. Instead of scaling a persistent storage solution for"},{"line_number":126,"context_line":"tokens, an alternative would be to use AE tokens and scale up compute power."},{"line_number":127,"context_line":"Since the tokens never have to be written to a backend,"},{"line_number":128,"context_line":"CPU operations will have better performance versus I/O operations."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Other Deployer Impact"},{"line_number":131,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_ed2428c8","line":128,"in_reply_to":"7a8c0949_71403257","updated":"2014-10-30 22:20:13.000000000","message":"Yeah, there has been some POC work that i can dig up with some examples. As far as performance goes, the encryption part scales with CPU, so that *should* be more performant than any i/o read/write operation.","commit_id":"a2ec961d7cd4a5ec1abf6f8428afc012b049e39f"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"825374b7a794474e52d0e97330f95f56e623bbda","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_18a4f8a4","line":13,"updated":"2014-11-07 10:43:57.000000000","message":"Authenticated Encryption (AE) tokens...","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c5c2d028234d4d69708f57d46739be04cb7998f","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_89b7b8d7","line":13,"in_reply_to":"7a8c0949_18a4f8a4","updated":"2014-11-07 12:29:01.000000000","message":"Done","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"825374b7a794474e52d0e97330f95f56e623bbda","unresolved":false,"context_lines":[{"line_number":19,"context_line":"After having deployed Keystone for some time, deployers have run into issues"},{"line_number":20,"context_line":"with the amount of tokens stored in the token backend. To avoid this"},{"line_number":21,"context_line":"problem, deployers must routinely clean out stale tokens from their"},{"line_number":22,"context_line":"persistent storage to prevent performance or upgrade issues."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Proposed Change"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_98de2810","line":22,"updated":"2014-11-07 10:43:57.000000000","message":"Cleaning out stale tokens in mass could cause performance issues as well in a large replicating identity solution.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c5c2d028234d4d69708f57d46739be04cb7998f","unresolved":false,"context_lines":[{"line_number":19,"context_line":"After having deployed Keystone for some time, deployers have run into issues"},{"line_number":20,"context_line":"with the amount of tokens stored in the token backend. To avoid this"},{"line_number":21,"context_line":"problem, deployers must routinely clean out stale tokens from their"},{"line_number":22,"context_line":"persistent storage to prevent performance or upgrade issues."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Proposed Change"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_69d7eced","line":22,"in_reply_to":"7a8c0949_98de2810","updated":"2014-11-07 12:29:01.000000000","message":"Done","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c5f92a231b8b1fdf1b731f3164b53fce7c2a0f70","unresolved":false,"context_lines":[{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user (``user_id``, ``expires_at``,"},{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"},{"line_number":40,"context_line":"information inside the token. This doesn\u0027t require the AE token driver to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_e23cd9e4","line":37,"updated":"2014-11-07 09:40:29.000000000","message":"auth_token middleware will also need token binding.\n\nThe scope will also be needed.\n\nWhat is auth_type?\n\nchange \"to in\" to \"in\"","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d78d2ea30f5df6472559a493fddd8544a7d6eaba","unresolved":false,"context_lines":[{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user (``user_id``, ``expires_at``,"},{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"},{"line_number":40,"context_line":"information inside the token. This doesn\u0027t require the AE token driver to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_c942a00f","line":37,"in_reply_to":"7a8c0949_894ed86d","updated":"2014-11-07 12:26:44.000000000","message":"token binding needs to be stored with the token, since it can\u0027t be rebuilt given any of this info that\u0027s listed here.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d69a1ad9bba87dbbcdf44202c295a8ecd8df58d9","unresolved":false,"context_lines":[{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user (``user_id``, ``expires_at``,"},{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"},{"line_number":40,"context_line":"information inside the token. This doesn\u0027t require the AE token driver to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_f372edab","line":37,"in_reply_to":"7a8c0949_e23cd9e4","updated":"2014-11-07 12:25:00.000000000","message":"Done, auth_type would be a way to represent different token types, say if we wanted to add multi-factor tokens or impersonated tokens.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f67c8a921e681d57e659ce2e32e1b09c0dbfac53","unresolved":false,"context_lines":[{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user (``user_id``, ``expires_at``,"},{"line_number":37,"context_line":"``created_at``, ``auth_type``). The user can then use this AE token to in a"},{"line_number":38,"context_line":"normal UUID workflow. When  Keystone receives an AE token from a user or a"},{"line_number":39,"context_line":"service, it can validate the token by decrypting the token and verifying the"},{"line_number":40,"context_line":"information inside the token. This doesn\u0027t require the AE token driver to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_894ed86d","line":37,"in_reply_to":"7a8c0949_e23cd9e4","updated":"2014-11-07 12:15:33.000000000","message":"If token binding works with UUID token, it should work with AE tokens as well. Token binding is not being checked till we get the token data. The flow is exactly the same as UUID tokens.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c5f92a231b8b1fdf1b731f3164b53fce7c2a0f70","unresolved":false,"context_lines":[{"line_number":44,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":45,"context_line":"identity. The encrypted data will result in the user\u0027s token. The workflow"},{"line_number":46,"context_line":"for the user doesn\u0027t change from the current workflow. The token size will"},{"line_number":47,"context_line":"be bigger than UUID tokens but not at big as a PKI tokens."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_b5784d90","line":47,"updated":"2014-11-07 09:40:29.000000000","message":"change \"as a\" to \"as\"","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d69a1ad9bba87dbbcdf44202c295a8ecd8df58d9","unresolved":false,"context_lines":[{"line_number":44,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":45,"context_line":"identity. The encrypted data will result in the user\u0027s token. The workflow"},{"line_number":46,"context_line":"for the user doesn\u0027t change from the current workflow. The token size will"},{"line_number":47,"context_line":"be bigger than UUID tokens but not at big as a PKI tokens."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_336475e4","line":47,"in_reply_to":"7a8c0949_b5784d90","updated":"2014-11-07 12:25:00.000000000","message":"Done","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c5f92a231b8b1fdf1b731f3164b53fce7c2a0f70","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Token revocation can be handled through revocation rules,"},{"line_number":53,"context_line":"which can be built of the existing recovation rule system. When a user"},{"line_number":54,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":55,"context_line":"expression that will describe a token to revoke. An example being,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_f572d5ab","line":52,"updated":"2014-11-07 09:40:29.000000000","message":"Keystone already has revocation events.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d78d2ea30f5df6472559a493fddd8544a7d6eaba","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Token revocation can be handled through revocation rules,"},{"line_number":53,"context_line":"which can be built of the existing recovation rule system. When a user"},{"line_number":54,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":55,"context_line":"expression that will describe a token to revoke. An example being,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_094ca841","line":52,"in_reply_to":"7a8c0949_0942e83d","updated":"2014-11-07 12:26:44.000000000","message":"revocation events are persisted.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f67c8a921e681d57e659ce2e32e1b09c0dbfac53","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Token revocation can be handled through revocation rules,"},{"line_number":53,"context_line":"which can be built of the existing recovation rule system. When a user"},{"line_number":54,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":55,"context_line":"expression that will describe a token to revoke. An example being,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_0942e83d","line":52,"in_reply_to":"7a8c0949_f572d5ab","updated":"2014-11-07 12:15:33.000000000","message":"We need to persist the token revocation data. Are the revocation events persisted?","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d69a1ad9bba87dbbcdf44202c295a8ecd8df58d9","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Token revocation can be handled through revocation rules,"},{"line_number":53,"context_line":"which can be built of the existing recovation rule system. When a user"},{"line_number":54,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":55,"context_line":"expression that will describe a token to revoke. An example being,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_f3a90de0","line":52,"in_reply_to":"7a8c0949_f572d5ab","updated":"2014-11-07 12:25:00.000000000","message":"Yep, we should be able to leverage the existing work to revoke ae tokens.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c5f92a231b8b1fdf1b731f3164b53fce7c2a0f70","unresolved":false,"context_lines":[{"line_number":58,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":59,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":60,"context_line":"rules can be cleaned up anytime after the default token expiration time."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Alternatives"},{"line_number":63,"context_line":"------------"},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_b5868d63","line":61,"updated":"2014-11-07 09:40:29.000000000","message":"Any new or changed config options? How do I set up the encryption?","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d78d2ea30f5df6472559a493fddd8544a7d6eaba","unresolved":false,"context_lines":[{"line_number":58,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":59,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":60,"context_line":"rules can be cleaned up anytime after the default token expiration time."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Alternatives"},{"line_number":63,"context_line":"------------"},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_6951acd7","line":61,"in_reply_to":"7a8c0949_a978f48f","updated":"2014-11-07 12:26:44.000000000","message":"Don\u0027t need to specify them but I wouldn\u0027t complain if they were.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d69a1ad9bba87dbbcdf44202c295a8ecd8df58d9","unresolved":false,"context_lines":[{"line_number":58,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":59,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":60,"context_line":"rules can be cleaned up anytime after the default token expiration time."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Alternatives"},{"line_number":63,"context_line":"------------"},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_d3f411f4","line":61,"in_reply_to":"7a8c0949_b5868d63","updated":"2014-11-07 12:25:00.000000000","message":"Done","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f67c8a921e681d57e659ce2e32e1b09c0dbfac53","unresolved":false,"context_lines":[{"line_number":58,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":59,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":60,"context_line":"rules can be cleaned up anytime after the default token expiration time."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Alternatives"},{"line_number":63,"context_line":"------------"},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_a978f48f","line":61,"in_reply_to":"7a8c0949_b5868d63","updated":"2014-11-07 12:15:33.000000000","message":"That\u0027s implementation details right? Do we need to specify them in the spec?","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c5f92a231b8b1fdf1b731f3164b53fce7c2a0f70","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"  Yes, tokens will be encrypted, compressed and returned instead of stored"},{"line_number":76,"context_line":"  in a token backend."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* Does this change alter the API in a way that may impact security, such as"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_55e80910","line":75,"updated":"2014-11-07 09:40:29.000000000","message":"Is compression going to help? The UUIDs are random data.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d69a1ad9bba87dbbcdf44202c295a8ecd8df58d9","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"  Yes, tokens will be encrypted, compressed and returned instead of stored"},{"line_number":76,"context_line":"  in a token backend."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* Does this change alter the API in a way that may impact security, such as"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_097d881c","line":75,"in_reply_to":"7a8c0949_55e80910","updated":"2014-11-07 12:25:00.000000000","message":"It\u0027s true that we will have the minimum amount of data allowed for a token *in* the token. I think if we have the opportunity to make the token smaller, considering user experience, it would be good to do so.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f67c8a921e681d57e659ce2e32e1b09c0dbfac53","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"  Yes, tokens will be encrypted, compressed and returned instead of stored"},{"line_number":76,"context_line":"  in a token backend."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* Does this change alter the API in a way that may impact security, such as"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_a99f14b3","line":75,"in_reply_to":"7a8c0949_55e80910","updated":"2014-11-07 12:15:33.000000000","message":"Yes compression will help. But is it necessary? If its only 256 bytes or less, compression would be more of an overhead.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c5f92a231b8b1fdf1b731f3164b53fce7c2a0f70","unresolved":false,"context_lines":[{"line_number":94,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":95,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"  The AE token will be built from data provided from the user."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":100,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_f55c95ef","line":97,"updated":"2014-11-07 09:40:29.000000000","message":"what data is being used?","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d78d2ea30f5df6472559a493fddd8544a7d6eaba","unresolved":false,"context_lines":[{"line_number":94,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":95,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"  The AE token will be built from data provided from the user."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":100,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_0921084d","line":97,"in_reply_to":"7a8c0949_09b02842","updated":"2014-11-07 12:26:44.000000000","message":"the spec should say how the data provided by the user is validated.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"1ad0c90a5f1ce08377b8f70acbed249e5fe896e4","unresolved":false,"context_lines":[{"line_number":94,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":95,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"  The AE token will be built from data provided from the user."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":100,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_69ee0cb6","line":97,"in_reply_to":"7a8c0949_4977903a","updated":"2014-11-07 12:28:30.000000000","message":"If you try to compress random data it winds up larger, due to headers that the compression adds.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d69a1ad9bba87dbbcdf44202c295a8ecd8df58d9","unresolved":false,"context_lines":[{"line_number":94,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":95,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"  The AE token will be built from data provided from the user."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":100,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_4977903a","line":97,"in_reply_to":"7a8c0949_f55c95ef","updated":"2014-11-07 12:25:00.000000000","message":"The same data that is listed above in the `Proposed Change` section.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f67c8a921e681d57e659ce2e32e1b09c0dbfac53","unresolved":false,"context_lines":[{"line_number":94,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":95,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"  The AE token will be built from data provided from the user."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":100,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_09b02842","line":97,"in_reply_to":"7a8c0949_f55c95ef","updated":"2014-11-07 12:15:33.000000000","message":"user_id, validity, and scope","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c5f92a231b8b1fdf1b731f3164b53fce7c2a0f70","unresolved":false,"context_lines":[{"line_number":139,"context_line":"  implement as well)? Are the default values ones which will work well in"},{"line_number":140,"context_line":"  real deployments?"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"  The AE token driver should be specified in the Keystone configuration file."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"},{"line_number":145,"context_line":"  something that has to be explicitly enabled?"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_b5be8dd2","line":142,"updated":"2014-11-07 09:40:29.000000000","message":"Does the deployer have to configured a key?","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d69a1ad9bba87dbbcdf44202c295a8ecd8df58d9","unresolved":false,"context_lines":[{"line_number":139,"context_line":"  implement as well)? Are the default values ones which will work well in"},{"line_number":140,"context_line":"  real deployments?"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"  The AE token driver should be specified in the Keystone configuration file."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"},{"line_number":145,"context_line":"  something that has to be explicitly enabled?"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_e9f75cf3","line":142,"in_reply_to":"7a8c0949_b5be8dd2","updated":"2014-11-07 12:25:00.000000000","message":"Done","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f67c8a921e681d57e659ce2e32e1b09c0dbfac53","unresolved":false,"context_lines":[{"line_number":139,"context_line":"  implement as well)? Are the default values ones which will work well in"},{"line_number":140,"context_line":"  real deployments?"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"  The AE token driver should be specified in the Keystone configuration file."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"},{"line_number":145,"context_line":"  something that has to be explicitly enabled?"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_49ba3024","line":142,"in_reply_to":"7a8c0949_b5be8dd2","updated":"2014-11-07 12:15:33.000000000","message":"Yes","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c5f92a231b8b1fdf1b731f3164b53fce7c2a0f70","unresolved":false,"context_lines":[{"line_number":179,"context_line":"Documentation Impact"},{"line_number":180,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"Detail how to switch to a AE token implementation and setting up the drivers."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"References"},{"line_number":185,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_f5b815e7","line":182,"updated":"2014-11-07 09:40:29.000000000","message":"change \"drivers\" to \"driver\".","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d69a1ad9bba87dbbcdf44202c295a8ecd8df58d9","unresolved":false,"context_lines":[{"line_number":179,"context_line":"Documentation Impact"},{"line_number":180,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"Detail how to switch to a AE token implementation and setting up the drivers."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"References"},{"line_number":185,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_e9ce7cb3","line":182,"in_reply_to":"7a8c0949_f5b815e7","updated":"2014-11-07 12:25:00.000000000","message":"Done","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c5f92a231b8b1fdf1b731f3164b53fce7c2a0f70","unresolved":false,"context_lines":[{"line_number":184,"context_line":"References"},{"line_number":185,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_75c4255f","line":187,"updated":"2014-11-07 09:40:29.000000000","message":"Could reference the encryption algorithm used.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f67c8a921e681d57e659ce2e32e1b09c0dbfac53","unresolved":false,"context_lines":[{"line_number":184,"context_line":"References"},{"line_number":185,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_c97d4070","line":187,"in_reply_to":"7a8c0949_13de996d","updated":"2014-11-07 12:15:33.000000000","message":"++. I thought we\u0027ve agreed on authentication (HMAC) only. No encryption.","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c5c2d028234d4d69708f57d46739be04cb7998f","unresolved":false,"context_lines":[{"line_number":184,"context_line":"References"},{"line_number":185,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_e9391c42","line":187,"in_reply_to":"7a8c0949_13de996d","updated":"2014-11-07 12:29:01.000000000","message":"Done","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"825374b7a794474e52d0e97330f95f56e623bbda","unresolved":false,"context_lines":[{"line_number":184,"context_line":"References"},{"line_number":185,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_13de996d","line":187,"in_reply_to":"7a8c0949_75c4255f","updated":"2014-11-07 10:43:57.000000000","message":"+1 - http://en.wikipedia.org/wiki/Authenticated_encryption","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d69a1ad9bba87dbbcdf44202c295a8ecd8df58d9","unresolved":false,"context_lines":[{"line_number":184,"context_line":"References"},{"line_number":185,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_69ed2cef","line":187,"in_reply_to":"7a8c0949_75c4255f","updated":"2014-11-07 12:25:00.000000000","message":"Done","commit_id":"ad0e7d086a058462638748a6cf64256649cc4e73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d7aaf8e006bfd02bd60c8d24fb67cf5a51ce3877","unresolved":false,"context_lines":[{"line_number":136,"context_line":"tokens, an alternative would be to use AE tokens and scale up compute power."},{"line_number":137,"context_line":"Since the tokens never have to be written to a backend,"},{"line_number":138,"context_line":"CPU operations will have better performance versus I/O operations."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Other Deployer Impact"},{"line_number":141,"context_line":"---------------------"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a8c0949_e4e141ff","line":139,"updated":"2014-11-07 14:57:59.000000000","message":"This solution scales linearly instead of the timing and performance issues of some storage solution.","commit_id":"26e2b6bf2dc0f57a530307e9762504c4fe9094db"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"33a44bd0eb7af4a51044df6dde399730e96a8968","unresolved":false,"context_lines":[{"line_number":136,"context_line":"tokens, an alternative would be to use AE tokens and scale up compute power."},{"line_number":137,"context_line":"Since the tokens never have to be written to a backend,"},{"line_number":138,"context_line":"CPU operations will have better performance versus I/O operations."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Other Deployer Impact"},{"line_number":141,"context_line":"---------------------"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_3573e24e","line":139,"in_reply_to":"7a8c0949_e4e141ff","updated":"2014-11-10 14:38:29.000000000","message":"Done","commit_id":"26e2b6bf2dc0f57a530307e9762504c4fe9094db"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"be436e2005705eb009ae1f9207d39bf42baf5adc","unresolved":false,"context_lines":[{"line_number":27,"context_line":"One way to avoid issues with massive amounts of tokens stored in a backend"},{"line_number":28,"context_line":"is to not store tokens at all. This work is being accomplished with"},{"line_number":29,"context_line":"`non-persistent tokens \u003chttps://blueprints.launchpad"},{"line_number":30,"context_line":".net/keystone/+spec/non-persistent-tokens\u003e`_ which will require PKI."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"AE tokens will provide a way for deployers to avoid performance and"},{"line_number":33,"context_line":"maintenance of tokens backends by using an Authenticated Encrypted token"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_629ebbba","line":30,"updated":"2014-11-18 04:59:28.000000000","message":"PKI? That\u0027s a tease - you don\u0027t mention PKI anywhere else in this doc.","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e4a9c51186cd651927cbcd0af3b6c2e47e181a0f","unresolved":false,"context_lines":[{"line_number":27,"context_line":"One way to avoid issues with massive amounts of tokens stored in a backend"},{"line_number":28,"context_line":"is to not store tokens at all. This work is being accomplished with"},{"line_number":29,"context_line":"`non-persistent tokens \u003chttps://blueprints.launchpad"},{"line_number":30,"context_line":".net/keystone/+spec/non-persistent-tokens\u003e`_ which will require PKI."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"AE tokens will provide a way for deployers to avoid performance and"},{"line_number":33,"context_line":"maintenance of tokens backends by using an Authenticated Encrypted token"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_4cd47247","line":30,"in_reply_to":"5a890539_629ebbba","updated":"2014-11-18 21:36:46.000000000","message":"Done","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"be436e2005705eb009ae1f9207d39bf42baf5adc","unresolved":false,"context_lines":[{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user (``user_id``, ``expires_at``,"},{"line_number":37,"context_line":"``created_at``, ``auth_type``)."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Specifically, this will look very similar to the following::"},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_e2b1cb47","line":37,"updated":"2014-11-18 04:59:28.000000000","message":"missing audit_id","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e4a9c51186cd651927cbcd0af3b6c2e47e181a0f","unresolved":false,"context_lines":[{"line_number":34,"context_line":"driver. When authenticating, the AE token driver will pull the absolute"},{"line_number":35,"context_line":"minimum amount of information about the user out of the request and encrypt"},{"line_number":36,"context_line":"the data and return it to the user (``user_id``, ``expires_at``,"},{"line_number":37,"context_line":"``created_at``, ``auth_type``)."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Specifically, this will look very similar to the following::"},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_ecbc3e09","line":37,"in_reply_to":"5a890539_e2b1cb47","updated":"2014-11-18 21:36:46.000000000","message":"consolidating this info into one place, done.","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"db739d4c795ed3075ea3980e45ffbfd5de75c9d4","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Specifically, this will look very similar to the following::"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"  payload \u003d [user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Where the values are"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_a240a307","line":41,"updated":"2014-11-18 04:54:56.000000000","message":"auth_type?\n\nAlso, may want to mention that this is just an example. Otherwise, you will have to cover domain-scoped, binding, etc.","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"be436e2005705eb009ae1f9207d39bf42baf5adc","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Specifically, this will look very similar to the following::"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"  payload \u003d [user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Where the values are"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_2e23bfbd","line":41,"updated":"2014-11-18 04:59:28.000000000","message":"i think we\u0027ll need a way to distinguish the target. For example how do we know it\u0027s scoped to a project and not a trust or a domain. \n\nI like the list rather than a full dictionary here so maybe just put a:\n\n[user_id, \u0027p\u0027, project_id... ] to distinguish project from \u0027t\u0027rust \u0027d\u0027omain or later \u0027s\u0027ervice.","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e4a9c51186cd651927cbcd0af3b6c2e47e181a0f","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Specifically, this will look very similar to the following::"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"  payload \u003d [user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Where the values are"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_ec019eb0","line":41,"in_reply_to":"5a890539_2e23bfbd","updated":"2014-11-18 21:36:46.000000000","message":"Done","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e4a9c51186cd651927cbcd0af3b6c2e47e181a0f","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Specifically, this will look very similar to the following::"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"  payload \u003d [user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Where the values are"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_2c0486c5","line":41,"in_reply_to":"5a890539_a240a307","updated":"2014-11-18 21:36:46.000000000","message":"Done","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"be436e2005705eb009ae1f9207d39bf42baf5adc","unresolved":false,"context_lines":[{"line_number":46,"context_line":"* ``created_at``: Timestamp representing the created at time of the token. By"},{"line_number":47,"context_line":"using timestamp we can save on space when packing the message by packing an int"},{"line_number":48,"context_line":"instead of a string."},{"line_number":49,"context_line":"* ``expires_at``: Timestamp representing the expiration of the token. This"},{"line_number":50,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_02adf7e8","line":49,"updated":"2014-11-18 04:59:28.000000000","message":"audit_id","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"be436e2005705eb009ae1f9207d39bf42baf5adc","unresolved":false,"context_lines":[{"line_number":48,"context_line":"instead of a string."},{"line_number":49,"context_line":"* ``expires_at``: Timestamp representing the expiration of the token. This"},{"line_number":50,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_ee14574e","line":51,"updated":"2014-11-18 04:59:28.000000000","message":"why would we want different representations? same with created_at - i don\u0027t think it matters so much which timestamp format you pick (though i\u0027d say just use the ISO8601) and require it.","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e4a9c51186cd651927cbcd0af3b6c2e47e181a0f","unresolved":false,"context_lines":[{"line_number":48,"context_line":"instead of a string."},{"line_number":49,"context_line":"* ``expires_at``: Timestamp representing the expiration of the token. This"},{"line_number":50,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_4cbe32d6","line":51,"in_reply_to":"5a890539_ee14574e","updated":"2014-11-18 21:36:46.000000000","message":"By using an integer to for the timestamp we can save on space versus using a string.","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"db739d4c795ed3075ea3980e45ffbfd5de75c9d4","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` can be"},{"line_number":58,"context_line":"HMAC signed. The resulting digest will be tacked on to the ``payload`` and"},{"line_number":59,"context_line":"will be used to verify the contents of the payload. This is important"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_02f7b7d3","line":56,"updated":"2014-11-18 04:54:56.000000000","message":"IIRC, at the summit, we agreed on using HMAC only. Encrypt only if necessary. May want to consider making encryption optional.","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"be436e2005705eb009ae1f9207d39bf42baf5adc","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Finally, the token will look something like::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d ae_token_version + digest + payload"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":69,"context_line":"validation, this character can be popped off the token to determine the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_6285db58","line":66,"updated":"2014-11-18 04:59:28.000000000","message":"are you saying that the values will be seperated with the \u0027+\u0027 character or simply appended? \n\nIf not \u0027+\u0027 how do we split the token into parts?\n\nwhat\u0027s the prefix?","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"db739d4c795ed3075ea3980e45ffbfd5de75c9d4","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Finally, the token will look something like::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d ae_token_version + digest + payload"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":69,"context_line":"validation, this character can be popped off the token to determine the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_42fd3fb0","line":66,"updated":"2014-11-18 04:54:56.000000000","message":"prefix + ...","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e4a9c51186cd651927cbcd0af3b6c2e47e181a0f","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Finally, the token will look something like::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d ae_token_version + digest + payload"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":69,"context_line":"validation, this character can be popped off the token to determine the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_8cebbaaf","line":66,"in_reply_to":"5a890539_6285db58","updated":"2014-11-18 21:36:46.000000000","message":"Done","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"be436e2005705eb009ae1f9207d39bf42baf5adc","unresolved":false,"context_lines":[{"line_number":92,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Token revocation can be handled through revocation rules,"},{"line_number":95,"context_line":"which can be built of the existing recovation rule system. When a user"},{"line_number":96,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":97,"context_line":"expression that will describe a token to revoke. An example being,"},{"line_number":98,"context_line":"revoke all tokens from user XYZ before this point in time. The next time the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_62295b89","line":95,"updated":"2014-11-18 04:59:28.000000000","message":"pretty sure we called this revocation events, not rules","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e4a9c51186cd651927cbcd0af3b6c2e47e181a0f","unresolved":false,"context_lines":[{"line_number":92,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Token revocation can be handled through revocation rules,"},{"line_number":95,"context_line":"which can be built of the existing recovation rule system. When a user"},{"line_number":96,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":97,"context_line":"expression that will describe a token to revoke. An example being,"},{"line_number":98,"context_line":"revoke all tokens from user XYZ before this point in time. The next time the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_2c03a677","line":95,"in_reply_to":"5a890539_62295b89","updated":"2014-11-18 21:36:46.000000000","message":"Done","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"be436e2005705eb009ae1f9207d39bf42baf5adc","unresolved":false,"context_lines":[{"line_number":115,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  Yes, tokens will be encrypted, compressed and returned instead of stored"},{"line_number":118,"context_line":"  in a token backend."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":121,"context_line":"  a new way to access sensitive information or a new way to login?"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_428a9f64","line":118,"updated":"2014-11-18 04:59:28.000000000","message":"Are we encrypting and compressing? - not otherwised mentioned","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e4a9c51186cd651927cbcd0af3b6c2e47e181a0f","unresolved":false,"context_lines":[{"line_number":115,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  Yes, tokens will be encrypted, compressed and returned instead of stored"},{"line_number":118,"context_line":"  in a token backend."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":121,"context_line":"  a new way to access sensitive information or a new way to login?"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_cc686224","line":118,"in_reply_to":"5a890539_428a9f64","updated":"2014-11-18 21:36:46.000000000","message":"Done, added some info at Proposed Change","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"be436e2005705eb009ae1f9207d39bf42baf5adc","unresolved":false,"context_lines":[{"line_number":136,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":137,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"  The AE token will be built from data provided from the user."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":142,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_42453f41","line":139,"updated":"2014-11-18 04:59:28.000000000","message":"nit: yes and no - the ids that are being used should come from the database. I think this is asking whether we open up the possibility of an injection attack and i don\u0027t believe we do here.","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e4a9c51186cd651927cbcd0af3b6c2e47e181a0f","unresolved":false,"context_lines":[{"line_number":136,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":137,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"  The AE token will be built from data provided from the user."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":142,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_2ced668f","line":139,"in_reply_to":"5a890539_42453f41","updated":"2014-11-18 21:36:46.000000000","message":"Done","commit_id":"dab6c530be1ace4ca781f5eb49ca9a2002d9d6d6"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":" This work is licensed under a Creative Commons Attribution 3.0 Unported"},{"line_number":3,"context_line":" License."},{"line_number":4,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_a9dbb119","line":1,"updated":"2014-11-20 21:35:33.000000000","message":"After reading the spec, one overall comment i\u0027d suggest is to break out the example into a separate section specific to the example. \n\nThe main section of the spec can then clearly and succinctly outline what an implementation MUST do, SHOULD do (but not required), and OPTIONALLY do. It also provides some clarification on what is left to the implementation\u0027s discretion. A lot of my subsequent comments refer to ambiguity is whether something described is required or optional.\n\nThe example could then provide some clarity on how a potential solution could stitch all the requirements together while not prescribing a specific implementation.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":29,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":30,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":31,"context_line":"the AE token driver will pull the absolute minimum amount of information"},{"line_number":32,"context_line":"about the user out of the request and encrypt the data and return it to the"},{"line_number":33,"context_line":"user. To ensure we keep the tokens to a reasonable length,"},{"line_number":34,"context_line":"the information can be compressed. This is something that can be done using"},{"line_number":35,"context_line":"msgpack."}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_70829301","line":32,"updated":"2014-11-20 21:35:33.000000000","message":"Suggest rewording this more along the lines of:\n\"...out of the request, generate a token containing this data and return it to the user\"\n\nThe way it reads now, to me anyway, is that only the encrypted data is returned to the user. With the change the \"generation\" process is left open, to be described later in the spec.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":29,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":30,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":31,"context_line":"the AE token driver will pull the absolute minimum amount of information"},{"line_number":32,"context_line":"about the user out of the request and encrypt the data and return it to the"},{"line_number":33,"context_line":"user. To ensure we keep the tokens to a reasonable length,"},{"line_number":34,"context_line":"the information can be compressed. This is something that can be done using"},{"line_number":35,"context_line":"msgpack."}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_92c9be7b","line":32,"in_reply_to":"5a890539_70829301","updated":"2014-11-20 23:13:14.000000000","message":"Done","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":32,"context_line":"about the user out of the request and encrypt the data and return it to the"},{"line_number":33,"context_line":"user. To ensure we keep the tokens to a reasonable length,"},{"line_number":34,"context_line":"the information can be compressed. This is something that can be done using"},{"line_number":35,"context_line":"msgpack."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_b07b1b28","line":35,"updated":"2014-11-20 21:35:33.000000000","message":"is msgpack being prescribed as the only acceptable solution here?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":32,"context_line":"about the user out of the request and encrypt the data and return it to the"},{"line_number":33,"context_line":"user. To ensure we keep the tokens to a reasonable length,"},{"line_number":34,"context_line":"the information can be compressed. This is something that can be done using"},{"line_number":35,"context_line":"msgpack."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_3242ca10","line":35,"in_reply_to":"5a890539_b07b1b28","updated":"2014-11-20 23:13:14.000000000","message":"No, not at all, another solution can be used or included. I can add clarity here saying that we *can* use msgpack or that msgpack can be used to fill this space.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":35,"context_line":"msgpack."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_f0acc38e","line":38,"updated":"2014-11-20 21:35:33.000000000","message":"This states \"example\". So is the spec explicitly prescribing any information that MUST be included in the payload in order for an implementation to meet the spec? Or are all implementations free to choose whatever fields make sense for that implementation? \n\nAlso, what flexibility is being/should be given to implementors to add additional information that may be required for that particular implementation?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":35,"context_line":"msgpack."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_f2dda215","line":38,"in_reply_to":"5a890539_f0acc38e","updated":"2014-11-20 23:13:14.000000000","message":"I would say that the \"example\" means that in order to be compliant with the spec, you need to have some identifier that represents a user, etc. The information below can be described as the information needed for Keystone to validate a token.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":50,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_10722f11","line":53,"updated":"2014-11-20 21:35:33.000000000","message":"The exact representation in the token in which the above fields are stored is left ambiguous here. Are implementations free to choose whatever representation they deem appropriate?\n\nFor example, expires_at could be an epoch, a string representation of a date, or even ms from the created_at date field.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":50,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_521036a8","line":53,"in_reply_to":"5a890539_10722f11","updated":"2014-11-20 23:13:14.000000000","message":"Yes, I would think that how an implementation determines what format the `expires_at` is up to them. For example, I might represent `expires_at` as a timestamp integer because I know that will give be better compression than a string.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` can be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_70129363","line":54,"updated":"2014-11-20 21:35:33.000000000","message":"\"can be stored\"\n\nSo the exact representation of the information pre-encryption is left to the implementation?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` can be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_32d2cad2","line":54,"in_reply_to":"5a890539_70129363","updated":"2014-11-20 23:13:14.000000000","message":"Are you suggesting that this should be locked down more?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` can be"},{"line_number":58,"context_line":"HMAC signed. The resulting digest will be tacked on to the ``payload`` and"},{"line_number":59,"context_line":"will be used to verify the contents of the payload. This is important"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_4b3a4699","line":56,"updated":"2014-11-20 21:35:33.000000000","message":"\"can be packed, encrypted, and encoded\"\n\nSo one, all, or none of these things can be done by an implementation and still meet the spec?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` can be"},{"line_number":58,"context_line":"HMAC signed. The resulting digest will be tacked on to the ``payload`` and"},{"line_number":59,"context_line":"will be used to verify the contents of the payload. This is important"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_52ecb68f","line":56,"in_reply_to":"5a890539_4b3a4699","updated":"2014-11-20 23:13:14.000000000","message":"Similar to the above, right? \n\nAre you suggesting that \u0027can\u0027 be substituted with \u0027should\u0027?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` can be"},{"line_number":58,"context_line":"HMAC signed. The resulting digest will be tacked on to the ``payload`` and"},{"line_number":59,"context_line":"will be used to verify the contents of the payload. This is important"},{"line_number":60,"context_line":"because we can fast fail if the token has been tampered with in any way"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_0ba83e76","line":57,"updated":"2014-11-20 21:35:33.000000000","message":"\"can be HMAC signed\"\n\nSo HMAC is not required per the spec? \n\nAlso, I\u0027d suggest that we generate a MAC of not just the payload (which is previously described as just the protected data such as user_id, creation_date, etc), but include other data for which integrity may be important such as the AE token version. Assuming an encryption algorithm is used which requires a random IV, this has to be included in the token and would make sense to protect its integrity with the MAC.\n\nUltimately the question then, is what provisions should the spec include to allow implementors flexibility in choosing what is included in the MAC?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` can be"},{"line_number":58,"context_line":"HMAC signed. The resulting digest will be tacked on to the ``payload`` and"},{"line_number":59,"context_line":"will be used to verify the contents of the payload. This is important"},{"line_number":60,"context_line":"because we can fast fail if the token has been tampered with in any way"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_b2931af9","line":57,"in_reply_to":"5a890539_0ba83e76","updated":"2014-11-20 23:13:14.000000000","message":"Done","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` can be"},{"line_number":58,"context_line":"HMAC signed. The resulting digest will be tacked on to the ``payload`` and"},{"line_number":59,"context_line":"will be used to verify the contents of the payload. This is important"},{"line_number":60,"context_line":"because we can fast fail if the token has been tampered with in any way"},{"line_number":61,"context_line":"without having to attempt decrypting the spoofed token only to fail on bogus"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_4b07a681","line":58,"updated":"2014-11-20 21:35:33.000000000","message":"The digest isn\u0027t being tacked on to the payload, but just included in the token, per later in the spec.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` can be"},{"line_number":58,"context_line":"HMAC signed. The resulting digest will be tacked on to the ``payload`` and"},{"line_number":59,"context_line":"will be used to verify the contents of the payload. This is important"},{"line_number":60,"context_line":"because we can fast fail if the token has been tampered with in any way"},{"line_number":61,"context_line":"without having to attempt decrypting the spoofed token only to fail on bogus"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_725e1247","line":58,"in_reply_to":"5a890539_4b07a681","updated":"2014-11-20 23:13:14.000000000","message":"Done","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":64,"context_line":"Finally, the tokens will be a concatenation of the following:"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d token_prefix + ae_token_version + digest + payload"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_0bc3de57","line":67,"updated":"2014-11-20 21:35:33.000000000","message":"I assume \"payload\" in this context is actually the ciphertext generated from encrypting the plaintext payload? Perhaps delineate this by using \"encrypt(payload)\" instead?\n\n\"will be a concatenation of\"\n\nDoes this mean the exact order of the data comprising the token is being prescribed by the spec? For example, the digest MUST be concatenated BEFORE the encrypted payload?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":64,"context_line":"Finally, the tokens will be a concatenation of the following:"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d token_prefix + ae_token_version + digest + payload"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_b2587a57","line":67,"in_reply_to":"5a890539_0bc3de57","updated":"2014-11-20 23:13:14.000000000","message":"good point, done.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":78,"context_line":"The token would result in::"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  \u003e\u003e\u003e print token"},{"line_number":81,"context_line":"  \u003e\u003e\u003e \u0027AE1sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":84,"context_line":"validation, this character can be popped off the token to determine the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_6ccab750","line":81,"updated":"2014-11-20 21:35:33.000000000","message":"While the spec doesn\u0027t appear to explicitly state this, per your example, it appears you\u0027re only Base64 encoding the ciphertext. \n\nWhile this is implementation specific, would suggest encoding the whole token after all the concatenation is performed. Then don\u0027t have to worry about ensuring each individual part is \"web safe\" and have more flexibility as to the actual values stored in the fields.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9b04ca3b5d61de3f471fb29edce7d27f64515e5e","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  \u003e\u003e\u003e print token"},{"line_number":81,"context_line":"  \u003e\u003e\u003e \u0027AE1sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":84,"context_line":"validation, this character can be popped off the token to determine the"},{"line_number":85,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":86,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_2f30f806","line":83,"updated":"2014-11-18 22:15:16.000000000","message":"first two characters to be safe, unless you really don\u0027t think we\u0027ll have more than 9 versions :)\n\nanyhow, lets not be too picky about implementation details at this point","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  \u003e\u003e\u003e print token"},{"line_number":81,"context_line":"  \u003e\u003e\u003e \u0027AE1sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":84,"context_line":"validation, this character can be popped off the token to determine the"},{"line_number":85,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":86,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_1d2a3f7e","line":83,"in_reply_to":"5a890539_2f30f806","updated":"2014-11-20 23:13:14.000000000","message":"Done","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":81,"context_line":"  \u003e\u003e\u003e \u0027AE1sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":84,"context_line":"validation, this character can be popped off the token to determine the"},{"line_number":85,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":86,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"},{"line_number":87,"context_line":"``payload`` can be passed to a token formatter that can properly"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_8caa83d0","line":84,"updated":"2014-11-20 21:35:33.000000000","message":"So am I understanding this right in that a \"token_prefix\" will be appended to all tokens (e.g. - PKI, UUID, etc) to allow distinguishing between the different token formats? \n\nIf so, does this mean a keystone implementation could support multiple token formats (e.g. UUID and AE and PKI) concurrently? \n\nHow does this impact existing UUID/PKI implementations? \n\nIs this requirement outlined in some higher left spec/blueprint discussing tokens in general?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":81,"context_line":"  \u003e\u003e\u003e \u0027AE1sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":84,"context_line":"validation, this character can be popped off the token to determine the"},{"line_number":85,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":86,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"},{"line_number":87,"context_line":"``payload`` can be passed to a token formatter that can properly"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_9d3c6fc1","line":84,"in_reply_to":"5a890539_8caa83d0","updated":"2014-11-20 23:13:14.000000000","message":"No, this is the `ae_token_version` not the token version in general.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":84,"context_line":"validation, this character can be popped off the token to determine the"},{"line_number":85,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":86,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"},{"line_number":87,"context_line":"``payload`` can be passed to a token formatter that can properly"},{"line_number":88,"context_line":"deconstruct the encrypted data and return the information. An example"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_6c95573f","line":85,"updated":"2014-11-20 21:35:33.000000000","message":"Under what circumstances would the \"ae_token_version\" be modified? Is that left to implementors? Some various changes I could see happening over time:\n\n1. encryption algorithms change\n2. Hash algorithms change\n3. The encrypted data representation changes (e.g. - same overall data, just stored differently)\n4. Different data fields encrypted (e.g. - adding more data points)\n5. Compression mechanism changes (e.g. - version of msgpack, switching from msgpack to something else, etc)\n\nDo any backwards compatibility requirements need to be specified to allow tokens generated under the previous version to still be accepted?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The ``ae_token_version`` can always be the first character of the token. On"},{"line_number":84,"context_line":"validation, this character can be popped off the token to determine the"},{"line_number":85,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":86,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"},{"line_number":87,"context_line":"``payload`` can be passed to a token formatter that can properly"},{"line_number":88,"context_line":"deconstruct the encrypted data and return the information. An example"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_7ddd0370","line":85,"in_reply_to":"5a890539_6c95573f","updated":"2014-11-20 23:13:14.000000000","message":"I would consider the `ae_token_version` to be incremented as a result of a backward incompatible change.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":88,"context_line":"deconstruct the encrypted data and return the information. An example"},{"line_number":89,"context_line":"workflow can be seen in `POC"},{"line_number":90,"context_line":"\u003chttps://gist.github.com/lbragstad/a0b30f15b92798df6141\u003e`_, and generate"},{"line_number":91,"context_line":"`output \u003chttps://gist.github.com/lbragstad/5381c639a3a4e17e1124\u003e`_ accordingly."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Given the above information in the token, the token size is around 165"},{"line_number":94,"context_line":"characters."}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_f06123d4","line":91,"updated":"2014-11-20 21:35:33.000000000","message":"This is specific to your example, but why do you replace the padding character \u0027\u003d\u0027 with \u0027.\u0027 in the Base64 encoded version? Why is this required over the \"URL and Filename Safe\" alphabet described at https://tools.ietf.org/html/rfc4648#page-7?\n\nI also don\u0027t see anywhere mentioning requirements for the encoding of the token. Should a specific encoding standard be specified or is that open to implementors to choose?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":88,"context_line":"deconstruct the encrypted data and return the information. An example"},{"line_number":89,"context_line":"workflow can be seen in `POC"},{"line_number":90,"context_line":"\u003chttps://gist.github.com/lbragstad/a0b30f15b92798df6141\u003e`_, and generate"},{"line_number":91,"context_line":"`output \u003chttps://gist.github.com/lbragstad/5381c639a3a4e17e1124\u003e`_ accordingly."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Given the above information in the token, the token size is around 165"},{"line_number":94,"context_line":"characters."}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_bd6ccb9d","line":91,"in_reply_to":"5a890539_f06123d4","updated":"2014-11-20 23:13:14.000000000","message":"My example uses some work that was previously done by another Keystone team member, in which I would have to defer to his explanation.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":100,"context_line":"token backend."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":103,"context_line":"identity. The encrypted data will result in the user\u0027s token. The workflow"},{"line_number":104,"context_line":"for the user doesn\u0027t change from the current workflow. The token size will"},{"line_number":105,"context_line":"be bigger than UUID tokens but not at big as a PKI tokens."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_46507d0a","line":103,"updated":"2014-11-20 21:35:33.000000000","message":"\"will result in\" -\u003e \"will be included in\"?","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":100,"context_line":"token backend."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":103,"context_line":"identity. The encrypted data will result in the user\u0027s token. The workflow"},{"line_number":104,"context_line":"for the user doesn\u0027t change from the current workflow. The token size will"},{"line_number":105,"context_line":"be bigger than UUID tokens but not at big as a PKI tokens."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_3d27fb65","line":103,"in_reply_to":"5a890539_46507d0a","updated":"2014-11-20 23:13:14.000000000","message":"good catch, thanks.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":114,"context_line":"user sends the now revoked token to Keystone, the validate call will check"},{"line_number":115,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":116,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":117,"context_line":"rules can be cleaned up anytime after the default token expiration time."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Alternatives"},{"line_number":120,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_667c9973","line":117,"updated":"2014-11-20 21:35:33.000000000","message":"The deletion of the revocation rule likely depends on when the rule was created. Perhaps reword this to:\n\n\"A given revocation rule can be cleaned up anytime after the default token expiration time has lapsed since the revocation rule was created.\"","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":114,"context_line":"user sends the now revoked token to Keystone, the validate call will check"},{"line_number":115,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":116,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":117,"context_line":"rules can be cleaned up anytime after the default token expiration time."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Alternatives"},{"line_number":120,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_dd9a776d","line":117,"in_reply_to":"5a890539_667c9973","updated":"2014-11-20 23:13:14.000000000","message":"Done","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"30aa8f97715802a12bd370b74258d59ad0ee4a46","unresolved":false,"context_lines":[{"line_number":143,"context_line":"  Yes, when Keystone receives an authenticate request,"},{"line_number":144,"context_line":"  all information required to verify a user will have to be compressed and"},{"line_number":145,"context_line":"  encrypted, the result being the token."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  No"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_49a32d4f","line":146,"updated":"2014-11-20 21:35:33.000000000","message":"\"have to be compressed and encrypted\"\n\ncompression is required? No mention of hashing, even though that\u0027s explicitly called out in question.","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07730d06a32a97040b72c6768fc3ac2f0841a0bb","unresolved":false,"context_lines":[{"line_number":143,"context_line":"  Yes, when Keystone receives an authenticate request,"},{"line_number":144,"context_line":"  all information required to verify a user will have to be compressed and"},{"line_number":145,"context_line":"  encrypted, the result being the token."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  No"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_5824d5ae","line":146,"in_reply_to":"5a890539_49a32d4f","updated":"2014-11-20 23:13:14.000000000","message":"Done","commit_id":"b63767ab6000fa613cca38e55ce79b755c104940"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5961cc9e660d10ae95f76182a774d5798f5cb1a7","unresolved":false,"context_lines":[{"line_number":32,"context_line":"about the user out of the request, generate a token containing this data and"},{"line_number":33,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"},{"line_number":34,"context_line":"the information can be compressed. This is something that can be done using"},{"line_number":35,"context_line":"msgpack."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_3af9b3c8","line":35,"updated":"2014-11-21 09:41:06.000000000","message":"Please add reference.","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a699c4ed5a88bb23b18a7a38dac74e7f7542cc50","unresolved":false,"context_lines":[{"line_number":32,"context_line":"about the user out of the request, generate a token containing this data and"},{"line_number":33,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"},{"line_number":34,"context_line":"the information can be compressed. This is something that can be done using"},{"line_number":35,"context_line":"msgpack."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_b4504f0b","line":35,"in_reply_to":"5a890539_3af9b3c8","updated":"2014-11-21 14:46:57.000000000","message":"Done","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5961cc9e660d10ae95f76182a774d5798f5cb1a7","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_3a20d348","line":41,"updated":"2014-11-21 09:41:06.000000000","message":"forgot \u0027:\u0027 ?","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a699c4ed5a88bb23b18a7a38dac74e7f7542cc50","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_343c5fbf","line":41,"in_reply_to":"5a890539_3a20d348","updated":"2014-11-21 14:46:57.000000000","message":"Nice catch, thanks","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"52e6b4705d189db3ce92a39fdd27f1db7b028754","unresolved":false,"context_lines":[{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id``: ID representing the project of the user."},{"line_number":46,"context_line":"* ``created_at``: Timestamp representing the created at time of the token. By"},{"line_number":47,"context_line":"using timestamp we can save on space when packing the message by packing an int"},{"line_number":48,"context_line":"instead of a string."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_0821169f","line":45,"updated":"2014-11-21 02:53:16.000000000","message":"I assume for domain scoped token, this will be domain_id instead?","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a699c4ed5a88bb23b18a7a38dac74e7f7542cc50","unresolved":false,"context_lines":[{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id``: ID representing the project of the user."},{"line_number":46,"context_line":"* ``created_at``: Timestamp representing the created at time of the token. By"},{"line_number":47,"context_line":"using timestamp we can save on space when packing the message by packing an int"},{"line_number":48,"context_line":"instead of a string."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_54b9eb2c","line":45,"in_reply_to":"5a890539_0821169f","updated":"2014-11-21 14:46:57.000000000","message":"Done","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5961cc9e660d10ae95f76182a774d5798f5cb1a7","unresolved":false,"context_lines":[{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id``: ID representing the project of the user."},{"line_number":46,"context_line":"* ``created_at``: Timestamp representing the created at time of the token. By"},{"line_number":47,"context_line":"using timestamp we can save on space when packing the message by packing an int"},{"line_number":48,"context_line":"instead of a string."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_9a72a70f","line":45,"in_reply_to":"5a890539_0821169f","updated":"2014-11-21 09:41:06.000000000","message":"that\u0027s how i understood it too.","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a699c4ed5a88bb23b18a7a38dac74e7f7542cc50","unresolved":false,"context_lines":[{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id``: ID representing the project of the user."},{"line_number":46,"context_line":"* ``created_at``: Timestamp representing the created at time of the token. By"},{"line_number":47,"context_line":"using timestamp we can save on space when packing the message by packing an int"},{"line_number":48,"context_line":"instead of a string."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_34aa9fd2","line":45,"in_reply_to":"5a890539_9a72a70f","updated":"2014-11-21 14:46:57.000000000","message":"Done","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"52e6b4705d189db3ce92a39fdd27f1db7b028754","unresolved":false,"context_lines":[{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id``: ID representing the project of the user."},{"line_number":46,"context_line":"* ``created_at``: Timestamp representing the created at time of the token. By"},{"line_number":47,"context_line":"using timestamp we can save on space when packing the message by packing an int"},{"line_number":48,"context_line":"instead of a string."},{"line_number":49,"context_line":"* ``expires_at``: Timestamp representing the expiration of the token. This"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_e8292a8a","line":46,"updated":"2014-11-21 02:53:16.000000000","message":"Is this UTC timestamp?","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a699c4ed5a88bb23b18a7a38dac74e7f7542cc50","unresolved":false,"context_lines":[{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id``: ID representing the project of the user."},{"line_number":46,"context_line":"* ``created_at``: Timestamp representing the created at time of the token. By"},{"line_number":47,"context_line":"using timestamp we can save on space when packing the message by packing an int"},{"line_number":48,"context_line":"instead of a string."},{"line_number":49,"context_line":"* ``expires_at``: Timestamp representing the expiration of the token. This"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_94e9931c","line":46,"in_reply_to":"5a890539_e8292a8a","updated":"2014-11-21 14:46:57.000000000","message":"Yes","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"52e6b4705d189db3ce92a39fdd27f1db7b028754","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  \u003e\u003e\u003e print token"},{"line_number":81,"context_line":"  \u003e\u003e\u003e \u0027AE1sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The ``ae_token_version`` can always be the first two character of the token. On"},{"line_number":84,"context_line":"validation, these character can be popped off the token to determine the"},{"line_number":85,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":86,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_550c9b42","line":83,"updated":"2014-11-21 02:53:16.000000000","message":"I didn\u0027t quite get the explanation here. In the example, ae_token_version is the 3rd character.  Should it be the first 3 characters used to determine the token format? \n\nAlso, what if the version goes to 2-digits, how to pull the token format for that case?","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a699c4ed5a88bb23b18a7a38dac74e7f7542cc50","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  \u003e\u003e\u003e print token"},{"line_number":81,"context_line":"  \u003e\u003e\u003e \u0027AE1sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The ``ae_token_version`` can always be the first two character of the token. On"},{"line_number":84,"context_line":"validation, these character can be popped off the token to determine the"},{"line_number":85,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":86,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_94635319","line":83,"in_reply_to":"5a890539_550c9b42","updated":"2014-11-21 14:46:57.000000000","message":"Done","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"52e6b4705d189db3ce92a39fdd27f1db7b028754","unresolved":false,"context_lines":[{"line_number":94,"context_line":"characters."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"The user can then use this AE token to in a normal UUID workflow. When"},{"line_number":97,"context_line":"Keystone receives an AE token from a user or a service, it can validate the"},{"line_number":98,"context_line":"token by decrypting the token and verifying the information inside the token"},{"line_number":99,"context_line":". This doesn\u0027t require the AE token driver to look up any information from a"},{"line_number":100,"context_line":"token backend."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_f534a7fc","line":97,"updated":"2014-11-21 02:53:16.000000000","message":"doesn\u0027t keystone validate the digest first before decrypting?","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a699c4ed5a88bb23b18a7a38dac74e7f7542cc50","unresolved":false,"context_lines":[{"line_number":94,"context_line":"characters."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"The user can then use this AE token to in a normal UUID workflow. When"},{"line_number":97,"context_line":"Keystone receives an AE token from a user or a service, it can validate the"},{"line_number":98,"context_line":"token by decrypting the token and verifying the information inside the token"},{"line_number":99,"context_line":". This doesn\u0027t require the AE token driver to look up any information from a"},{"line_number":100,"context_line":"token backend."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_94d35337","line":97,"in_reply_to":"5a890539_f534a7fc","updated":"2014-11-21 14:46:57.000000000","message":"Yes, clarifying","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"52e6b4705d189db3ce92a39fdd27f1db7b028754","unresolved":false,"context_lines":[{"line_number":115,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":116,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":117,"context_line":"events can be cleaned up anytime after the default token expiration time has"},{"line_number":118,"context_line":"lapsed, since the recovation rule was created."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Alternatives"},{"line_number":121,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_b57cdfb6","line":118,"updated":"2014-11-21 02:53:16.000000000","message":"recovation -\u003e revocation","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a699c4ed5a88bb23b18a7a38dac74e7f7542cc50","unresolved":false,"context_lines":[{"line_number":115,"context_line":"the token information against the revocation rules and if a revocation rule"},{"line_number":116,"context_line":"matches the information decrypted from the token, return 401. Revocation"},{"line_number":117,"context_line":"events can be cleaned up anytime after the default token expiration time has"},{"line_number":118,"context_line":"lapsed, since the recovation rule was created."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Alternatives"},{"line_number":121,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a890539_54c48b3f","line":118,"in_reply_to":"5a890539_b57cdfb6","updated":"2014-11-21 14:46:57.000000000","message":"Done","commit_id":"5157d220d531fd971592085847fc38bb26b67cb4"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"faee0f6898506a6c9c0ebdc76d7905f3e14d5d83","unresolved":false,"context_lines":[{"line_number":90,"context_line":"  \u003e\u003e\u003e print token"},{"line_number":91,"context_line":"  \u003e\u003e\u003e \u0027AE01sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The ``ae_token_version`` can always be the first two character of the token. On"},{"line_number":94,"context_line":"validation, these character can be popped off the token to determine the"},{"line_number":95,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":96,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"}],"source_content_type":"text/x-rst","patch_set":12,"id":"5a890539_7a1ec00d","line":93,"updated":"2014-11-21 23:58:33.000000000","message":"ae_token_version is actually 3rd and 4th character of the token, should this be referring to token_prefix instead?","commit_id":"96472f6707988cc28fca4291cbda5c81919adc6c"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3ab681643dcceddf25d25fd82bd819e0a0e72623","unresolved":false,"context_lines":[{"line_number":90,"context_line":"  \u003e\u003e\u003e print token"},{"line_number":91,"context_line":"  \u003e\u003e\u003e \u0027AE01sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The ``ae_token_version`` can always be the first two character of the token. On"},{"line_number":94,"context_line":"validation, these character can be popped off the token to determine the"},{"line_number":95,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":96,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"}],"source_content_type":"text/x-rst","patch_set":12,"id":"5a890539_f9a2acac","line":93,"in_reply_to":"5a890539_7a1ec00d","updated":"2014-11-24 07:51:49.000000000","message":"++","commit_id":"96472f6707988cc28fca4291cbda5c81919adc6c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"afbe61feb84d40068b8aa1bfcfebf02835842674","unresolved":false,"context_lines":[{"line_number":90,"context_line":"  \u003e\u003e\u003e print token"},{"line_number":91,"context_line":"  \u003e\u003e\u003e \u0027AE01sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The ``ae_token_version`` can always be the first two character of the token. On"},{"line_number":94,"context_line":"validation, these character can be popped off the token to determine the"},{"line_number":95,"context_line":"format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":96,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"}],"source_content_type":"text/x-rst","patch_set":12,"id":"5a890539_03c29952","line":93,"in_reply_to":"5a890539_f9a2acac","updated":"2014-11-24 14:35:43.000000000","message":"Done","commit_id":"96472f6707988cc28fca4291cbda5c81919adc6c"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"00c7e9bcc49b979b3e2dc65af271804b45ac3539","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Finally, the tokens will be a concatenation of the following, but not limited"},{"line_number":64,"context_line":"to the order of the following example::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d token_prefix + ae_token_version + digest + encrypt(payload)"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"}],"source_content_type":"text/x-rst","patch_set":13,"id":"5a890539_073ff3b4","line":66,"updated":"2014-11-25 00:45:13.000000000","message":"we had a request at summit to please not encrypt anything that isn\u0027t sensitive data. As far as i can tell (given that any attacker would need to hold the token) there isn\u0027t anything sensitive about this?\n\nThe only exception i can see is possibly on expired tokens (which keystone won\u0027t validate) maybe audit_id shouldn\u0027t be determinable? - but i\u0027m clutching at straws.","commit_id":"49e83ab37956c4f2a545c326eff793d1027a61ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"32af63726b155411d9f8e69dec830b0d81d90b07","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Finally, the tokens will be a concatenation of the following, but not limited"},{"line_number":64,"context_line":"to the order of the following example::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d token_prefix + ae_token_version + digest + encrypt(payload)"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"}],"source_content_type":"text/x-rst","patch_set":13,"id":"5a890539_4985ed05","line":66,"in_reply_to":"5a890539_073ff3b4","updated":"2014-12-01 17:36:17.000000000","message":"We could make the encryption configurable and opt-in for the encrypted part?","commit_id":"49e83ab37956c4f2a545c326eff793d1027a61ac"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"80b992de8d810d272b7ef9af8aeac999ee97e65e","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"The following represents the above token in length of characters::"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  token \u003d [02] + [02] + [28] + [+]"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Where the ``token_prefix`` is two characters (``AE``), the ``ae_token_version``"},{"line_number":83,"context_line":"is two characters (``01`` or ``15``). Since the rest of the format is read in"}],"source_content_type":"text/x-rst","patch_set":13,"id":"5a890539_a7061f1a","line":80,"updated":"2014-11-25 00:41:47.000000000","message":"are we saying the digest here will always be 28 characters? Looking at your demo you\u0027ve required this length which essentially says that this format will only work with SHA1 which we are still in the process of trying to move away from.\n\nWhy don\u0027t we msgpack the outer token (token[4:]) as well? or make the components comma seperated or something? \n\nthe msgpack library dependency will still only be keystone server side but you can easily figure out the break between digest and payload and whatever you are thinking might be added in future. Whether we should indicate hash algo or leave that as a server side config i don\u0027t mind.","commit_id":"49e83ab37956c4f2a545c326eff793d1027a61ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"32af63726b155411d9f8e69dec830b0d81d90b07","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"The following represents the above token in length of characters::"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  token \u003d [02] + [02] + [28] + [+]"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Where the ``token_prefix`` is two characters (``AE``), the ``ae_token_version``"},{"line_number":83,"context_line":"is two characters (``01`` or ``15``). Since the rest of the format is read in"}],"source_content_type":"text/x-rst","patch_set":13,"id":"5a890539_a91f31b6","line":80,"in_reply_to":"5a890539_a7061f1a","updated":"2014-12-01 17:36:17.000000000","message":"We could msgpack the whole thing. We could also have a mapping for the digest depending on how the message is signed. For each algorithm that is an option, we could set a digest length. For example, *if* I\u0027m using SHA1, then I expect my digest to be 28 characters long, etc. I can include this in the spec if we think it\u0027s worth noting, but I would think it\u0027s safe to assume there would be a mapping for each digest/algorithm if needed in the implementation.","commit_id":"49e83ab37956c4f2a545c326eff793d1027a61ac"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"269f0016b85ec31afd8c6bc8e71ac2f36ebe555e","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_803e92b6","line":39,"updated":"2014-12-02 23:13:33.000000000","message":"Having JSON here will give you flexibility down the road. There are optional stuff like constraints that we currently don\u0027t persist.","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"269f0016b85ec31afd8c6bc8e71ac2f36ebe555e","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."},{"line_number":46,"context_line":"* ``created_at``: UTC timestamp representing the created at time of the token."}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_a05e2e11","line":43,"updated":"2014-12-02 23:13:33.000000000","message":"We don\u0027t have service scoped token at the moment.","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0f0b993ddf84d11b606aa3cbb9cb3ab332bb3ad1","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."},{"line_number":46,"context_line":"* ``created_at``: UTC timestamp representing the created at time of the token."}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_7632f45e","line":43,"in_reply_to":"5a890539_a05e2e11","updated":"2014-12-04 20:30:48.000000000","message":"correct, just making the point that at some point in the future we may need to distinguish between token types and this would be one way of doing that.","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"269f0016b85ec31afd8c6bc8e71ac2f36ebe555e","unresolved":false,"context_lines":[{"line_number":49,"context_line":"* ``expires_at``: UTC timestamp representing the expiration of the token. This"},{"line_number":50,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver, or any"},{"line_number":55,"context_line":"validator for that matter, knows the order of the values. The above values can"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_407e6a6b","line":52,"updated":"2014-12-02 23:13:33.000000000","message":"* \u0027\u0027method\u0027\u0027: The manner in which the token is obtained.","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0f0b993ddf84d11b606aa3cbb9cb3ab332bb3ad1","unresolved":false,"context_lines":[{"line_number":49,"context_line":"* ``expires_at``: UTC timestamp representing the expiration of the token. This"},{"line_number":50,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver, or any"},{"line_number":55,"context_line":"validator for that matter, knows the order of the values. The above values can"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_768034bf","line":52,"in_reply_to":"5a890539_407e6a6b","updated":"2014-12-04 20:30:48.000000000","message":"Done","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"6078542cfa8d5ad7431f9df2b628ed51c71bccd3","unresolved":false,"context_lines":[{"line_number":58,"context_line":"We can have the token encryption be an opt-in section of this feature. This"},{"line_number":59,"context_line":"will result in a ``payload``. To ensure the integrity of the contents, the"},{"line_number":60,"context_line":"``payload`` should be HMAC signed. The resulting digest will be included as"},{"line_number":61,"context_line":"part of the token. This is important because we should fast fail if the token"},{"line_number":62,"context_line":"has been tampered with in any way without having to attempt decrypting the"},{"line_number":63,"context_line":"spoofed token only to fail on bogus token values."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_4f8f5fcd","line":61,"updated":"2014-12-03 15:10:46.000000000","message":"as a part\nI\u0027m not sure, may be \"fail fast\"?","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0f0b993ddf84d11b606aa3cbb9cb3ab332bb3ad1","unresolved":false,"context_lines":[{"line_number":58,"context_line":"We can have the token encryption be an opt-in section of this feature. This"},{"line_number":59,"context_line":"will result in a ``payload``. To ensure the integrity of the contents, the"},{"line_number":60,"context_line":"``payload`` should be HMAC signed. The resulting digest will be included as"},{"line_number":61,"context_line":"part of the token. This is important because we should fast fail if the token"},{"line_number":62,"context_line":"has been tampered with in any way without having to attempt decrypting the"},{"line_number":63,"context_line":"spoofed token only to fail on bogus token values."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_166ff028","line":61,"in_reply_to":"5a890539_4f8f5fcd","updated":"2014-12-04 20:30:48.000000000","message":"Done","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"269f0016b85ec31afd8c6bc8e71ac2f36ebe555e","unresolved":false,"context_lines":[{"line_number":70,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":71,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":74,"context_line":"  ae_token_version \u003d \u00271\u0027"},{"line_number":75,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":76,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_603a86ce","line":73,"updated":"2014-12-02 23:13:33.000000000","message":"You may want your prefix to clearly distinguish between HMAC and encrypt(HMAC). For example\n\ntoken_prefix \u003d \u0027A\u0027 | \u0027AE\u0027\n\nwhere \u0027A\u0027 means authenticated and \u0027E\u0027 means encrypted","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0f0b993ddf84d11b606aa3cbb9cb3ab332bb3ad1","unresolved":false,"context_lines":[{"line_number":70,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":71,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":74,"context_line":"  ae_token_version \u003d \u00271\u0027"},{"line_number":75,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":76,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_76b3d499","line":73,"in_reply_to":"5a890539_603a86ce","updated":"2014-12-04 20:30:48.000000000","message":"Done","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"269f0016b85ec31afd8c6bc8e71ac2f36ebe555e","unresolved":false,"context_lines":[{"line_number":71,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":74,"context_line":"  ae_token_version \u003d \u00271\u0027"},{"line_number":75,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":76,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_4043ca12","line":74,"updated":"2014-12-02 23:13:33.000000000","message":"ae_token_version \u003d \u002701\u0027\n\nthe length should be fixed right?","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0f0b993ddf84d11b606aa3cbb9cb3ab332bb3ad1","unresolved":false,"context_lines":[{"line_number":71,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":74,"context_line":"  ae_token_version \u003d \u00271\u0027"},{"line_number":75,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":76,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_b6b0dc8b","line":74,"in_reply_to":"5a890539_4043ca12","updated":"2014-12-04 20:30:48.000000000","message":"Done, correct. Good catch.","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"6078542cfa8d5ad7431f9df2b628ed51c71bccd3","unresolved":false,"context_lines":[{"line_number":93,"context_line":"  \u003e\u003e\u003e \u0027AE01sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"The ``ae_token_version`` can always be the third and fourth characters of the"},{"line_number":96,"context_line":"token.  On validation, these character can be popped off the token to determine"},{"line_number":97,"context_line":"the format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":98,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"},{"line_number":99,"context_line":"``payload`` can be passed to a token formatter that can properly"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_b2790c95","line":96,"updated":"2014-12-03 15:10:46.000000000","message":"these characters","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0f0b993ddf84d11b606aa3cbb9cb3ab332bb3ad1","unresolved":false,"context_lines":[{"line_number":93,"context_line":"  \u003e\u003e\u003e \u0027AE01sYnCFfb9jGhwnYP/+Zwn071IKCI\u003dZ-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"The ``ae_token_version`` can always be the third and fourth characters of the"},{"line_number":96,"context_line":"token.  On validation, these character can be popped off the token to determine"},{"line_number":97,"context_line":"the format of the token. The ``digest`` (around ~28 characters) can be used to"},{"line_number":98,"context_line":"verify the ``payload`` hasn\u0027t been tampered with. At this point, the"},{"line_number":99,"context_line":"``payload`` can be passed to a token formatter that can properly"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a890539_f6a6e452","line":96,"in_reply_to":"5a890539_b2790c95","updated":"2014-12-04 20:30:48.000000000","message":"Done","commit_id":"a648cc51d5e3a6e1497ad3263485ab667a64e1d1"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"de889812cf1f0afc9943bb7a95cd8d19495b27a8","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":16,"id":"5a890539_5a419261","line":39,"updated":"2014-12-05 02:17:33.000000000","message":"Are  we assuming the token is valid for all roles the user has for the project?  How are we going to specify trusts or oauth delegations?","commit_id":"45d13ed18af8a47e7b2edbe4e8e22a6279bf9f98"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a7c23978a5ee7f3a84fac59e6966dd2275dca169","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":16,"id":"5a890539_bbea6972","line":39,"in_reply_to":"5a890539_5a419261","updated":"2014-12-05 13:04:40.000000000","message":"trust or oauth delegations can be something we know how to unpack using the auth_type or by having a version that maps to a type. Token version 05, for example, could be a token type for a trust that would include the assigner, assignee, scope, and project id.","commit_id":"45d13ed18af8a47e7b2edbe4e8e22a6279bf9f98"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"de889812cf1f0afc9943bb7a95cd8d19495b27a8","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Finally, the tokens will be a concatenation of the following, but not limited"},{"line_number":67,"context_line":"to the order of the following example::"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  token \u003d token_prefix + ae_token_version + digest + encrypt(payload)"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":72,"context_line":"token is sum of different parts of information. Example is as follows::"}],"source_content_type":"text/x-rst","patch_set":16,"id":"5a890539_daa66253","line":69,"updated":"2014-12-05 02:17:33.000000000","message":"the digest and the encrypted payload are going to bleed into each other.  Either we need a length or a field seperator.","commit_id":"45d13ed18af8a47e7b2edbe4e8e22a6279bf9f98"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a7c23978a5ee7f3a84fac59e6966dd2275dca169","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Finally, the tokens will be a concatenation of the following, but not limited"},{"line_number":67,"context_line":"to the order of the following example::"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  token \u003d token_prefix + ae_token_version + digest + encrypt(payload)"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":72,"context_line":"token is sum of different parts of information. Example is as follows::"}],"source_content_type":"text/x-rst","patch_set":16,"id":"5a890539_bb5c297f","line":69,"in_reply_to":"5a890539_daa66253","updated":"2014-12-05 13:04:40.000000000","message":"yes, that is laid out in an example on line 83.","commit_id":"45d13ed18af8a47e7b2edbe4e8e22a6279bf9f98"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"c750402472e198a7424b4a67c6acc82b550b66b9","unresolved":false,"context_lines":[{"line_number":113,"context_line":"Given the above information in the token, the token size is around 165"},{"line_number":114,"context_line":"characters."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"The user can then use this AE token to in a normal UUID workflow. When"},{"line_number":117,"context_line":"Keystone receives an AE token from a user or a service, it can validate the"},{"line_number":118,"context_line":"digest to determine if the token has been tampered with in transit before"},{"line_number":119,"context_line":"decrypting the rest of the token and validating the decrypted information in"}],"source_content_type":"text/x-rst","patch_set":17,"id":"5a890539_1df368e8","line":116,"updated":"2014-12-05 17:40:46.000000000","message":"s/to //","commit_id":"e9ca480427621a57d436719341d6f22aef7a742d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fdcc09fb027aa8f94a905b35ebf79b8a3f1efd60","unresolved":false,"context_lines":[{"line_number":113,"context_line":"Given the above information in the token, the token size is around 165"},{"line_number":114,"context_line":"characters."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"The user can then use this AE token to in a normal UUID workflow. When"},{"line_number":117,"context_line":"Keystone receives an AE token from a user or a service, it can validate the"},{"line_number":118,"context_line":"digest to determine if the token has been tampered with in transit before"},{"line_number":119,"context_line":"decrypting the rest of the token and validating the decrypted information in"}],"source_content_type":"text/x-rst","patch_set":17,"id":"5a890539_11151049","line":116,"in_reply_to":"5a890539_1df368e8","updated":"2014-12-05 21:50:53.000000000","message":"Done","commit_id":"e9ca480427621a57d436719341d6f22aef7a742d"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"c750402472e198a7424b4a67c6acc82b550b66b9","unresolved":false,"context_lines":[{"line_number":116,"context_line":"The user can then use this AE token to in a normal UUID workflow. When"},{"line_number":117,"context_line":"Keystone receives an AE token from a user or a service, it can validate the"},{"line_number":118,"context_line":"digest to determine if the token has been tampered with in transit before"},{"line_number":119,"context_line":"decrypting the rest of the token and validating the decrypted information in"},{"line_number":120,"context_line":"the token. This doesn\u0027t require the AE token driver to look up any information"},{"line_number":121,"context_line":"from a token backend. The information traditionally stored in the token"},{"line_number":122,"context_line":"backend, like the service catalog, will be computed dynamically based on the"}],"source_content_type":"text/x-rst","patch_set":17,"id":"5a890539_7d29cc39","line":119,"updated":"2014-12-05 17:40:46.000000000","message":"s/validating/validate/","commit_id":"e9ca480427621a57d436719341d6f22aef7a742d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fdcc09fb027aa8f94a905b35ebf79b8a3f1efd60","unresolved":false,"context_lines":[{"line_number":116,"context_line":"The user can then use this AE token to in a normal UUID workflow. When"},{"line_number":117,"context_line":"Keystone receives an AE token from a user or a service, it can validate the"},{"line_number":118,"context_line":"digest to determine if the token has been tampered with in transit before"},{"line_number":119,"context_line":"decrypting the rest of the token and validating the decrypted information in"},{"line_number":120,"context_line":"the token. This doesn\u0027t require the AE token driver to look up any information"},{"line_number":121,"context_line":"from a token backend. The information traditionally stored in the token"},{"line_number":122,"context_line":"backend, like the service catalog, will be computed dynamically based on the"}],"source_content_type":"text/x-rst","patch_set":17,"id":"5a890539_5106b822","line":119,"in_reply_to":"5a890539_7d29cc39","updated":"2014-12-05 21:50:53.000000000","message":"Done","commit_id":"e9ca480427621a57d436719341d6f22aef7a742d"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"c750402472e198a7424b4a67c6acc82b550b66b9","unresolved":false,"context_lines":[{"line_number":195,"context_line":"  of this include launching subprocesses for each connection, or entity"},{"line_number":196,"context_line":"  expansion attacks in XML."},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"  Yes, given enough authentication requests with respect to the size of the"},{"line_number":199,"context_line":"  API nodes. The argument could be made that the point at which resource"},{"line_number":200,"context_line":"  exhaustion happens from AE tokens would be greater than the current"},{"line_number":201,"context_line":"  implementation being able to read token data from the token backend given"}],"source_content_type":"text/x-rst","patch_set":17,"id":"5a890539_3d1744f0","line":198,"updated":"2014-12-05 17:40:46.000000000","message":"There should be a key rotating mechanism in place for AE tokens to be secure.  I would suggest looking into keyczar http://www.keyczar.org/","commit_id":"e9ca480427621a57d436719341d6f22aef7a742d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fdcc09fb027aa8f94a905b35ebf79b8a3f1efd60","unresolved":false,"context_lines":[{"line_number":195,"context_line":"  of this include launching subprocesses for each connection, or entity"},{"line_number":196,"context_line":"  expansion attacks in XML."},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"  Yes, given enough authentication requests with respect to the size of the"},{"line_number":199,"context_line":"  API nodes. The argument could be made that the point at which resource"},{"line_number":200,"context_line":"  exhaustion happens from AE tokens would be greater than the current"},{"line_number":201,"context_line":"  implementation being able to read token data from the token backend given"}],"source_content_type":"text/x-rst","patch_set":17,"id":"5a890539_000db4e8","line":198,"in_reply_to":"5a890539_3d1744f0","updated":"2014-12-05 21:50:53.000000000","message":"Done","commit_id":"e9ca480427621a57d436719341d6f22aef7a742d"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"64e7f8cc857a19029d16710f9cc27257f7573822","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."}],"source_content_type":"text/x-rst","patch_set":20,"id":"3a961159_45499bcf","line":42,"updated":"2014-12-08 16:31:04.000000000","message":"(nit) My ReText does not think this is a list without spaces before asterisks and corresponding indentation of multilines.\nNot sure about Sphinx though.\n\n * ``auth_type``: Authentication type to determine the type of the token\n   (i.e. domain scoped token, service scoped token, trust scoped token, etc)\n * ``user_id``: ID representing the user creating the token.\n * ``project_id`` or ``domain_id``: ID representing the scope of the user.\n * ``created_at``: UTC timestamp representing the created at time of the token.\n   By using timestamp we can save on space when packing the message by packing an\n   integer instead of a string.\n * ``expires_at``: UTC timestamp representing the expiration of the token. This\n   can be represented different ways and also using an integer to store the\n   timestamp instead of a string.\n * ``audit_id``: The audit ID for the token.\n * ``method``: The manner in which the token is obtained","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a4d91c2d617df083003f569d4b1d944d6c58c470","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."}],"source_content_type":"text/x-rst","patch_set":20,"id":"3a961159_46f6efd8","line":42,"in_reply_to":"3a961159_45499bcf","updated":"2014-12-08 21:55:40.000000000","message":"Done","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"64e7f8cc857a19029d16710f9cc27257f7573822","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"The ``token_prefix`` for ``AE`` could be specified further to be more"},{"line_number":92,"context_line":"descriptive. If the token isn\u0027t actually encrypted, the prefix could consist of"},{"line_number":93,"context_line":"just ``0A`` or ``A``, representing authenticated, where as ``AE`` would be"},{"line_number":94,"context_line":"authenticated encrypted. Since there would be a difference in the two, this"},{"line_number":95,"context_line":"shows that we can represent that difference if a deployer chooses to not"},{"line_number":96,"context_line":"encrypt their tokens."}],"source_content_type":"text/x-rst","patch_set":20,"id":"3a961159_d62b7880","line":93,"updated":"2014-12-08 16:31:04.000000000","message":"0A - 2 bytes, A - 1 byte. Please correct this.","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a4d91c2d617df083003f569d4b1d944d6c58c470","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"The ``token_prefix`` for ``AE`` could be specified further to be more"},{"line_number":92,"context_line":"descriptive. If the token isn\u0027t actually encrypted, the prefix could consist of"},{"line_number":93,"context_line":"just ``0A`` or ``A``, representing authenticated, where as ``AE`` would be"},{"line_number":94,"context_line":"authenticated encrypted. Since there would be a difference in the two, this"},{"line_number":95,"context_line":"shows that we can represent that difference if a deployer chooses to not"},{"line_number":96,"context_line":"encrypt their tokens."}],"source_content_type":"text/x-rst","patch_set":20,"id":"3a961159_a62cf34b","line":93,"in_reply_to":"3a961159_d62b7880","updated":"2014-12-08 21:55:40.000000000","message":"Done","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"64e7f8cc857a19029d16710f9cc27257f7573822","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Token revocation can be handled through revocation events,"},{"line_number":133,"context_line":"which can be built of the existing revocation event system. When a user"},{"line_number":134,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":135,"context_line":"expression that will describe a token to revoke. An example being,"},{"line_number":136,"context_line":"revoke all tokens from user XYZ before this point in time. The next time the"},{"line_number":137,"context_line":"user sends the now revoked token to Keystone, the validate call will check"},{"line_number":138,"context_line":"the token information against the revocation rules and if a revocation rule"}],"source_content_type":"text/x-rst","patch_set":20,"id":"3a961159_56f6a8d8","line":135,"updated":"2014-12-08 16:31:04.000000000","message":"Some more detailed explanation would be nice here. It is a rule engine of some sort, and it has to be fast and both flexible.","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"227a43de156d0a020596340474523d560b7eb69e","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Token revocation can be handled through revocation events,"},{"line_number":133,"context_line":"which can be built of the existing revocation event system. When a user"},{"line_number":134,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":135,"context_line":"expression that will describe a token to revoke. An example being,"},{"line_number":136,"context_line":"revoke all tokens from user XYZ before this point in time. The next time the"},{"line_number":137,"context_line":"user sends the now revoked token to Keystone, the validate call will check"},{"line_number":138,"context_line":"the token information against the revocation rules and if a revocation rule"}],"source_content_type":"text/x-rst","patch_set":20,"id":"3a961159_8a2f03a1","line":135,"in_reply_to":"3a961159_56f6a8d8","updated":"2014-12-08 18:19:41.000000000","message":"it would be the same way as we check for revoked PKI tokens","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a4d91c2d617df083003f569d4b1d944d6c58c470","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Token revocation can be handled through revocation events,"},{"line_number":133,"context_line":"which can be built of the existing revocation event system. When a user"},{"line_number":134,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":135,"context_line":"expression that will describe a token to revoke. An example being,"},{"line_number":136,"context_line":"revoke all tokens from user XYZ before this point in time. The next time the"},{"line_number":137,"context_line":"user sends the now revoked token to Keystone, the validate call will check"},{"line_number":138,"context_line":"the token information against the revocation rules and if a revocation rule"}],"source_content_type":"text/x-rst","patch_set":20,"id":"3a961159_26200349","line":135,"in_reply_to":"3a961159_8a2f03a1","updated":"2014-12-08 21:55:40.000000000","message":"yep!","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"9593a7c8c9a4ffd04baa702f8a06b73766e28322","unresolved":false,"context_lines":[{"line_number":149,"context_line":"needs of that token type. This token type will be understood by Keystone from a"},{"line_number":150,"context_line":"token creation and validation perspective. An example of this would be having"},{"line_number":151,"context_line":"the ability to specify a particular role in a trusting relationship between the"},{"line_number":152,"context_line":"trustor and the trustee. This would allow for flexible delegation with an AE"},{"line_number":153,"context_line":"trust token."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"**Signing Key Details**"}],"source_content_type":"text/x-rst","patch_set":20,"id":"5a890539_5a69688b","line":152,"updated":"2014-12-06 02:50:11.000000000","message":"This will work for most of the case, but still I\u0027m not sure how is this ever going to work for federation.\n\nConsider this sample request\n\n{\n    \"token\": {\n        \"methods\": [\n            \"saml2\"\n        ],\n        \"user\": {\n            \"id\": \"username%40example.com\",\n            \"name\": \"username@example.com\",\n            \"OS-FEDERATION\": {\n                \"identity_provider\": \"ACME\",\n                \"protocol\": \"SAML\",\n                \"groups\": [\n                    {\"id\": \"abc123\"},\n                    {\"id\": \"bcd234\"}\n                ]\n            }\n        }\n    }\n}\n\nIf this has to be used in AE, then  payload should have had group_id.  If the payload is just  [field1, field2,field3,...) how do you even know which field is group_id?  In this case there are multiple group_ids.,Are you going to sort them before encrypting?\n\nIMO it is better to  have payload as \n   [ Name\u003dValue1, Name\u003dValue2 ]\ninstead of \n   [  value1, value2]","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a4d91c2d617df083003f569d4b1d944d6c58c470","unresolved":false,"context_lines":[{"line_number":149,"context_line":"needs of that token type. This token type will be understood by Keystone from a"},{"line_number":150,"context_line":"token creation and validation perspective. An example of this would be having"},{"line_number":151,"context_line":"the ability to specify a particular role in a trusting relationship between the"},{"line_number":152,"context_line":"trustor and the trustee. This would allow for flexible delegation with an AE"},{"line_number":153,"context_line":"trust token."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"**Signing Key Details**"}],"source_content_type":"text/x-rst","patch_set":20,"id":"3a961159_8673774c","line":152,"in_reply_to":"3a961159_0ab79387","updated":"2014-12-08 21:55:40.000000000","message":"Sure, you can have it that way. This was written with the local UUID case in mind where you wouldn\u0027t have that scenario, but there isn\u0027t anythings stopping you from having a format that creates and accepts: \n\n    {group_id: [\u003cfirst_group_id\u003e, \u003csecond_group_id\u003e]}\n\nThat format just has to be specified, and for federated tokens that would mean that they would be slightly bigger than the default case.\n\nThis case would be different than specifying user_id, role_id, and project_id in the token, since there would only be one of each. In that case we could chunk each off in size limits (ie the first 32 characters is the user\u0027s id, the next 32 is the project id, at the last 32 is the role, etc). If you want to do something with key value pairs you can use http://msgpack.org/ , which compresses json into a smaller format, which is what we would want in this case. Regardless, if we specify the format and keystone knows how to *create* the token format and what to do when it receives it back, we shouldn\u0027t have issues decoding what we created.\n\nYou can use msgpack for the whole thing if you want\n\n    payload \u003d {\u0027user_id\u0027: \u003cuser_id\u003e, \u0027project_id\u0027: \u003cproject_id\u003e, \u0027role_id\u0027: \u003crole_id\u003e}\n    packed_payload \u003d msgpack.packb(payload)\n\nbut that seems unnecessary when we can assert the value based on their order.\n\nhttp://pasteraw.com/bpyqd1caaruuu90apgdt4r7ovujayzf\n\nBut like I said, there isn\u0027t anything stopping us using something like that when we need to (ie. federation)","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"227a43de156d0a020596340474523d560b7eb69e","unresolved":false,"context_lines":[{"line_number":149,"context_line":"needs of that token type. This token type will be understood by Keystone from a"},{"line_number":150,"context_line":"token creation and validation perspective. An example of this would be having"},{"line_number":151,"context_line":"the ability to specify a particular role in a trusting relationship between the"},{"line_number":152,"context_line":"trustor and the trustee. This would allow for flexible delegation with an AE"},{"line_number":153,"context_line":"trust token."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"**Signing Key Details**"}],"source_content_type":"text/x-rst","patch_set":20,"id":"3a961159_0ab79387","line":152,"in_reply_to":"5a890539_5a69688b","updated":"2014-12-08 18:19:41.000000000","message":"good point. That why I suggest using JSON in the payload instead of a fixed set of IDs so its extensible. Otherwise, one option would be to keep bumping up the version number every time we add IDs, which does not seem ideal.","commit_id":"8c538b5ef5d646d01aa4cf06da4788aa0312249d"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"379836ba06952188a59f21c3bddadea77d7f60e7","unresolved":false,"context_lines":[{"line_number":29,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":30,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":31,"context_line":"the AE token driver will pull the absolute minimum amount of information"},{"line_number":32,"context_line":"about the user out of the request, generate a token containing this data and"},{"line_number":33,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"},{"line_number":34,"context_line":"the information can be compressed. This is something that can be done using"},{"line_number":35,"context_line":"`msgpack \u003chttp://msgpack.org/\u003e`_."}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_1fab2cd7","line":32,"updated":"2014-12-09 16:24:03.000000000","message":"user in the request,","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"994b56de54764490450797269cc06b850b06a6e9","unresolved":false,"context_lines":[{"line_number":29,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":30,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":31,"context_line":"the AE token driver will pull the absolute minimum amount of information"},{"line_number":32,"context_line":"about the user out of the request, generate a token containing this data and"},{"line_number":33,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"},{"line_number":34,"context_line":"the information can be compressed. This is something that can be done using"},{"line_number":35,"context_line":"`msgpack \u003chttp://msgpack.org/\u003e`_."}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_cbd298d1","line":32,"in_reply_to":"3a961159_1fab2cd7","updated":"2014-12-10 20:00:21.000000000","message":"Done","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"379836ba06952188a59f21c3bddadea77d7f60e7","unresolved":false,"context_lines":[{"line_number":154,"context_line":""},{"line_number":155,"context_line":"If the deployer decides to have the tokens signed, the keyCzar package can be"},{"line_number":156,"context_line":"used to do a lot of that work. This is important because if the token is"},{"line_number":157,"context_line":"signed, the keys used to do the signing should rotated to ensure token"},{"line_number":158,"context_line":"security."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"* Where are keys stored?"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_5f47744b","line":157,"updated":"2014-12-09 16:24:03.000000000","message":"should be rotated","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"994b56de54764490450797269cc06b850b06a6e9","unresolved":false,"context_lines":[{"line_number":154,"context_line":""},{"line_number":155,"context_line":"If the deployer decides to have the tokens signed, the keyCzar package can be"},{"line_number":156,"context_line":"used to do a lot of that work. This is important because if the token is"},{"line_number":157,"context_line":"signed, the keys used to do the signing should rotated to ensure token"},{"line_number":158,"context_line":"security."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"* Where are keys stored?"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_2bd79cc0","line":157,"in_reply_to":"3a961159_5f47744b","updated":"2014-12-10 20:00:21.000000000","message":"Done","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"379836ba06952188a59f21c3bddadea77d7f60e7","unresolved":false,"context_lines":[{"line_number":192,"context_line":"  so that when it gets the key back, it knows what key to use to decrypt the"},{"line_number":193,"context_line":"  information. The `digest` from the example above would be the equivalent of"},{"line_number":194,"context_line":"  this step, but it wouldn\u0027t be handled by Keystone if keyCzar was used. We"},{"line_number":195,"context_line":"  could also expect a couple different errors back if the token isn\u0027t"},{"line_number":196,"context_line":"  decrypted. The first would be if the checksum doesn\u0027t match the payload,"},{"line_number":197,"context_line":"  which means the token was tampered with and should result in a `401`, `403`,"},{"line_number":198,"context_line":"  etc. The other would be that the key used to encrypt no longer exists, which"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_9fbe3cd3","line":195,"updated":"2014-12-09 16:24:03.000000000","message":"token can\u0027t be decrypted","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"994b56de54764490450797269cc06b850b06a6e9","unresolved":false,"context_lines":[{"line_number":192,"context_line":"  so that when it gets the key back, it knows what key to use to decrypt the"},{"line_number":193,"context_line":"  information. The `digest` from the example above would be the equivalent of"},{"line_number":194,"context_line":"  this step, but it wouldn\u0027t be handled by Keystone if keyCzar was used. We"},{"line_number":195,"context_line":"  could also expect a couple different errors back if the token isn\u0027t"},{"line_number":196,"context_line":"  decrypted. The first would be if the checksum doesn\u0027t match the payload,"},{"line_number":197,"context_line":"  which means the token was tampered with and should result in a `401`, `403`,"},{"line_number":198,"context_line":"  etc. The other would be that the key used to encrypt no longer exists, which"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_ab99cc20","line":195,"in_reply_to":"3a961159_9fbe3cd3","updated":"2014-12-10 20:00:21.000000000","message":"Done","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"379836ba06952188a59f21c3bddadea77d7f60e7","unresolved":false,"context_lines":[{"line_number":209,"context_line":"  only used to decrypt data. Knowing that, a deployer can ensure a safe key"},{"line_number":210,"context_line":"  rotation practice by doing something similar to the following:"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"  1. Add one or more `active` keys to keyCzar via the command line tool"},{"line_number":213,"context_line":"  2. Set at least one key to be the `primary` key using the command line tool"},{"line_number":214,"context_line":"  3. After a key has been `primary` to a period of time, the deployer can set"},{"line_number":215,"context_line":"     to be `active`. This means the key will still be used to decrypt tokens if"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_9fe1dcd2","line":212,"updated":"2014-12-09 16:24:03.000000000","message":"It should be clear that new keys need to be added to all nodes before setting them to primary.  If Keystone assigns a key that isn\u0027t in place in another node it would not be able to decrypt it.","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"994b56de54764490450797269cc06b850b06a6e9","unresolved":false,"context_lines":[{"line_number":209,"context_line":"  only used to decrypt data. Knowing that, a deployer can ensure a safe key"},{"line_number":210,"context_line":"  rotation practice by doing something similar to the following:"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"  1. Add one or more `active` keys to keyCzar via the command line tool"},{"line_number":213,"context_line":"  2. Set at least one key to be the `primary` key using the command line tool"},{"line_number":214,"context_line":"  3. After a key has been `primary` to a period of time, the deployer can set"},{"line_number":215,"context_line":"     to be `active`. This means the key will still be used to decrypt tokens if"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_6ba60455","line":212,"in_reply_to":"3a961159_9fe1dcd2","updated":"2014-12-10 20:00:21.000000000","message":"Done","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"379836ba06952188a59f21c3bddadea77d7f60e7","unresolved":false,"context_lines":[{"line_number":258,"context_line":""},{"line_number":259,"context_line":"  The AE token will be built from data provided from the user. This doesn\u0027t"},{"line_number":260,"context_line":"  make Keystone vulnerable to injection attacks since the information used"},{"line_number":261,"context_line":"  will be pulled from a backing store."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":264,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_3ff3889f","line":261,"updated":"2014-12-09 16:24:03.000000000","message":"back-end store","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"994b56de54764490450797269cc06b850b06a6e9","unresolved":false,"context_lines":[{"line_number":258,"context_line":""},{"line_number":259,"context_line":"  The AE token will be built from data provided from the user. This doesn\u0027t"},{"line_number":260,"context_line":"  make Keystone vulnerable to injection attacks since the information used"},{"line_number":261,"context_line":"  will be pulled from a backing store."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":264,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3a961159_ab354cf8","line":261,"in_reply_to":"3a961159_3ff3889f","updated":"2014-12-10 20:00:21.000000000","message":"Done","commit_id":"afba33c37589ee36920e9b70cf852368eb588212"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f2743c6194ba8abfb6cf9fcd0646cdc2d58fde77","unresolved":false,"context_lines":[{"line_number":48,"context_line":"    packing an integer instead of a string."},{"line_number":49,"context_line":"  * ``expires_at``: UTC timestamp representing the expiration of the token."},{"line_number":50,"context_line":"    This can be represented different ways and also using an integer to store"},{"line_number":51,"context_line":"    the timestamp instead of a string.  * ``audit_id``: The audit ID for the"},{"line_number":52,"context_line":"    token.  * ``method``: The manner in which the token is obtained"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver, or any"}],"source_content_type":"text/x-rst","patch_set":22,"id":"3a961159_c4a8a922","line":51,"updated":"2014-12-11 15:18:01.000000000","message":"you may want to hit enter before * ``audit_id``","commit_id":"73bdf611b4c31dc1447a56601884164a7d023562"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4532f7719f006fb639c7f91777d40468acb8f8fa","unresolved":false,"context_lines":[{"line_number":48,"context_line":"    packing an integer instead of a string."},{"line_number":49,"context_line":"  * ``expires_at``: UTC timestamp representing the expiration of the token."},{"line_number":50,"context_line":"    This can be represented different ways and also using an integer to store"},{"line_number":51,"context_line":"    the timestamp instead of a string.  * ``audit_id``: The audit ID for the"},{"line_number":52,"context_line":"    token.  * ``method``: The manner in which the token is obtained"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver, or any"}],"source_content_type":"text/x-rst","patch_set":22,"id":"3a961159_fdd6f34d","line":51,"in_reply_to":"3a961159_c4a8a922","updated":"2014-12-12 14:12:27.000000000","message":"ah nice catch! Apparently my vim bindings don\u0027t do that for me \u003d)","commit_id":"73bdf611b4c31dc1447a56601884164a7d023562"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f2743c6194ba8abfb6cf9fcd0646cdc2d58fde77","unresolved":false,"context_lines":[{"line_number":49,"context_line":"  * ``expires_at``: UTC timestamp representing the expiration of the token."},{"line_number":50,"context_line":"    This can be represented different ways and also using an integer to store"},{"line_number":51,"context_line":"    the timestamp instead of a string.  * ``audit_id``: The audit ID for the"},{"line_number":52,"context_line":"    token.  * ``method``: The manner in which the token is obtained"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver, or any"},{"line_number":55,"context_line":"validator for that matter, knows the order of the values. The above values can"}],"source_content_type":"text/x-rst","patch_set":22,"id":"3a961159_6471b5df","line":52,"updated":"2014-12-11 15:18:01.000000000","message":"newline","commit_id":"73bdf611b4c31dc1447a56601884164a7d023562"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4532f7719f006fb639c7f91777d40468acb8f8fa","unresolved":false,"context_lines":[{"line_number":49,"context_line":"  * ``expires_at``: UTC timestamp representing the expiration of the token."},{"line_number":50,"context_line":"    This can be represented different ways and also using an integer to store"},{"line_number":51,"context_line":"    the timestamp instead of a string.  * ``audit_id``: The audit ID for the"},{"line_number":52,"context_line":"    token.  * ``method``: The manner in which the token is obtained"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver, or any"},{"line_number":55,"context_line":"validator for that matter, knows the order of the values. The above values can"}],"source_content_type":"text/x-rst","patch_set":22,"id":"3a961159_1dcadfa0","line":52,"in_reply_to":"3a961159_6471b5df","updated":"2014-12-12 14:12:27.000000000","message":"Done","commit_id":"73bdf611b4c31dc1447a56601884164a7d023562"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b7cb51195720f5aca53eb82719c836b1778d4847","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_68c99159","line":14,"updated":"2015-01-14 23:59:39.000000000","message":"tokens can already be non-persistent using PKI supposedly.","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"080722dfbb32fc5f610b55df9aec46b44b658217","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_4cb714d8","line":14,"in_reply_to":"3a961159_68c99159","updated":"2015-01-19 15:39:03.000000000","message":"After talking to Morgan, this work doesn\u0027t seem there quite yet. Morgan was in the process of working through the non-persistent stuff [1], but it says it\u0027s not done yet. \n\n[1] https://blueprints.launchpad.net/keystone/+spec/non-persistent-tokens","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b7cb51195720f5aca53eb82719c836b1778d4847","unresolved":false,"context_lines":[{"line_number":19,"context_line":"After having deployed Keystone for some time, deployers have run into issues"},{"line_number":20,"context_line":"with the amount of tokens stored in the token backend. To avoid this"},{"line_number":21,"context_line":"problem, deployers must routinely clean out stale tokens from their"},{"line_number":22,"context_line":"persistent storage to prevent performance or upgrade issues."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Proposed Change"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_88787d2c","line":22,"updated":"2015-01-14 23:59:39.000000000","message":"we seem to be replacing a minor problem for which we already have a solution with a solution that adds confusion and complication.","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"a6fbad3538107d0fe9fb75af9fbd50d0f359ba07","unresolved":false,"context_lines":[{"line_number":72,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":75,"context_line":"  ae_token_version \u003d \u002701\u0027"},{"line_number":76,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":77,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_ce709f42","line":75,"updated":"2014-12-12 15:44:07.000000000","message":"I think you should have both ae_token_version and ae_token_format.  ae_token_version would change based on the driver being used, and ae_token_format would be used for different tokens within the driver.\n\nThis would make it easier to implement ae token driver for a deployer that wants their own token format, and also allow for deployments of new releases where keystone needs to support the old token format and the new one at the same time.\n\nAlso include default ae token driver that specifies the token driver that is used to give out tokens.\n\nsample config:\n\n  [ae_token]\n  versions \u003d 01, 02\n  01 \u003d pkg.Driver1\n  02 \u003d pkg.Driver2\n  active_version \u003d 02","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a59dd79486729ca3f5d50a0e0f873c4f06636c7a","unresolved":false,"context_lines":[{"line_number":72,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":75,"context_line":"  ae_token_version \u003d \u002701\u0027"},{"line_number":76,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":77,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_ece719aa","line":75,"in_reply_to":"3a961159_0971b7a7","updated":"2014-12-12 20:50:26.000000000","message":"Isn\u0027t what token_prefix is for? That\u0027s how we migrate from UUID to PKI (and now back to UUID). Token lookup and validation logic tee off on the token prefix. We don\u0027t need anything more than that.\n\nKeystone auth_token middleware can validate multiple token formats today. UUID, PKI, and PKIZ.","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"6723077fafdf39d0d4f23944ca1a31fe4fd94c0b","unresolved":false,"context_lines":[{"line_number":72,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":75,"context_line":"  ae_token_version \u003d \u002701\u0027"},{"line_number":76,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":77,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_0971b7a7","line":75,"in_reply_to":"3a961159_94114154","updated":"2014-12-12 19:57:44.000000000","message":"You need to be able to support changes in the token format for new releases.  Normally you could run a migration against the backend since you are persisting the data.\n\nSince AE tokens are not persisted anywhere you cannot migrate them.  You need to be able to support tokens that where created before and after the change.\n\nThis is similar to what keyzcar does for changes.\n\nWhat alternative would you suggest to support a live migration token versions?","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b2d941dc0197ca09926fe636348f5e0821562faf","unresolved":false,"context_lines":[{"line_number":72,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":75,"context_line":"  ae_token_version \u003d \u002701\u0027"},{"line_number":76,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":77,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_6eb24b95","line":75,"in_reply_to":"3a961159_a08b501d","updated":"2014-12-22 17:33:09.000000000","message":"I was under the assumption that this would have been done in code. When a new version of an \u0027AE\u0027, the version of that token would correspond with a class that knows how to unpack that token.","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b3591be144e3f6b67ba81db9f418a5d0f3898dff","unresolved":false,"context_lines":[{"line_number":72,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":75,"context_line":"  ae_token_version \u003d \u002701\u0027"},{"line_number":76,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":77,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_a08b501d","line":75,"in_reply_to":"3a961159_b57ab085","updated":"2014-12-12 22:43:16.000000000","message":"If you are merely adding attributes to AE tokens you probably would need to bump the ae_token_version number. It still won\u0027t change the fact that its an AE token, which means the signature validation and encryption logic are exactly the same.\n\nBut yes, token validation logic would know what to do with it by looking at the prefix (and version if applicable).","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"eaf074acf66ec30b697face6dff5f5a48caeb3bd","unresolved":false,"context_lines":[{"line_number":72,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":75,"context_line":"  ae_token_version \u003d \u002701\u0027"},{"line_number":76,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":77,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_94114154","line":75,"in_reply_to":"3a961159_ce709f42","updated":"2014-12-12 17:22:02.000000000","message":"I disagree. For the current design, only one token driver is active at a time. There\u0027s no benefit of carrying extra configurations that are not being actively used.","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1683825a002a28239a49b3b8707952831b11dcc5","unresolved":false,"context_lines":[{"line_number":72,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":75,"context_line":"  ae_token_version \u003d \u002701\u0027"},{"line_number":76,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":77,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_b57ab085","line":75,"in_reply_to":"3a961159_ece719aa","updated":"2014-12-12 22:07:05.000000000","message":"Let me see If I understand correctly.\n\nAE tokens would be released with AE token_prefix for this release.  If the AE token adds additional attributes in the following release you would also change the prefix to some value that isn\u0027t AE (say AF?) and keystone would allow deploying both AE and AF token providers?","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"78e1afb05c0c3147b178a3b390e234b7ed77ae75","unresolved":false,"context_lines":[{"line_number":140,"context_line":"elapsed, since the revocation rule was created."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"In the event that more information is needed in the token, like federation, the"},{"line_number":143,"context_line":"existing AE token implementation could be extended to include extra values."},{"line_number":144,"context_line":"Another case where this would be useful is specifying token formats that"},{"line_number":145,"context_line":"require additional information, such as trust tokens, or an oauth token. If"},{"line_number":146,"context_line":"these token representations require additional information in the token to"}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_9284bcb3","line":143,"updated":"2015-01-19 10:59:52.000000000","message":"Looks like you are planning to tackle this problem in next few cycles, not now? \nI am still fearing AE tokens will not be flexible enough to handle all the corner cases, including oAuth, SAML, OIDC etc etc.","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b7cb51195720f5aca53eb82719c836b1778d4847","unresolved":false,"context_lines":[{"line_number":239,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":240,"context_line":"consider include:"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"  Yes, tokens will be encrypted, compressed and returned instead of stored"},{"line_number":245,"context_line":"  in a token backend."}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_08e2cdd4","line":242,"updated":"2015-01-14 23:59:39.000000000","message":"remove the questions and just put the explanation.","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b7cb51195720f5aca53eb82719c836b1778d4847","unresolved":false,"context_lines":[{"line_number":253,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"  Yes, this change involves cryptography to protect the user\u0027s information and"},{"line_number":256,"context_line":"  hashing to verify."},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":259,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_48ff7566","line":256,"updated":"2015-01-14 23:59:39.000000000","message":"what algorithms are used? Is new crypto going to be implemented or is an existing library going to be used? (which library?)","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b7cb51195720f5aca53eb82719c836b1778d4847","unresolved":false,"context_lines":[{"line_number":345,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":346,"context_line":""},{"line_number":347,"context_line":"`Token Provider Cleanup \u003chttps://blueprints.launchpad"},{"line_number":348,"context_line":".net/keystone/+spec/token-provider-cleanup\u003e`_"},{"line_number":349,"context_line":""},{"line_number":350,"context_line":"Documentation Impact"},{"line_number":351,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a961159_28314959","line":348,"updated":"2015-01-14 23:59:39.000000000","message":"another dependency is revocation event support.","commit_id":"49488424a4ca50f41b75ffc9b9330aa3a761f134"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"84441527454f4b5104655255e91cdcf46cec1578","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Authenticated Encrypted Tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_c9264468","line":8,"updated":"2015-02-09 23:11:05.000000000","message":"nit: grammar is a bit odd in the title, and it\u0027d be easier to find if the acronym was included. i\u0027d suggest:\n\n  Authenticated Encryption (AE) Tokens","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5eb214cd26046f952280af68b078a1c09b6179dc","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Authenticated Encrypted Tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_cee7f8e2","line":8,"in_reply_to":"da86d52c_c9264468","updated":"2015-02-10 19:28:21.000000000","message":"++","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Authenticated Encrypted Tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_5c1d81bd","line":8,"in_reply_to":"da86d52c_c9264468","updated":"2015-02-10 21:36:02.000000000","message":"Done","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"84441527454f4b5104655255e91cdcf46cec1578","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_6ea8fe77","line":42,"updated":"2015-02-09 23:11:05.000000000","message":"nit: this sounds like it should be described as \"authorization type\", not authentication type, but it\u0027s clear from context what is intended.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authentication type to determine the type of the token"},{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_9c7a99ef","line":42,"in_reply_to":"da86d52c_6ea8fe77","updated":"2015-02-10 21:36:02.000000000","message":"nice catch, I agree.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"54677afddfcdca8ffd81faa1b6ead3f103d219e7","unresolved":false,"context_lines":[{"line_number":64,"context_line":"to the order of the following example::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d token_prefix + ae_token_version + digest + encrypt(payload)"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_04d579b8","line":67,"updated":"2015-02-10 17:24:19.000000000","message":"What value encryption is adding here? Authenticity and integrity can be check using HMAC signature validation. At the same time we are encrypting something which is non critical information which we are anyhow providing to the client.\n\nI need more clarification around encrypted payload why it is needed and what value it is adding. Why not we can solve this using HMAC signature as proposed in \"HMAC signature based token\"","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5eb214cd26046f952280af68b078a1c09b6179dc","unresolved":false,"context_lines":[{"line_number":64,"context_line":"to the order of the following example::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d token_prefix + ae_token_version + digest + encrypt(payload)"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_4ec4e83f","line":67,"in_reply_to":"da86d52c_04d579b8","updated":"2015-02-10 19:28:21.000000000","message":"I\u0027m not sure the value of encrypting the token. I\u0027d like details on the reasoning to add encryption in as well.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":64,"context_line":"to the order of the following example::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  token \u003d token_prefix + ae_token_version + digest + encrypt(payload)"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where the \u0027+\u0027 is not included in the token, it only represents that the"},{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_c2534815","line":67,"in_reply_to":"da86d52c_4ec4e83f","updated":"2015-02-10 21:36:02.000000000","message":"Adding it as optional.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"84441527454f4b5104655255e91cdcf46cec1578","unresolved":false,"context_lines":[{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":72,"context_line":"  ae_token_version \u003d \u00271\u0027"},{"line_number":73,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":74,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_69bf18ab","line":72,"updated":"2015-02-09 23:11:05.000000000","message":"just food for thought: i kind of wish the token version was integrity verified - with a few iterations under our belt, it seems easy to imagine a user manipulating their token to skip an poorly coded authorization validation step by maliciously decreasing the token version, for example.\n\nbut there\u0027s obviously value in having it be external too, so i think we\u0027ll just have to be careful / document that it\u0027s not verified for integrity somewhere.\n\ni hate to suggest making these tokens bigger, but if this is deemed to be an issue, the version should be included *both* here and somewhere in the payload, and matched before using the token.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5eb214cd26046f952280af68b078a1c09b6179dc","unresolved":false,"context_lines":[{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":72,"context_line":"  ae_token_version \u003d \u00271\u0027"},{"line_number":73,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":74,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_8e8fc022","line":72,"in_reply_to":"da86d52c_69bf18ab","updated":"2015-02-10 19:28:21.000000000","message":"I would prefer the version be in the token and validated not external. This is worth the small data size increase.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":72,"context_line":"  ae_token_version \u003d \u00271\u0027"},{"line_number":73,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":74,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_224c2442","line":72,"in_reply_to":"da86d52c_8e04207f","updated":"2015-02-10 21:36:02.000000000","message":"So if we decide to not go with encrypting the token, we should have some extra room to allow for a couple bits to put the token version in the HMAC portion as well as externally. \n\nIt\u0027s nice to have the token version external because we can have a really dumb provider that just passes each token to a formatter/validator according to it\u0027s token version. If we carry the token version inside the integrity check, we\u0027ll have to do a little more orchestration between the formatters (possibly many of them) and the provider. \n\nEither way I think this is something that can be hashed out after a couple iterations.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"90d3f23eeb94b12be1162e004a2116f2eb1cad1d","unresolved":false,"context_lines":[{"line_number":69,"context_line":"token is sum of different parts of information. Example is as follows::"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  token_prefix \u003d \u0027AE\u0027"},{"line_number":72,"context_line":"  ae_token_version \u003d \u00271\u0027"},{"line_number":73,"context_line":"  digest \u003d \u0027sYnCFfb9jGhwnYP/+Zwn071IKCI\u003d\u0027"},{"line_number":74,"context_line":"  payload \u003d \u0027Z-LMbWY7EN3O7pDLVpaK2jO\u0027"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_8e04207f","line":72,"in_reply_to":"da86d52c_8e8fc022","updated":"2015-02-10 19:28:47.000000000","message":"Or at least *also* validated.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"84441527454f4b5104655255e91cdcf46cec1578","unresolved":false,"context_lines":[{"line_number":103,"context_line":"Given the above information in the token, the token size is around 165"},{"line_number":104,"context_line":"characters."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"The user can then use this AE token to in a normal UUID workflow. When"},{"line_number":107,"context_line":"Keystone receives an AE token from a user or a service, it can validate the"},{"line_number":108,"context_line":"digest to determine if the token has been tampered with in transit before"},{"line_number":109,"context_line":"decrypting the rest of the token and validating the decrypted information in"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_ce9f2a02","line":106,"updated":"2015-02-09 23:11:05.000000000","message":"nit: grammar typo","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":103,"context_line":"Given the above information in the token, the token size is around 165"},{"line_number":104,"context_line":"characters."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"The user can then use this AE token to in a normal UUID workflow. When"},{"line_number":107,"context_line":"Keystone receives an AE token from a user or a service, it can validate the"},{"line_number":108,"context_line":"digest to determine if the token has been tampered with in transit before"},{"line_number":109,"context_line":"decrypting the rest of the token and validating the decrypted information in"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_1c8a29bf","line":106,"in_reply_to":"da86d52c_ce9f2a02","updated":"2015-02-10 21:36:02.000000000","message":"Done","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"84441527454f4b5104655255e91cdcf46cec1578","unresolved":false,"context_lines":[{"line_number":109,"context_line":"decrypting the rest of the token and validating the decrypted information in"},{"line_number":110,"context_line":"the token. This doesn\u0027t require the AE token driver to look up any information"},{"line_number":111,"context_line":"from a token backend. The information traditionally stored in the token"},{"line_number":112,"context_line":"backend, like the service catalog, will be computed dynamically based on the"},{"line_number":113,"context_line":"scope that is passed in the token."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"This driver will only require minimum data to verify the user\u0027s"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_ceb64a8a","line":112,"updated":"2015-02-09 23:11:05.000000000","message":"nit: dynamically -\u003e on demand?","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":109,"context_line":"decrypting the rest of the token and validating the decrypted information in"},{"line_number":110,"context_line":"the token. This doesn\u0027t require the AE token driver to look up any information"},{"line_number":111,"context_line":"from a token backend. The information traditionally stored in the token"},{"line_number":112,"context_line":"backend, like the service catalog, will be computed dynamically based on the"},{"line_number":113,"context_line":"scope that is passed in the token."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"This driver will only require minimum data to verify the user\u0027s"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_5c9021ed","line":112,"in_reply_to":"da86d52c_ceb64a8a","updated":"2015-02-10 21:36:02.000000000","message":"Done","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"54677afddfcdca8ffd81faa1b6ead3f103d219e7","unresolved":false,"context_lines":[{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Security Impact"},{"line_number":142,"context_line":"---------------"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":145,"context_line":"consider include:"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_64fc753f","line":143,"updated":"2015-02-10 17:24:19.000000000","message":"I think we should mention about the protection and management around the crypto key. Though it is not scope of this spec","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Security Impact"},{"line_number":142,"context_line":"---------------"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":145,"context_line":"consider include:"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_dc417164","line":143,"in_reply_to":"da86d52c_64fc753f","updated":"2015-02-10 21:36:02.000000000","message":"I don\u0027t think that falls in the scope of the spec. I feel that we can iterate over that in review when adding something like \"keystone-manage ae_setup\", and then have proper documentation on key rotation based on that outcome.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"84441527454f4b5104655255e91cdcf46cec1578","unresolved":false,"context_lines":[{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  Yes, tokens will be encrypted, compressed and returned instead of stored"},{"line_number":150,"context_line":"  in a token backend."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"* Does this change alter the API in a way that may impact security, such as"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_e986a8da","line":149,"updated":"2015-02-09 23:11:05.000000000","message":"to be more specific:\n\n  Yes, identity and authorization data will be encrypted, compressed\n  and returned to the API user instead of stored in a token backend.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  Yes, tokens will be encrypted, compressed and returned instead of stored"},{"line_number":150,"context_line":"  in a token backend."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"* Does this change alter the API in a way that may impact security, such as"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_bc1e7d6e","line":149,"in_reply_to":"da86d52c_e986a8da","updated":"2015-02-10 21:36:02.000000000","message":"Done","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"84441527454f4b5104655255e91cdcf46cec1578","unresolved":false,"context_lines":[{"line_number":180,"context_line":"  API nodes. The argument could be made that the point at which resource"},{"line_number":181,"context_line":"  exhaustion happens from AE tokens would be greater than the current"},{"line_number":182,"context_line":"  implementation being able to read token data from the token backend given"},{"line_number":183,"context_line":"  the same request volume."},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"Notifications Impact"},{"line_number":186,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_3f81d28f","line":183,"updated":"2015-02-09 23:11:05.000000000","message":"nit: the above answer is accurate, but not relevant to the question. resource exhaustion is possible with UUID tokens (and especially PKI tokens) -- too many tokens being created in a short enough period of time results in the database becoming full and keystone failing to create new tokens. AE tokens do not consume any persistent resources and are therefore not vulnerable to resource exhaustion. like any other API, they\u0027re simply vulnerable to traditional DoS which is not what this question is asking about.","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":180,"context_line":"  API nodes. The argument could be made that the point at which resource"},{"line_number":181,"context_line":"  exhaustion happens from AE tokens would be greater than the current"},{"line_number":182,"context_line":"  implementation being able to read token data from the token backend given"},{"line_number":183,"context_line":"  the same request volume."},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"Notifications Impact"},{"line_number":186,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_ffcc67bd","line":183,"in_reply_to":"da86d52c_3f81d28f","updated":"2015-02-10 21:36:02.000000000","message":"Done","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"84441527454f4b5104655255e91cdcf46cec1578","unresolved":false,"context_lines":[{"line_number":201,"context_line":"increases in scale. Instead of scaling a persistent storage solution for"},{"line_number":202,"context_line":"tokens, an alternative would be to use AE tokens and scale up compute power."},{"line_number":203,"context_line":"Since the tokens never have to be written to a backend,"},{"line_number":204,"context_line":"CPU operations will have better performance versus I/O operations."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Other Deployer Impact"},{"line_number":207,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_ff5d7a49","line":204,"updated":"2015-02-09 23:11:05.000000000","message":"shameless plug: could link to my blog post here now :P\n\n  http://dolphm.com/benchmarking-openstack-keystone-token-formats","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f1e3305a5db088b48eb99ed91ff2583ecfed1600","unresolved":false,"context_lines":[{"line_number":201,"context_line":"increases in scale. Instead of scaling a persistent storage solution for"},{"line_number":202,"context_line":"tokens, an alternative would be to use AE tokens and scale up compute power."},{"line_number":203,"context_line":"Since the tokens never have to be written to a backend,"},{"line_number":204,"context_line":"CPU operations will have better performance versus I/O operations."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Other Deployer Impact"},{"line_number":207,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":24,"id":"da86d52c_9fd44b21","line":204,"in_reply_to":"da86d52c_ff5d7a49","updated":"2015-02-10 21:36:02.000000000","message":"Done","commit_id":"f5b494bafadb8a8e78cb2a60d6778301cdc490e1"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5201f58b3d4ead63844203951ae34f44ae0cce73","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_82ed27ba","line":13,"updated":"2015-02-14 18:51:43.000000000","message":"Somewhere you need to provide a reference to authenticated encryption ( http://en.wikipedia.org/wiki/Authenticated_encryption)  Also you need to explain how authenticated encryption tokens provide simultaneously, authentication integrity, and privacy of the token contents.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d395544286bd38c2edaddb13cbd04b39ed13dc34","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_a50a1025","line":13,"in_reply_to":"da86d52c_82ed27ba","updated":"2015-02-16 17:53:48.000000000","message":"Renaming this to something not implementation specific.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5201f58b3d4ead63844203951ae34f44ae0cce73","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_824447b8","line":14,"updated":"2015-02-14 18:51:43.000000000","message":"Somewhere you should put the following:  In its basic form an authenticated encryption token contains a user identifier, and expiration date and a message digest of this information and then encrypts this information.  With this approach, the encryption provides privacy, the message digest ensures the token information cannot be tampered with (i.e. integrity), and the user identifier provides authentication.  Our approach to the AE token model is a variant of this basic approach tailored to Keystone artifacts.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d395544286bd38c2edaddb13cbd04b39ed13dc34","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp ae-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"AE tokens provide a way to use Authenticated Encryption to represent a"},{"line_number":14,"context_line":"token, allowing for tokens to be non-persistent."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_e504081a","line":14,"in_reply_to":"da86d52c_824447b8","updated":"2015-02-16 17:53:48.000000000","message":"Done","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f77256960d9508c39b64c06eb2de20dd9180725e","unresolved":false,"context_lines":[{"line_number":31,"context_line":"the AE token driver will pull the absolute minimum amount of information"},{"line_number":32,"context_line":"about the user out of the request, generate a token containing this data and"},{"line_number":33,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"},{"line_number":34,"context_line":"the information can be compressed. This is something that can be done using"},{"line_number":35,"context_line":"`msgpack \u003chttp://msgpack.org/\u003e`_."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_0d16bfa7","line":34,"updated":"2015-02-15 21:38:33.000000000","message":"Pleas Use ASN1 instead.  It is the format used by CMS, and is far more mature.  It has sufficient opportunities for dealing with all of the complex types that we have in the body of the tokens as well.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"3ba1b397ae3a89f6cdabfd38ac966e72465917c6","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authorization type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_38fa90bd","line":39,"updated":"2015-02-11 01:33:03.000000000","message":"There is security issue here , client can spoof the system as the signature is not bind with roles and endpoints.\nUser can present this signature and middleware will allow without knowing the role.\nAlso this is not protecting at the endpoints level.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3feb22adfb4acb6e81ac18567bd1f73f2a2c3b8c","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authorization type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_ac7ff415","line":39,"in_reply_to":"da86d52c_2c006933","updated":"2015-02-11 21:58:26.000000000","message":"There\u0027s no opportunity here for the user to spoof roles, as they\u0027re still retrieved online from keystone.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f77256960d9508c39b64c06eb2de20dd9180725e","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authorization type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_ed108bad","line":39,"in_reply_to":"da86d52c_315c1d7d","updated":"2015-02-15 21:38:33.000000000","message":"I think we will need a body of relate tokens types for each format:  Unscoped, unscoped Federated, scope,, and trust.  Only Unscoped Federated should need a list of groups in them for now.  We can optimize that in a a future revision.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d2635bb44c91670da5c097a7c1dff3a8e37e32dc","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authorization type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_2c006933","line":39,"in_reply_to":"da86d52c_38fa90bd","updated":"2015-02-11 20:05:34.000000000","message":"Could you clarify a bit more how the spoofing occurs? Endpoints would be protected by the token-constraints - or do you mean something else?","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"4d9ad3f994f84044aa327a44e2db6893c37a7e70","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authorization type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_b6a1ff47","line":39,"in_reply_to":"da86d52c_ac7ff415","updated":"2015-02-12 01:06:16.000000000","message":"Dolph, are you suggesting Keystone will be pulling the user roles on project for each validation call?\n\nIf that is the case then we are loosing all the benefits of HMAC signature validation framework.\n\nIMO let user present the roles which he/she got from get token call from keystone. Keystone will bind the signature with roles too. If user is trying to spoof, validating will fail.\n\nThoughts?","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ec5225ad78ba6573c2087756ac769ad3e42e3072","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"An example of this would look similar to the following::"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"  payload \u003d [auth_type, user_id, project_id, created_at, expires_at, audit_id]"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Where the values are:"},{"line_number":42,"context_line":"* ``auth_type``: Authorization type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_315c1d7d","line":39,"in_reply_to":"da86d52c_b6a1ff47","updated":"2015-02-12 15:45:52.000000000","message":"One of the reasons this spec wasn\u0027t merged at the mid-cycle was because there was the ability to have an unbound number of groups in a federated token, which bloats the AE token. The same argument applies to roles. A user can have multiple roles and if we\u0027re not returning them from Keystone, they have to live in the token, which can bloat the token. Until there is a way in Keystone to ensure there is only one role per user per project and I can dedicated a specific slice of my token format to the role ID, I don\u0027t think we should be putting roles in the token. Simply because it exposes the ability to go over our length threshold for an acceptable non-persistent tokens. \n\nNot saying that we shouldn\u0027t investigate this option at some point, I think it would be valuable. Maybe putting the roles in the token is something that we can investigate more once ayoung\u0027s hierarchical roles work is finished up.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f77256960d9508c39b64c06eb2de20dd9180725e","unresolved":false,"context_lines":[{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."},{"line_number":46,"context_line":"* ``created_at``: UTC timestamp representing the created at time of the token."},{"line_number":47,"context_line":"By using timestamp we can save on space when packing the message by packing an"},{"line_number":48,"context_line":"integer instead of a string."},{"line_number":49,"context_line":"* ``expires_at``: UTC timestamp representing the expiration of the token. This"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_6d6bbb1f","line":46,"updated":"2015-02-15 21:38:33.000000000","message":"I can\u0027t help but think that we should be able to calculate this value based on the expiration time.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d395544286bd38c2edaddb13cbd04b39ed13dc34","unresolved":false,"context_lines":[{"line_number":43,"context_line":"(i.e. domain scoped token, service scoped token, trust scoped token, etc)"},{"line_number":44,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":45,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."},{"line_number":46,"context_line":"* ``created_at``: UTC timestamp representing the created at time of the token."},{"line_number":47,"context_line":"By using timestamp we can save on space when packing the message by packing an"},{"line_number":48,"context_line":"integer instead of a string."},{"line_number":49,"context_line":"* ``expires_at``: UTC timestamp representing the expiration of the token. This"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_c8d63953","line":46,"in_reply_to":"da86d52c_6d6bbb1f","updated":"2015-02-16 17:53:48.000000000","message":"This is an implementation detail, we can address this in code review.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f77256960d9508c39b64c06eb2de20dd9180725e","unresolved":false,"context_lines":[{"line_number":49,"context_line":"* ``expires_at``: UTC timestamp representing the expiration of the token. This"},{"line_number":50,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":51,"context_line":"timestamp instead of a string."},{"line_number":52,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"These values can be stored in a list where the AE Token driver,"},{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_ed5ecb78","line":52,"updated":"2015-02-15 21:38:33.000000000","message":"The token should also have a field to indicate which Keystone server signed the token for a multi-keystone deployment.  This can be a single integer value if a UUID is deemed too long.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f77256960d9508c39b64c06eb2de20dd9180725e","unresolved":false,"context_lines":[{"line_number":55,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":56,"context_line":"values can be packed, encrypted, and encoded. This will result in a"},{"line_number":57,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` should be"},{"line_number":58,"context_line":"HMAC signed. The resulting digest will be included as part of the token. This"},{"line_number":59,"context_line":"is important because we should fast fail if the token has been tampered with in"},{"line_number":60,"context_line":"any way without having to attempt decrypting the spoofed token only to fail on"},{"line_number":61,"context_line":"bogus token values."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_ad4cd3c9","line":58,"updated":"2015-02-15 21:38:33.000000000","message":"Please use the existing PKI token signature mechanism, not symmetric cryptography.  Symmetric has some poor issues when looking at distributed systems.  With symmetric, if any keystone server needs to validate for another keystone server, they need to share a symmetrci key, and key distribution is very hard to get correct.  Asymmetric cryptography is much simpler to do right, as the public key is a public document.  Also, it means tha a non-trusted entity can validate the signature on a token.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5201f58b3d4ead63844203951ae34f44ae0cce73","unresolved":false,"context_lines":[{"line_number":60,"context_line":"any way without having to attempt decrypting the spoofed token only to fail on"},{"line_number":61,"context_line":"bogus token values."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatively, encryption may not be necessary depending on the values in the"},{"line_number":64,"context_line":"payload. Since the information here doesn\u0027t consist of personally identifiable"},{"line_number":65,"context_line":"information there isn\u0027t a hard requirement to encrypt the payload. Keystone"},{"line_number":66,"context_line":"could rely on HMAC verification instead of decrypting the token in that case."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_22d9dbf4","line":63,"updated":"2015-02-14 18:51:43.000000000","message":"Hmm. I\u0027m not comfortable with the encryption being optional.  How can you be so sure you can maintain privacy and that folks can\u0027t look at the id\u0027s and with a little work figure stuff out?","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"43fc669fe3edf0e9a9a4cfa1695111ad938f6734","unresolved":false,"context_lines":[{"line_number":60,"context_line":"any way without having to attempt decrypting the spoofed token only to fail on"},{"line_number":61,"context_line":"bogus token values."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatively, encryption may not be necessary depending on the values in the"},{"line_number":64,"context_line":"payload. Since the information here doesn\u0027t consist of personally identifiable"},{"line_number":65,"context_line":"information there isn\u0027t a hard requirement to encrypt the payload. Keystone"},{"line_number":66,"context_line":"could rely on HMAC verification instead of decrypting the token in that case."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_f801346b","line":63,"in_reply_to":"da86d52c_22d9dbf4","updated":"2015-02-14 23:38:26.000000000","message":"Typically none of the data in the token would be sensitive. Encryption is really an optional layer of obfuscation, but to be clear, ASN1 format doesn\u0027t secure the data, it just is a signature. \n\nThe important part here is the data is signed / verifiable.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f77256960d9508c39b64c06eb2de20dd9180725e","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Alternatively, encryption may not be necessary depending on the values in the"},{"line_number":64,"context_line":"payload. Since the information here doesn\u0027t consist of personally identifiable"},{"line_number":65,"context_line":"information there isn\u0027t a hard requirement to encrypt the payload. Keystone"},{"line_number":66,"context_line":"could rely on HMAC verification instead of decrypting the token in that case."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"The user can then use an AE token in a normal UUID workflow. When Keystone"},{"line_number":69,"context_line":"receives an AE token from a user or a service, it can validate the digest to"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_ad1e93b9","line":66,"updated":"2015-02-15 21:38:33.000000000","message":"HMAC only ensure that the body of the data has not been tampered with.  This is the idea behind the signing of PKI tokens, and should be sufficient here as well;  add a signature block after the data .","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5201f58b3d4ead63844203951ae34f44ae0cce73","unresolved":false,"context_lines":[{"line_number":69,"context_line":"receives an AE token from a user or a service, it can validate the digest to"},{"line_number":70,"context_line":"determine if the token has been tampered with in transit before decrypting the"},{"line_number":71,"context_line":"rest of the token and validating the decrypted information in the token. This"},{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_ddc8e2aa","line":72,"updated":"2015-02-14 18:51:43.000000000","message":"Whoa. I believe you need to sign the token data first (i.e. create a message digest) and then encrypt.  If you do it the other way around it is much weaker and not recommended","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2622,"name":"Samuel Merritt","email":"spam+launchpad@andcheese.org","username":"torgomatic"},"change_message_id":"0eb303b9af45697076e6fb1be8cd71ebbbd1ff84","unresolved":false,"context_lines":[{"line_number":69,"context_line":"receives an AE token from a user or a service, it can validate the digest to"},{"line_number":70,"context_line":"determine if the token has been tampered with in transit before decrypting the"},{"line_number":71,"context_line":"rest of the token and validating the decrypted information in the token. This"},{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_e286da15","line":72,"in_reply_to":"da86d52c_58f08091","updated":"2015-02-15 18:15:01.000000000","message":"I don\u0027t think that\u0027s correct. Depending on the cipher in question[1], you can apply the decryption function to just about any old bytes that come in, and you\u0027ll get some output. Whether that output is valid or not is a separate question.\n\nLet\u0027s take a concrete example: consider AES in CTR mode. Encryption works by using AES to produce an unpredictable byte stream, then XOR-ing the plaintext with the bytes to produce the ciphertext. Decryption is the same process, but with the ciphertext as input and plaintext as output. If an attacker wants to flip a particular bit in the plaintext, all they have to do is flip that same bit in the ciphertext.\n\nIf you want proof of validity, you need some kind of authentication, not just encryption.\n\n(Bonus points for using encrypt-then-MAC, as everything else requires decryption of a possibly-attacker-controlled ciphertext before being able to determine that it\u0027s invalid.)\n\n[1] weasel words; I can\u0027t think of a cipher where this is false, but I\u0027m not willing to assert that none exist.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"89d3641ac285aafb598c0a4c0a5c457f040f7383","unresolved":false,"context_lines":[{"line_number":69,"context_line":"receives an AE token from a user or a service, it can validate the digest to"},{"line_number":70,"context_line":"determine if the token has been tampered with in transit before decrypting the"},{"line_number":71,"context_line":"rest of the token and validating the decrypted information in the token. This"},{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_36b3dc0b","line":72,"in_reply_to":"da86d52c_58f08091","updated":"2015-02-15 06:25:10.000000000","message":"to clarify, signing wouldn\u0027t be needed if the token is encrypted.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"958c33c8e20d1bb107fda661ba046bde4120536a","unresolved":false,"context_lines":[{"line_number":69,"context_line":"receives an AE token from a user or a service, it can validate the digest to"},{"line_number":70,"context_line":"determine if the token has been tampered with in transit before decrypting the"},{"line_number":71,"context_line":"rest of the token and validating the decrypted information in the token. This"},{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_e216da57","line":72,"in_reply_to":"da86d52c_a29142f3","updated":"2015-02-15 19:41:23.000000000","message":"I agree with Samuel. Please check out http://eversystems.eu/Document/15/Sessionless_Authentication_with_Encrypted_Tokens\n\"The message digest is the piece that many people forget. Encryption alone doesn\u0027t actually protect the integrity of a message: a user could modify the token and decryption would still produce data. Now the result of modifying the token will usually be junk, but nothing guarantees that. A determined user could, with a bit of time, produce a valid token. \"   \n\nMy fear is either we are doing AE tokens or we are not.  Are we encrypting or arent we?  Are we adding the a message digest or not.  The way the spec reads it makes it sound like encryption may not be necessary.  I have a hard time believing that.  We need to be clear on what exactly is going to be done here and then convince ourselves it is secure.  Right now the spec is too wishy-washy on these critical details","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"43fc669fe3edf0e9a9a4cfa1695111ad938f6734","unresolved":false,"context_lines":[{"line_number":69,"context_line":"receives an AE token from a user or a service, it can validate the digest to"},{"line_number":70,"context_line":"determine if the token has been tampered with in transit before decrypting the"},{"line_number":71,"context_line":"rest of the token and validating the decrypted information in the token. This"},{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_58f08091","line":72,"in_reply_to":"da86d52c_ddc8e2aa","updated":"2015-02-14 23:38:26.000000000","message":"I\u0027ve always viewed encryption as superfluous in this spec, but if the data is encrypted, I believe signing it is not needed (doesn\u0027t encryption provide proof of validity, it won\u0027t decrypt otherwise).","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b84deb8e30f6b5b3d0c1f11317d5f4f219e50589","unresolved":false,"context_lines":[{"line_number":69,"context_line":"receives an AE token from a user or a service, it can validate the digest to"},{"line_number":70,"context_line":"determine if the token has been tampered with in transit before decrypting the"},{"line_number":71,"context_line":"rest of the token and validating the decrypted information in the token. This"},{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_08786d8e","line":72,"in_reply_to":"da86d52c_e216da57","updated":"2015-02-15 23:17:43.000000000","message":"Encryption of the data (vs. HMAC signature of the message) is likely icing on the cake, and could be an additional formatter. The Digest in the important part.\n\nWhat benefit besides obscuring the data does the encryption add over our current tokens? I assert that the digest is what we\u0027re looking for, encryption (especially if the form of encryption is going to hang up this spec more) can be addressed after the core functionality or as an additional formatter. We are not placing sensitive data in the token itself and should clearly document the contents of the token are considered private data and may change at anytime - at least that way we can at least tell everyone \"we told you so\" when we do change it to incorporate encryption.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41841aaf45ab7063eb5df14443422ead0e271b9c","unresolved":false,"context_lines":[{"line_number":69,"context_line":"receives an AE token from a user or a service, it can validate the digest to"},{"line_number":70,"context_line":"determine if the token has been tampered with in transit before decrypting the"},{"line_number":71,"context_line":"rest of the token and validating the decrypted information in the token. This"},{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_a29142f3","line":72,"in_reply_to":"da86d52c_e286da15","updated":"2015-02-15 19:20:18.000000000","message":"@Samuel,\n\nFair enough (I think I was stuck thinking about the ASN1 signing-construct when I wrote that comment, which is neither encryption nor symmetrical).\n\nI think the important part of this spec is hit by way of the HMAC signature. We should split the extra formatter requirements into either: \"additional formatters that include encryption will follow the base implementation\" or into a separate spec.\n\nThe core functionality should be the focus here in this spec.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5201f58b3d4ead63844203951ae34f44ae0cce73","unresolved":false,"context_lines":[{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":78,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_5d5312e2","line":75,"updated":"2015-02-14 18:51:43.000000000","message":"What about role assignments. How is that handled? Are those added? Need more detail on this","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41841aaf45ab7063eb5df14443422ead0e271b9c","unresolved":false,"context_lines":[{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":78,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_c28e36d0","line":75,"in_reply_to":"da86d52c_5d5312e2","updated":"2015-02-15 19:20:18.000000000","message":"We should have this information expanded, but the concept is those would be reconstructed on validate.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d395544286bd38c2edaddb13cbd04b39ed13dc34","unresolved":false,"context_lines":[{"line_number":72,"context_line":"doesn\u0027t require the AE token driver to look up any information from a token"},{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":78,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_fffc99b7","line":75,"in_reply_to":"da86d52c_c28e36d0","updated":"2015-02-16 17:53:48.000000000","message":"Yes, the roles assignments are built on auth and validate.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5201f58b3d4ead63844203951ae34f44ae0cce73","unresolved":false,"context_lines":[{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":78,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"},{"line_number":79,"context_line":"for the user doesn\u0027t change from the current workflow. The token size will"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_7db9b614","line":76,"updated":"2015-02-14 18:51:43.000000000","message":"Will this be a new API extension to get catalog from a valid token or are using an existing API?  When will catalogs be added and when wont they be added?","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f77256960d9508c39b64c06eb2de20dd9180725e","unresolved":false,"context_lines":[{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":78,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"},{"line_number":79,"context_line":"for the user doesn\u0027t change from the current workflow. The token size will"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_cd1bc7c8","line":76,"in_reply_to":"da86d52c_42ba466f","updated":"2015-02-15 21:38:33.000000000","message":"Role assignments will only be stored in the Keystone server.  However, we have the potential, if we use PKI instead of symmetrical, to have multiple tokens go to Nova and not have to do a round trip;  only the first set of data needs to be stoare, additional token for a user would use cached validation.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41841aaf45ab7063eb5df14443422ead0e271b9c","unresolved":false,"context_lines":[{"line_number":73,"context_line":"backend. The information traditionally stored in the token backend, like the"},{"line_number":74,"context_line":"service catalog, will be computed on demand based on the scope that is passed"},{"line_number":75,"context_line":"in the token."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":78,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"},{"line_number":79,"context_line":"for the user doesn\u0027t change from the current workflow. The token size will"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_42ba466f","line":76,"in_reply_to":"da86d52c_7db9b614","updated":"2015-02-15 19:20:18.000000000","message":"The catalogs would still be part of the token body (as today) or not (if ?nocatalog is used). Think of these tokens like UUID tokens, the token id itself doesn\u0027t have the information for the catalog in it, but keystone will emit that info when a token is validated.\n\nThe difference is the AE Token would have enough information to not need to store data (UUID tokens are only an index, no functional data in them).","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5201f58b3d4ead63844203951ae34f44ae0cce73","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Token revocation can be handled through revocation events,"},{"line_number":85,"context_line":"which can be built of the existing revocation event system. When a user"},{"line_number":86,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":87,"context_line":"expression that will describe a token to revoke. An example being,"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_9d5caaf2","line":84,"updated":"2015-02-14 18:51:43.000000000","message":"Why can\u0027t there be code that looks at the expiration time in the token when authorization is being done and if the token has expired then revoke?","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"43fc669fe3edf0e9a9a4cfa1695111ad938f6734","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Token revocation can be handled through revocation events,"},{"line_number":85,"context_line":"which can be built of the existing revocation event system. When a user"},{"line_number":86,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":87,"context_line":"expression that will describe a token to revoke. An example being,"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_f838543f","line":84,"in_reply_to":"da86d52c_9d5caaf2","updated":"2015-02-14 23:38:26.000000000","message":"An expired token is implicitly invalid. A revoked token would be non-expired but also explicitly invalid. This is defining that the token (if not expired) would have revocation status (e.g. tokens revoked due to password change) determined by the revocation event system (not the token revocation list).","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d395544286bd38c2edaddb13cbd04b39ed13dc34","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"That\u0027s neat, but how do I revoke an AE token that isn\u0027t stored?"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Token revocation can be handled through revocation events,"},{"line_number":85,"context_line":"which can be built of the existing revocation event system. When a user"},{"line_number":86,"context_line":"token has been revoked, the AE token driver can build a rule or regular"},{"line_number":87,"context_line":"expression that will describe a token to revoke. An example being,"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_9fa1dd97","line":84,"in_reply_to":"da86d52c_f838543f","updated":"2015-02-16 17:53:48.000000000","message":"Correct, by using the revocation events work, we allow the ability to revoke a token that\u0027s never persisted. So saying something like \"all tokens from this user created before this time are now invalid\". We can create a revocation rule for that and validate against it.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"43fc669fe3edf0e9a9a4cfa1695111ad938f6734","unresolved":false,"context_lines":[{"line_number":93,"context_line":"lapsed, since the revocation rule was created."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"In the event that more information is needed in the token, like federation, the"},{"line_number":96,"context_line":"existing AE token implementation could be extended to include extra values."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Alternatives"},{"line_number":99,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_982918f5","line":96,"updated":"2015-02-14 23:38:26.000000000","message":"Please rephrase to avoid \"could be extended\". This phrasing makes it sound like federated tokens are \"optional\" for support - which is not the case.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5201f58b3d4ead63844203951ae34f44ae0cce73","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"In the event that more information is needed in the token, like federation, the"},{"line_number":96,"context_line":"existing AE token implementation could be extended to include extra values."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Alternatives"},{"line_number":99,"context_line":"------------"},{"line_number":100,"context_line":""}],"source_content_type":"text/x-rst","patch_set":25,"id":"da86d52c_fd44c61c","line":97,"updated":"2015-02-14 18:51:43.000000000","message":"So this will support federated tokens. Can you provide more detail on how and if anything else is needed for this case.","commit_id":"06accec17675e82be786f2ef02c747b09144ae61"}],"specs/kilo/klwt.rst":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ccead3be29c3c668fc3fa56c7d59d18ee5b520dd","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Keystone Lightweight Tokens - KLWT"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp klwt-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"KLWT tokens provide a way to use to represent a token, allowing for tokens to"},{"line_number":14,"context_line":"be non-persistent. KLWT tokens provide integrity and confidentiality by being"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_d9c60d68","line":11,"updated":"2015-02-16 18:32:54.000000000","message":"Will need to update the LP BP.","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Keystone Lightweight Tokens - KLWT"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp klwt-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"KLWT tokens provide a way to use to represent a token, allowing for tokens to"},{"line_number":14,"context_line":"be non-persistent. KLWT tokens provide integrity and confidentiality by being"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_484c0477","line":11,"in_reply_to":"da86d52c_d9c60d68","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ccead3be29c3c668fc3fa56c7d59d18ee5b520dd","unresolved":false,"context_lines":[{"line_number":45,"context_line":"* ``scope_type``: Scope type to determine the type of the token"},{"line_number":46,"context_line":"(i.e. domain scoped token, trust scoped token, etc)"},{"line_number":47,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":48,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."},{"line_number":49,"context_line":"* ``created_at``: UTC timestamp representing the created at time of the token."},{"line_number":50,"context_line":"By using timestamp we can save on space when packing the message by packing an"},{"line_number":51,"context_line":"integer instead of a string."}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_799b6166","line":48,"updated":"2015-02-16 18:32:54.000000000","message":"This would also encompass trusts in the case of a trust token?","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"21bd24d746247cd91e76fbae3e38771340f66ac7","unresolved":false,"context_lines":[{"line_number":45,"context_line":"* ``scope_type``: Scope type to determine the type of the token"},{"line_number":46,"context_line":"(i.e. domain scoped token, trust scoped token, etc)"},{"line_number":47,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":48,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."},{"line_number":49,"context_line":"* ``created_at``: UTC timestamp representing the created at time of the token."},{"line_number":50,"context_line":"By using timestamp we can save on space when packing the message by packing an"},{"line_number":51,"context_line":"integer instead of a string."}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_b96b1985","line":48,"updated":"2015-02-16 18:31:45.000000000","message":"remove project and domain id  from the body of the payload, as it they will be done in the scope instead.  We don\u0027t need the users\u0027 domain id in the token, and project is assignment only.","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":45,"context_line":"* ``scope_type``: Scope type to determine the type of the token"},{"line_number":46,"context_line":"(i.e. domain scoped token, trust scoped token, etc)"},{"line_number":47,"context_line":"* ``user_id``: ID representing the user creating the token."},{"line_number":48,"context_line":"* ``project_id`` or ``domain_id``: ID representing the scope of the user."},{"line_number":49,"context_line":"* ``created_at``: UTC timestamp representing the created at time of the token."},{"line_number":50,"context_line":"By using timestamp we can save on space when packing the message by packing an"},{"line_number":51,"context_line":"integer instead of a string."}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_e86138d5","line":48,"in_reply_to":"da86d52c_799b6166","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ccead3be29c3c668fc3fa56c7d59d18ee5b520dd","unresolved":false,"context_lines":[{"line_number":53,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":54,"context_line":"timestamp instead of a string. This could optionally be a delta integer that is"},{"line_number":55,"context_line":"the token ttl."},{"line_number":56,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"These values can be stored in a list where the KLWT Token driver,"},{"line_number":59,"context_line":"or any validator for that matter, knows the order of the values. The above"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_9993b55b","line":56,"updated":"2015-02-16 18:32:54.000000000","message":"I am not clear how we will represent the federation info here, which will need to be addressed before we can confirm the SPFE.","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":53,"context_line":"can be represented different ways and also using an integer to store the"},{"line_number":54,"context_line":"timestamp instead of a string. This could optionally be a delta integer that is"},{"line_number":55,"context_line":"the token ttl."},{"line_number":56,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"These values can be stored in a list where the KLWT Token driver,"},{"line_number":59,"context_line":"or any validator for that matter, knows the order of the values. The above"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_c8db947b","line":56,"in_reply_to":"da86d52c_9993b55b","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"21bd24d746247cd91e76fbae3e38771340f66ac7","unresolved":false,"context_lines":[{"line_number":59,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":60,"context_line":"values can be packed, possibly encrypted, and encoded. This will result in a"},{"line_number":61,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` should be"},{"line_number":62,"context_line":"HMAC signed. The resulting digest will be included as part of the token. This"},{"line_number":63,"context_line":"is important because we should fast fail if the token has been tampered with in"},{"line_number":64,"context_line":"any way without having to attempt decrypting the spoofed token only to fail on"},{"line_number":65,"context_line":"bogus token values."}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_b9c79964","line":62,"updated":"2015-02-16 18:31:45.000000000","message":"change HMAC to \"signed with a mechanism like HMAC\" to avoid us tying to one technology.","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":59,"context_line":"or any validator for that matter, knows the order of the values. The above"},{"line_number":60,"context_line":"values can be packed, possibly encrypted, and encoded. This will result in a"},{"line_number":61,"context_line":"``payload``. To ensure the integrity of the contents, the ``payload`` should be"},{"line_number":62,"context_line":"HMAC signed. The resulting digest will be included as part of the token. This"},{"line_number":63,"context_line":"is important because we should fast fail if the token has been tampered with in"},{"line_number":64,"context_line":"any way without having to attempt decrypting the spoofed token only to fail on"},{"line_number":65,"context_line":"bogus token values."}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_c849d433","line":62,"in_reply_to":"da86d52c_b9c79964","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"21bd24d746247cd91e76fbae3e38771340f66ac7","unresolved":false,"context_lines":[{"line_number":64,"context_line":"any way without having to attempt decrypting the spoofed token only to fail on"},{"line_number":65,"context_line":"bogus token values."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Alternatively, encryption may not be necessary depending on the values in the"},{"line_number":68,"context_line":"payload. Since the information here doesn\u0027t consist of personally identifiable"},{"line_number":69,"context_line":"information there isn\u0027t a hard requirement to encrypt the payload. Keystone"},{"line_number":70,"context_line":"could rely on HMAC verification instead of decrypting the token in that case."}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_f9ebd1a1","line":67,"updated":"2015-02-16 18:31:45.000000000","message":"Suggestion: make the baseline unencrypted, just signed, but indicate that encryption is availabl as an upgraded security option if people want to make the tokens unreadable outside the keystone server.","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":64,"context_line":"any way without having to attempt decrypting the spoofed token only to fail on"},{"line_number":65,"context_line":"bogus token values."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Alternatively, encryption may not be necessary depending on the values in the"},{"line_number":68,"context_line":"payload. Since the information here doesn\u0027t consist of personally identifiable"},{"line_number":69,"context_line":"information there isn\u0027t a hard requirement to encrypt the payload. Keystone"},{"line_number":70,"context_line":"could rely on HMAC verification instead of decrypting the token in that case."}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_e844d81a","line":67,"in_reply_to":"da86d52c_f9ebd1a1","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ccead3be29c3c668fc3fa56c7d59d18ee5b520dd","unresolved":false,"context_lines":[{"line_number":82,"context_line":"for the user doesn\u0027t change from the current UUID workflow. The token size will"},{"line_number":83,"context_line":"be bigger than UUID tokens but not as big as a PKI tokens."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"That\u0027s neat, but how do I revoke an KLWT token that isn\u0027t stored?"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Token revocation can be handled through revocation events, which can be built"},{"line_number":88,"context_line":"of the existing revocation event system. When a user token has been revoked,"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_b9c31938","line":85,"updated":"2015-02-16 18:32:54.000000000","message":"Hah! :)","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ccead3be29c3c668fc3fa56c7d59d18ee5b520dd","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"That\u0027s neat, but how do I revoke an KLWT token that isn\u0027t stored?"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Token revocation can be handled through revocation events, which can be built"},{"line_number":88,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":89,"context_line":"the KLWT token driver can build a rule that will describe a token to revoke. An"},{"line_number":90,"context_line":"example being, revoke all tokens from user XYZ before this point in time. The"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_b9ca3944","line":87,"updated":"2015-02-16 18:32:54.000000000","message":"(NIT): Can -\u003e will, and 2nd \"can\" -\u003e \"is\"","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"21bd24d746247cd91e76fbae3e38771340f66ac7","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"That\u0027s neat, but how do I revoke an KLWT token that isn\u0027t stored?"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Token revocation can be handled through revocation events, which can be built"},{"line_number":88,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":89,"context_line":"the KLWT token driver can build a rule that will describe a token to revoke. An"},{"line_number":90,"context_line":"example being, revoke all tokens from user XYZ before this point in time. The"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_191185af","line":87,"updated":"2015-02-16 18:31:45.000000000","message":"can-\u003ewill...we can\u0027t do AE tokens without revocation events.","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"That\u0027s neat, but how do I revoke an KLWT token that isn\u0027t stored?"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Token revocation can be handled through revocation events, which can be built"},{"line_number":88,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":89,"context_line":"the KLWT token driver can build a rule that will describe a token to revoke. An"},{"line_number":90,"context_line":"example being, revoke all tokens from user XYZ before this point in time. The"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_482b2433","line":87,"in_reply_to":"da86d52c_191185af","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"That\u0027s neat, but how do I revoke an KLWT token that isn\u0027t stored?"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Token revocation can be handled through revocation events, which can be built"},{"line_number":88,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":89,"context_line":"the KLWT token driver can build a rule that will describe a token to revoke. An"},{"line_number":90,"context_line":"example being, revoke all tokens from user XYZ before this point in time. The"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_28fd10b2","line":87,"in_reply_to":"da86d52c_b9ca3944","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ccead3be29c3c668fc3fa56c7d59d18ee5b520dd","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Token revocation can be handled through revocation events, which can be built"},{"line_number":88,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":89,"context_line":"the KLWT token driver can build a rule that will describe a token to revoke. An"},{"line_number":90,"context_line":"example being, revoke all tokens from user XYZ before this point in time. The"},{"line_number":91,"context_line":"next time the user sends the now revoked token to Keystone, the validate call"},{"line_number":92,"context_line":"will check the token information against the revocation rules and if a"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_5934dd49","line":89,"updated":"2015-02-16 18:32:54.000000000","message":"(NIT) \"can\" -\u003e \"will\"","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Token revocation can be handled through revocation events, which can be built"},{"line_number":88,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":89,"context_line":"the KLWT token driver can build a rule that will describe a token to revoke. An"},{"line_number":90,"context_line":"example being, revoke all tokens from user XYZ before this point in time. The"},{"line_number":91,"context_line":"next time the user sends the now revoked token to Keystone, the validate call"},{"line_number":92,"context_line":"will check the token information against the revocation rules and if a"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_08192c22","line":89,"in_reply_to":"da86d52c_5934dd49","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ccead3be29c3c668fc3fa56c7d59d18ee5b520dd","unresolved":false,"context_lines":[{"line_number":92,"context_line":"will check the token information against the revocation rules and if a"},{"line_number":93,"context_line":"revocation rule matches the information decrypted from the token, return 401."},{"line_number":94,"context_line":"Revocation events can be cleaned up anytime after the default token expiration"},{"line_number":95,"context_line":"time has lapsed, since the revocation rule was created."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"In the event that more information is needed in the token, like federation, the"},{"line_number":98,"context_line":"existing KLWT token implementation could be extended to include extra values."}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_3914899e","line":95,"updated":"2015-02-16 18:32:54.000000000","message":"This mostly can be summed up as already implemented, the middleware piece is not currently implemented.","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":92,"context_line":"will check the token information against the revocation rules and if a"},{"line_number":93,"context_line":"revocation rule matches the information decrypted from the token, return 401."},{"line_number":94,"context_line":"Revocation events can be cleaned up anytime after the default token expiration"},{"line_number":95,"context_line":"time has lapsed, since the revocation rule was created."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"In the event that more information is needed in the token, like federation, the"},{"line_number":98,"context_line":"existing KLWT token implementation could be extended to include extra values."}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_68bc68dc","line":95,"in_reply_to":"da86d52c_3914899e","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"21bd24d746247cd91e76fbae3e38771340f66ac7","unresolved":false,"context_lines":[{"line_number":94,"context_line":"Revocation events can be cleaned up anytime after the default token expiration"},{"line_number":95,"context_line":"time has lapsed, since the revocation rule was created."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"In the event that more information is needed in the token, like federation, the"},{"line_number":98,"context_line":"existing KLWT token implementation could be extended to include extra values."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_59821dc9","line":97,"updated":"2015-02-16 18:31:45.000000000","message":"I think you can drop this now, as it is covered by the scope section above.","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":94,"context_line":"Revocation events can be cleaned up anytime after the default token expiration"},{"line_number":95,"context_line":"time has lapsed, since the revocation rule was created."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"In the event that more information is needed in the token, like federation, the"},{"line_number":98,"context_line":"existing KLWT token implementation could be extended to include extra values."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_48b964eb","line":97,"in_reply_to":"da86d52c_59821dc9","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"21bd24d746247cd91e76fbae3e38771340f66ac7","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"None"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Security Impact ---------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":108,"context_line":"consider include:"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_b966b953","line":105,"updated":"2015-02-16 18:31:45.000000000","message":"editing error on the underline","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"None"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Security Impact ---------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":108,"context_line":"consider include:"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_c8cc748d","line":105,"in_reply_to":"da86d52c_b966b953","updated":"2015-02-16 19:18:36.000000000","message":"Done","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ccead3be29c3c668fc3fa56c7d59d18ee5b520dd","unresolved":false,"context_lines":[{"line_number":157,"context_line":"Performance Impact"},{"line_number":158,"context_line":"------------------"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"By using an KLWT token driver, Keystone performance should not decay as the"},{"line_number":161,"context_line":"deployment size increases. In large Keystone deployments where tokens are"},{"line_number":162,"context_line":"persisted to a backend, a performance hit may be observed as token creation"},{"line_number":163,"context_line":"increases in scale. Instead of scaling a persistent storage solution for"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_798521ce","line":160,"updated":"2015-02-16 18:32:54.000000000","message":"(NIT) \"decay\" -\u003e \"decline\"","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ccead3be29c3c668fc3fa56c7d59d18ee5b520dd","unresolved":false,"context_lines":[{"line_number":221,"context_line":""},{"line_number":222,"context_line":"`Token Provider Cleanup \u003chttps://blueprints.launchpad"},{"line_number":223,"context_line":".net/keystone/+spec/token-provider-cleanup\u003e`_"},{"line_number":224,"context_line":"Support for revocation events that work with a KLWT token implementation."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"Documentation Impact"},{"line_number":227,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_79ea8175","line":224,"updated":"2015-02-16 18:32:54.000000000","message":"Go ahead and remove this as a hard requirement. KLWT can land in either case.\n\nDoes this currently depend on keyczar?","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d82ff3d635c4a4adad328236e4bd592f479658ae","unresolved":false,"context_lines":[{"line_number":221,"context_line":""},{"line_number":222,"context_line":"`Token Provider Cleanup \u003chttps://blueprints.launchpad"},{"line_number":223,"context_line":".net/keystone/+spec/token-provider-cleanup\u003e`_"},{"line_number":224,"context_line":"Support for revocation events that work with a KLWT token implementation."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"Documentation Impact"},{"line_number":227,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":28,"id":"da86d52c_28c27053","line":224,"in_reply_to":"da86d52c_79ea8175","updated":"2015-02-16 19:18:36.000000000","message":"Yes","commit_id":"11a072a72a913e87adafdffc4728b4e0321aabeb"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"c5adb5accb789383e01a4384236960289c99eeda","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp klw-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"KLWT tokens provide a way to use to represent a token, allowing for tokens to"},{"line_number":14,"context_line":"be non-persistent. KLWT tokens provide integrity and confidentiality by being"},{"line_number":15,"context_line":"signed, and possibly encrypted, by Keystone. KLWT tokens contain some amount of"},{"line_number":16,"context_line":"token information, including the user, the issued at time, the expiration time,"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_f3b924ed","line":13,"updated":"2015-02-17 03:05:35.000000000","message":"\"a way to use to represent a token\"  \u003c-- I think there is a typo there","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp klw-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"KLWT tokens provide a way to use to represent a token, allowing for tokens to"},{"line_number":14,"context_line":"be non-persistent. KLWT tokens provide integrity and confidentiality by being"},{"line_number":15,"context_line":"signed, and possibly encrypted, by Keystone. KLWT tokens contain some amount of"},{"line_number":16,"context_line":"token information, including the user, the issued at time, the expiration time,"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_dc0b31d3","line":13,"in_reply_to":"da86d52c_f3b924ed","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"c5adb5accb789383e01a4384236960289c99eeda","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp klw-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"KLWT tokens provide a way to use to represent a token, allowing for tokens to"},{"line_number":14,"context_line":"be non-persistent. KLWT tokens provide integrity and confidentiality by being"},{"line_number":15,"context_line":"signed, and possibly encrypted, by Keystone. KLWT tokens contain some amount of"},{"line_number":16,"context_line":"token information, including the user, the issued at time, the expiration time,"},{"line_number":17,"context_line":"and the digest of the signed information."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_3382dc00","line":14,"updated":"2015-02-17 03:05:35.000000000","message":"Since encryption is optional, you only get confidentiality when it is used. So either rewrite to say potential confidentiality (when encryption is used) or remove the word confidentiality","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp klw-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"KLWT tokens provide a way to use to represent a token, allowing for tokens to"},{"line_number":14,"context_line":"be non-persistent. KLWT tokens provide integrity and confidentiality by being"},{"line_number":15,"context_line":"signed, and possibly encrypted, by Keystone. KLWT tokens contain some amount of"},{"line_number":16,"context_line":"token information, including the user, the issued at time, the expiration time,"},{"line_number":17,"context_line":"and the digest of the signed information."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_be304308","line":14,"in_reply_to":"da86d52c_3382dc00","updated":"2015-02-17 14:07:57.000000000","message":"Agree with Brad on \"optionally provide confidentiality\". Would also state that KLWT provide authenticity as that\u0027s essential.","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp klw-tokens \u003chttps://blueprints.launchpad.net/keystone/+spec/ae-tokens\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"KLWT tokens provide a way to use to represent a token, allowing for tokens to"},{"line_number":14,"context_line":"be non-persistent. KLWT tokens provide integrity and confidentiality by being"},{"line_number":15,"context_line":"signed, and possibly encrypted, by Keystone. KLWT tokens contain some amount of"},{"line_number":16,"context_line":"token information, including the user, the issued at time, the expiration time,"},{"line_number":17,"context_line":"and the digest of the signed information."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_3ccb6d73","line":14,"in_reply_to":"da86d52c_be304308","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"c5adb5accb789383e01a4384236960289c99eeda","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"One way to avoid issues with massive amounts of tokens stored in a backend"},{"line_number":32,"context_line":"is to not store tokens at all. KLWT tokens will provide a way for deployers to"},{"line_number":33,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":34,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":35,"context_line":"the KLWT token provider will pull the absolute minimum amount of information"},{"line_number":36,"context_line":"about the user out of the request, generate a token containing this data and"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_b375ec33","line":33,"updated":"2015-02-17 03:05:35.000000000","message":"performance should be performance degradation","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"One way to avoid issues with massive amounts of tokens stored in a backend"},{"line_number":32,"context_line":"is to not store tokens at all. KLWT tokens will provide a way for deployers to"},{"line_number":33,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":34,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":35,"context_line":"the KLWT token provider will pull the absolute minimum amount of information"},{"line_number":36,"context_line":"about the user out of the request, generate a token containing this data and"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_1c7ce91f","line":33,"in_reply_to":"da86d52c_b375ec33","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":31,"context_line":"One way to avoid issues with massive amounts of tokens stored in a backend"},{"line_number":32,"context_line":"is to not store tokens at all. KLWT tokens will provide a way for deployers to"},{"line_number":33,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":34,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":35,"context_line":"the KLWT token provider will pull the absolute minimum amount of information"},{"line_number":36,"context_line":"about the user out of the request, generate a token containing this data and"},{"line_number":37,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_c1fef804","line":34,"updated":"2015-02-17 14:07:57.000000000","message":"Think this should be switched to KLWT token driver.","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":31,"context_line":"One way to avoid issues with massive amounts of tokens stored in a backend"},{"line_number":32,"context_line":"is to not store tokens at all. KLWT tokens will provide a way for deployers to"},{"line_number":33,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":34,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":35,"context_line":"the KLWT token provider will pull the absolute minimum amount of information"},{"line_number":36,"context_line":"about the user out of the request, generate a token containing this data and"},{"line_number":37,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_5c72e14a","line":34,"in_reply_to":"da86d52c_c1fef804","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":32,"context_line":"is to not store tokens at all. KLWT tokens will provide a way for deployers to"},{"line_number":33,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":34,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":35,"context_line":"the KLWT token provider will pull the absolute minimum amount of information"},{"line_number":36,"context_line":"about the user out of the request, generate a token containing this data and"},{"line_number":37,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"},{"line_number":38,"context_line":"the information can be compressed."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_c1e8b818","line":35,"updated":"2015-02-17 14:07:57.000000000","message":"Don\u0027t necessarily think you should state \"absolute minimum\" as that artificially, and needlessly, restricts the data that can be placed in the token. Some implementors may want to include some data that is technically not essential per se, but valuable for that provider. Also, it\u0027s not just about the user.\n\nInstead suggest something like \"... will pull a minimal amount of information about the authentication...\" or \"...will pull a subset of information about the authentication...\"","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":32,"context_line":"is to not store tokens at all. KLWT tokens will provide a way for deployers to"},{"line_number":33,"context_line":"avoid performance and maintenance of tokens backends by using an"},{"line_number":34,"context_line":"Authenticated Encrypted token driver. When authenticating,"},{"line_number":35,"context_line":"the KLWT token provider will pull the absolute minimum amount of information"},{"line_number":36,"context_line":"about the user out of the request, generate a token containing this data and"},{"line_number":37,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"},{"line_number":38,"context_line":"the information can be compressed."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_dc95f132","line":35,"in_reply_to":"da86d52c_c1e8b818","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":37,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"},{"line_number":38,"context_line":"the information can be compressed."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"An example of this would look similar to the following::"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"  payload \u003d [scope_type, scope, user_id, created_at, expires_at, audit_id]"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_c10438c8","line":40,"updated":"2015-02-17 14:07:57.000000000","message":"To help clarify that this is an example only, I suggest explicitly stating that these fields are NOT being prescribed by the spec. \n\nPerhaps \"Although not to be considered prescribed by this spec, an example of this could look similar to the following:\"\n\nYes, I realize the word \"example\" is used here, but given the amount of time I\u0027ve seen people discuss this very example...\n\nThat said, if there is information that MUST be included in ALL tokens regardless of the driver/formatter in order to be called a KLWT, it should be stated outright in this spec rather than wrapped in ambiguous \"example\" language. \n\nFor example, \"created_at\" may be a required field depending on how the revocation works (e.g. - expire all tokens issued before date/time X). While some may state that this is not required because it could be calculated based solely on the expiration date, that\u0027s only if token TTL is a constant which, in various scenarios, isn\u0027t the case.","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":37,"context_line":"return it to the user. To ensure we keep the tokens to a reasonable length,"},{"line_number":38,"context_line":"the information can be compressed."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"An example of this would look similar to the following::"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"  payload \u003d [scope_type, scope, user_id, created_at, expires_at, audit_id]"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_dce331d6","line":40,"in_reply_to":"da86d52c_c10438c8","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"d61643b487218aa72e1b6b817cc562035051fb45","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"An example of this would look similar to the following::"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"  payload \u003d [scope_type, scope, user_id, created_at, expires_at, audit_id]"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Where the values are:"},{"line_number":45,"context_line":"* ``scope_type``: Scope type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_0e0bd02b","line":42,"updated":"2015-02-17 18:20:39.000000000","message":"This is what will be return as part of token request from Keystone?\nIf that is the case how the client will know the endpoints.?","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"An example of this would look similar to the following::"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"  payload \u003d [scope_type, scope, user_id, created_at, expires_at, audit_id]"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Where the values are:"},{"line_number":45,"context_line":"* ``scope_type``: Scope type to determine the type of the token"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_3cac4ded","line":42,"in_reply_to":"da86d52c_0e0bd02b","updated":"2015-02-17 19:24:57.000000000","message":"this is the token, not the entire response.","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":55,"context_line":"the token ttl."},{"line_number":56,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Federation tokens will be a special case. We will need a specific formatter to"},{"line_number":59,"context_line":"handle federated tokens. We can determine if we are authenticating in a"},{"line_number":60,"context_line":"federated workflow and use a format version specific to federated tokens. In"},{"line_number":61,"context_line":"that specific format version, we can append the groups necessary for federated"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_2101946a","line":58,"updated":"2015-02-17 14:07:57.000000000","message":"You mention a specific \"formatter\" for fed tokens, but the concept of formatter isn\u0027t discussed at all with respect to how a \"formatter\" fits into the overall KLWT concept. I think this should be explicitly called out and discussed such as the difference between a KLWT formatter and a KLWT driver.\n\nI think this spec should center on things such as:\n- The high level technical aspects of the generation of the token\n- Support for multiple types of formatters\n- Any particular requirements to allow keystone to determine the appropriate driver/formatter to generate a new token\n- Any particular requirements to allow keystone to determine the appropriate driver/formatter to validate an existing token\n- Any particular requirements for a keystone deployer to switch between drivers while still allow previously generated tokens to validate.","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":55,"context_line":"the token ttl."},{"line_number":56,"context_line":"* ``audit_id``: The audit ID for the token."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Federation tokens will be a special case. We will need a specific formatter to"},{"line_number":59,"context_line":"handle federated tokens. We can determine if we are authenticating in a"},{"line_number":60,"context_line":"federated workflow and use a format version specific to federated tokens. In"},{"line_number":61,"context_line":"that specific format version, we can append the groups necessary for federated"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_9c1299b2","line":58,"in_reply_to":"da86d52c_2101946a","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"c5adb5accb789383e01a4384236960289c99eeda","unresolved":false,"context_lines":[{"line_number":59,"context_line":"handle federated tokens. We can determine if we are authenticating in a"},{"line_number":60,"context_line":"federated workflow and use a format version specific to federated tokens. In"},{"line_number":61,"context_line":"that specific format version, we can append the groups necessary for federated"},{"line_number":62,"context_line":"tokens."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"These values can be stored in a list where the KLWT Token driver, or any"},{"line_number":65,"context_line":"validator for that matter, knows the order of the values. The above values can"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_b3ac0c8e","line":62,"updated":"2015-02-17 03:05:35.000000000","message":"Great to see this addressed","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":64,"context_line":"These values can be stored in a list where the KLWT Token driver, or any"},{"line_number":65,"context_line":"validator for that matter, knows the order of the values. The above values can"},{"line_number":66,"context_line":"be packed, possibly encrypted, and encoded. This will result in a ``payload``."},{"line_number":67,"context_line":"To ensure the integrity of the contents, the ``payload`` should be signed with"},{"line_number":68,"context_line":"a mechanism like HMAC. The resulting digest will be included as part of the"},{"line_number":69,"context_line":"token. This is important because we should fast fail if the token has been"},{"line_number":70,"context_line":"tampered with in any way without having to attempt decrypting the spoofed token"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_6139cc3e","line":67,"updated":"2015-02-17 14:07:57.000000000","message":"\"should\" -\u003e \"must\"","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":64,"context_line":"These values can be stored in a list where the KLWT Token driver, or any"},{"line_number":65,"context_line":"validator for that matter, knows the order of the values. The above values can"},{"line_number":66,"context_line":"be packed, possibly encrypted, and encoded. This will result in a ``payload``."},{"line_number":67,"context_line":"To ensure the integrity of the contents, the ``payload`` should be signed with"},{"line_number":68,"context_line":"a mechanism like HMAC. The resulting digest will be included as part of the"},{"line_number":69,"context_line":"token. This is important because we should fast fail if the token has been"},{"line_number":70,"context_line":"tampered with in any way without having to attempt decrypting the spoofed token"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_5c1ca1c2","line":67,"in_reply_to":"da86d52c_6139cc3e","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":66,"context_line":"be packed, possibly encrypted, and encoded. This will result in a ``payload``."},{"line_number":67,"context_line":"To ensure the integrity of the contents, the ``payload`` should be signed with"},{"line_number":68,"context_line":"a mechanism like HMAC. The resulting digest will be included as part of the"},{"line_number":69,"context_line":"token. This is important because we should fast fail if the token has been"},{"line_number":70,"context_line":"tampered with in any way without having to attempt decrypting the spoofed token"},{"line_number":71,"context_line":"only to fail on bogus token values."},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_c15fd873","line":69,"updated":"2015-02-17 14:07:57.000000000","message":"This sentence \"This is important...\" makes more sense if you moved it to the next paragraph which talks about the optional encryption and that signing the tokens is still required for integrity.","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":66,"context_line":"be packed, possibly encrypted, and encoded. This will result in a ``payload``."},{"line_number":67,"context_line":"To ensure the integrity of the contents, the ``payload`` should be signed with"},{"line_number":68,"context_line":"a mechanism like HMAC. The resulting digest will be included as part of the"},{"line_number":69,"context_line":"token. This is important because we should fast fail if the token has been"},{"line_number":70,"context_line":"tampered with in any way without having to attempt decrypting the spoofed token"},{"line_number":71,"context_line":"only to fail on bogus token values."},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_9c60d936","line":69,"in_reply_to":"da86d52c_c15fd873","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"c5adb5accb789383e01a4384236960289c99eeda","unresolved":false,"context_lines":[{"line_number":74,"context_line":"information opaque from end users. The important part is that the token data is"},{"line_number":75,"context_line":"signed by Keystone for integrity regardless if the token is encrypted or not."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The user can then use an KLWT token in a normal UUID workflow. When Keystone"},{"line_number":78,"context_line":"receives an KLWT token from a user or a service, it can validate the digest"},{"line_number":79,"context_line":"provided with the token to determine if the token has been tampered with in"},{"line_number":80,"context_line":"transit. This doesn\u0027t require the KLWT token driver to look up any information"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_f394c4e9","line":77,"updated":"2015-02-17 03:05:35.000000000","message":"Nit: an should be a","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":74,"context_line":"information opaque from end users. The important part is that the token data is"},{"line_number":75,"context_line":"signed by Keystone for integrity regardless if the token is encrypted or not."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The user can then use an KLWT token in a normal UUID workflow. When Keystone"},{"line_number":78,"context_line":"receives an KLWT token from a user or a service, it can validate the digest"},{"line_number":79,"context_line":"provided with the token to determine if the token has been tampered with in"},{"line_number":80,"context_line":"transit. This doesn\u0027t require the KLWT token driver to look up any information"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_9cc7f911","line":77,"in_reply_to":"da86d52c_f394c4e9","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"c5adb5accb789383e01a4384236960289c99eeda","unresolved":false,"context_lines":[{"line_number":80,"context_line":"transit. This doesn\u0027t require the KLWT token driver to look up any information"},{"line_number":81,"context_line":"from a token backend. The information traditionally stored in the token"},{"line_number":82,"context_line":"backend, like the service catalog, will be computed on demand based on the"},{"line_number":83,"context_line":"scope that is passed in the token."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":86,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_7388d4c6","line":83,"updated":"2015-02-17 03:05:35.000000000","message":"Nice description. So the \"magic\" I believe is the following: Since the digest is validated we can infer we have a valid token.  The token has the user and scoping information. With these two values we can compute both service catalog and roles for the user. Is this all correct?","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":80,"context_line":"transit. This doesn\u0027t require the KLWT token driver to look up any information"},{"line_number":81,"context_line":"from a token backend. The information traditionally stored in the token"},{"line_number":82,"context_line":"backend, like the service catalog, will be computed on demand based on the"},{"line_number":83,"context_line":"scope that is passed in the token."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":86,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_1cdb09ee","line":83,"in_reply_to":"da86d52c_7388d4c6","updated":"2015-02-17 19:24:57.000000000","message":"yes","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"c5adb5accb789383e01a4384236960289c99eeda","unresolved":false,"context_lines":[{"line_number":83,"context_line":"scope that is passed in the token."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":86,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"},{"line_number":87,"context_line":"for the user doesn\u0027t change from the current UUID workflow. The token size will"},{"line_number":88,"context_line":"be bigger than UUID tokens but not as big as a PKI tokens."},{"line_number":89,"context_line":""}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_d3a4204d","line":86,"updated":"2015-02-17 03:05:35.000000000","message":"Why do you say encrypted data? Given encryption is optional shouldn\u0027t you just say data or perhaps say signed data?","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":83,"context_line":"scope that is passed in the token."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"This driver will only require minimum data to verify the user\u0027s"},{"line_number":86,"context_line":"identity. The encrypted data will be included in the user\u0027s token. The workflow"},{"line_number":87,"context_line":"for the user doesn\u0027t change from the current UUID workflow. The token size will"},{"line_number":88,"context_line":"be bigger than UUID tokens but not as big as a PKI tokens."},{"line_number":89,"context_line":""}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_9cee198a","line":86,"in_reply_to":"da86d52c_d3a4204d","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"c5adb5accb789383e01a4384236960289c99eeda","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"That\u0027s neat, but how do I revoke an KLWT token that isn\u0027t stored?"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Token revocation will be handled through revocation events, which is be built"},{"line_number":93,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":94,"context_line":"the KLWT token driver will build a rule that will describe a token to revoke."},{"line_number":95,"context_line":"An example being, revoke all tokens from user XYZ before this point in time."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_1366b829","line":92,"updated":"2015-02-17 03:05:35.000000000","message":"Nit: put \"is be\" should be \"is to be\"","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"That\u0027s neat, but how do I revoke an KLWT token that isn\u0027t stored?"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Token revocation will be handled through revocation events, which is be built"},{"line_number":93,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":94,"context_line":"the KLWT token driver will build a rule that will describe a token to revoke."},{"line_number":95,"context_line":"An example being, revoke all tokens from user XYZ before this point in time."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_dc409161","line":92,"in_reply_to":"da86d52c_1366b829","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":90,"context_line":"That\u0027s neat, but how do I revoke an KLWT token that isn\u0027t stored?"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Token revocation will be handled through revocation events, which is be built"},{"line_number":93,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":94,"context_line":"the KLWT token driver will build a rule that will describe a token to revoke."},{"line_number":95,"context_line":"An example being, revoke all tokens from user XYZ before this point in time."},{"line_number":96,"context_line":"The next time the user sends the now revoked token to Keystone, the validate"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_047c9e71","line":93,"updated":"2015-02-17 14:07:57.000000000","message":"\"built of\" -\u003e \"built off\"\n\nI\u0027m not familiar with the revocation event system. Suggest putting a link or something here so those unfamiliar with it can easily go review. \n\nIs the existing system sufficient, in an of itself, to support the revocation events that KLWT requires? You include an example here, but should we explicitly list the minimal set of revocation use cases that KLWT requires?\n\nFor example,\n- explicitly revoke individual token\n- revoke all tokens from user XYQ created before datetime ABC","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":90,"context_line":"That\u0027s neat, but how do I revoke an KLWT token that isn\u0027t stored?"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Token revocation will be handled through revocation events, which is be built"},{"line_number":93,"context_line":"of the existing revocation event system. When a user token has been revoked,"},{"line_number":94,"context_line":"the KLWT token driver will build a rule that will describe a token to revoke."},{"line_number":95,"context_line":"An example being, revoke all tokens from user XYZ before this point in time."},{"line_number":96,"context_line":"The next time the user sends the now revoked token to Keystone, the validate"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_1c5ea945","line":93,"in_reply_to":"da86d52c_047c9e71","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":95,"context_line":"An example being, revoke all tokens from user XYZ before this point in time."},{"line_number":96,"context_line":"The next time the user sends the now revoked token to Keystone, the validate"},{"line_number":97,"context_line":"call will check the token information against the revocation rules and if a"},{"line_number":98,"context_line":"revocation rule matches the information decrypted from the token, return 401."},{"line_number":99,"context_line":"Revocation events can be cleaned up anytime after the default token expiration"},{"line_number":100,"context_line":"time has lapsed, since the revocation rule was created. This work and framework"},{"line_number":101,"context_line":"is already in place, but the middleware just needs a way to get the latest"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_04f3be0a","line":98,"updated":"2015-02-17 14:07:57.000000000","message":"\"decrypted from\" -\u003e \"included in\"","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  Yes, identity and authorization data will be encrypted, compressed and"},{"line_number":119,"context_line":"  returned to the API user instead of stored in a token backend."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* Does this change alter the API in a way that may impact security, such as a"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_e4d22a5a","line":118,"updated":"2015-02-17 14:07:57.000000000","message":"\"optionally encrypted\"","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  Yes, identity and authorization data will be encrypted, compressed and"},{"line_number":119,"context_line":"  returned to the API user instead of stored in a token backend."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* Does this change alter the API in a way that may impact security, such as a"}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_fc3c75e3","line":118,"in_reply_to":"da86d52c_e4d22a5a","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":124,"context_line":"  It shouldn\u0027t, all the same data will be required for authenticating and"},{"line_number":125,"context_line":"  validating against Keystone."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"  Yes, this change involves cryptography to protect the user\u0027s information and"},{"line_number":130,"context_line":"  hashing to verify. Keyczar can be used to handle KLWTS encryption."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_849ece61","line":127,"updated":"2015-02-17 14:07:57.000000000","message":"NIT: isn\u0027t hashing considered a subset of cryptography?","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":124,"context_line":"  It shouldn\u0027t, all the same data will be required for authenticating and"},{"line_number":125,"context_line":"  validating against Keystone."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"  Yes, this change involves cryptography to protect the user\u0027s information and"},{"line_number":130,"context_line":"  hashing to verify. Keyczar can be used to handle KLWTS encryption."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_9ce9b91c","line":127,"in_reply_to":"da86d52c_849ece61","updated":"2015-02-17 19:24:57.000000000","message":"It\u0027s part of the spec template.","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":13729,"name":"Bob Jacoby","email":"jacorob@gmail.com"},"change_message_id":"ca82b8a1b02d588151d839fb239063160a866ff4","unresolved":false,"context_lines":[{"line_number":217,"context_line":"----------"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"* Clean up the current token provider api such that it\u0027s easier to extend to"},{"line_number":220,"context_line":"  differnt token formats."},{"line_number":221,"context_line":"* Allow revocation events for KLWT tokens (i.e. pattern matching)"},{"line_number":222,"context_line":"* Add a new token driver for KLWT tokens and test."},{"line_number":223,"context_line":"* Document the process for setting up an KLWT token implementation."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_c487e610","line":220,"updated":"2015-02-17 14:07:57.000000000","message":"NIT: different","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3a2307cb583ee09971b4875bb8f5b32328e20e2","unresolved":false,"context_lines":[{"line_number":217,"context_line":"----------"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"* Clean up the current token provider api such that it\u0027s easier to extend to"},{"line_number":220,"context_line":"  differnt token formats."},{"line_number":221,"context_line":"* Allow revocation events for KLWT tokens (i.e. pattern matching)"},{"line_number":222,"context_line":"* Add a new token driver for KLWT tokens and test."},{"line_number":223,"context_line":"* Document the process for setting up an KLWT token implementation."}],"source_content_type":"text/x-rst","patch_set":32,"id":"da86d52c_7cffa502","line":220,"in_reply_to":"da86d52c_c487e610","updated":"2015-02-17 19:24:57.000000000","message":"Done","commit_id":"910d05555e21f1eb7a7e47a68a3e6d5d110ad282"}]}