)]}'
{"specs/kilo/refresh-token.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9470ae748e69aec2b217f5d22ccc948592989bf6","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp refresh-token \u003chttps://blueprints.launchpad.net/keystone/+spec/refresh-token\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"A refresh token can be used to acquire an existing access token with the same"},{"line_number":14,"context_line":"scope to access a protected resource on behalf of a user. A refresh token can"},{"line_number":15,"context_line":"be requested until the token is within the refresh window. The refresh window"},{"line_number":16,"context_line":"is the expiration that determines the length of time that a user is able to"},{"line_number":17,"context_line":"retrieve an existing access token."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_36192c7a","line":14,"updated":"2014-10-29 16:11:42.000000000","message":"I would say the following does a nice job of introducing what you\u0027re trying to do: \n\n    A refresh token can be used to acquire an existing access token with the same scope to access a protected resource on behalf of a user.\n\nThe rest seems to be details about the implementation that you can elaborate on in greater detail later in the spec (under Proposed Change possibly)","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"dcac1601542bd6a1f92aee13a9e58b5c9f50131f","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp refresh-token \u003chttps://blueprints.launchpad.net/keystone/+spec/refresh-token\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"A refresh token can be used to acquire an existing access token with the same"},{"line_number":14,"context_line":"scope to access a protected resource on behalf of a user. A refresh token can"},{"line_number":15,"context_line":"be requested until the token is within the refresh window. The refresh window"},{"line_number":16,"context_line":"is the expiration that determines the length of time that a user is able to"},{"line_number":17,"context_line":"retrieve an existing access token."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_3eac9e8c","line":14,"in_reply_to":"9aa7fdbe_36192c7a","updated":"2014-10-29 19:54:15.000000000","message":"Done","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9470ae748e69aec2b217f5d22ccc948592989bf6","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"The goal of a refresh token is to limit the amount to tokens created. It will"},{"line_number":23,"context_line":"also reduce the write operations being done to a backends."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_76781490","line":23,"updated":"2014-10-29 16:11:42.000000000","message":"This is a good description of the goal, but what kind of problems does generating a token on every auth request cost us?","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"dcac1601542bd6a1f92aee13a9e58b5c9f50131f","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"The goal of a refresh token is to limit the amount to tokens created. It will"},{"line_number":23,"context_line":"also reduce the write operations being done to a backends."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_5ea9627a","line":23,"in_reply_to":"9aa7fdbe_76781490","updated":"2014-10-29 19:54:15.000000000","message":"Done","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9470ae748e69aec2b217f5d22ccc948592989bf6","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Add feature flag for refresh tokens."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Add logic to auth controllers to return an existing access token matching the"},{"line_number":31,"context_line":"authenticate request\u0027s scope."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_967bb87a","line":28,"updated":"2014-10-29 16:11:42.000000000","message":"Would this be a configuration change to the Keystone configuration file (keystone.conf) or the paste file (keystone-paste.ini)?","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"dcac1601542bd6a1f92aee13a9e58b5c9f50131f","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Add feature flag for refresh tokens."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Add logic to auth controllers to return an existing access token matching the"},{"line_number":31,"context_line":"authenticate request\u0027s scope."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_7eb546cf","line":28,"in_reply_to":"9aa7fdbe_967bb87a","updated":"2014-10-29 19:54:15.000000000","message":"Done","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9470ae748e69aec2b217f5d22ccc948592989bf6","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Add logic to auth controllers to return an existing access token matching the"},{"line_number":31,"context_line":"authenticate request\u0027s scope."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Add logic to token backend to get a token by scope that fall within the"},{"line_number":34,"context_line":"refresh window."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_96f2d804","line":33,"updated":"2014-10-29 16:11:42.000000000","message":"falls*","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"dcac1601542bd6a1f92aee13a9e58b5c9f50131f","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Add logic to auth controllers to return an existing access token matching the"},{"line_number":31,"context_line":"authenticate request\u0027s scope."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Add logic to token backend to get a token by scope that fall within the"},{"line_number":34,"context_line":"refresh window."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_79872013","line":33,"in_reply_to":"9aa7fdbe_96f2d804","updated":"2014-10-29 19:54:15.000000000","message":"Done","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9470ae748e69aec2b217f5d22ccc948592989bf6","unresolved":false,"context_lines":[{"line_number":31,"context_line":"authenticate request\u0027s scope."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Add logic to token backend to get a token by scope that fall within the"},{"line_number":34,"context_line":"refresh window."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Alternatives"},{"line_number":37,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_16bd0803","line":34,"updated":"2014-10-29 16:11:42.000000000","message":"So, this will only return tokens iff they have the same scope provided in the request?","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"dcac1601542bd6a1f92aee13a9e58b5c9f50131f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"authenticate request\u0027s scope."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Add logic to token backend to get a token by scope that fall within the"},{"line_number":34,"context_line":"refresh window."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Alternatives"},{"line_number":37,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_5e8c0280","line":34,"in_reply_to":"9aa7fdbe_16bd0803","updated":"2014-10-29 19:54:15.000000000","message":"Correct.","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9470ae748e69aec2b217f5d22ccc948592989bf6","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Alternatives"},{"line_number":37,"context_line":"------------"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Create a filter."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Security Impact"},{"line_number":42,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_f646c420","line":39,"updated":"2014-10-29 16:11:42.000000000","message":"This is an extension, correct?","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9470ae748e69aec2b217f5d22ccc948592989bf6","unresolved":false,"context_lines":[{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* Implement backend method to search token by scope"},{"line_number":131,"context_line":"* Add flag to Keystone configuration file"},{"line_number":132,"context_line":"* Add logic to return refresh token"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Dependencies"},{"line_number":135,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_9625785e","line":132,"updated":"2014-10-29 16:11:42.000000000","message":"I would also add a bullet point here: \n\n    * Add user/deployer documentation for configuring refresh tokens","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"dcac1601542bd6a1f92aee13a9e58b5c9f50131f","unresolved":false,"context_lines":[{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* Implement backend method to search token by scope"},{"line_number":131,"context_line":"* Add flag to Keystone configuration file"},{"line_number":132,"context_line":"* Add logic to return refresh token"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Dependencies"},{"line_number":135,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_399e7864","line":132,"in_reply_to":"9aa7fdbe_9625785e","updated":"2014-10-29 19:54:15.000000000","message":"Done","commit_id":"f603f7c883edab387a5b7bba730d3513772c4104"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"6fe0461aad66b10cc4b0ab5f361d4cc67b22433f","unresolved":false,"context_lines":[{"line_number":20,"context_line":"refresh token is to allow keystone a way to reuse valid token, limit the amount"},{"line_number":21,"context_line":"of tokens created, and reduce the write operations being done to a backend."},{"line_number":22,"context_line":"Having a refresh token mechanism will provide keystone a way to alleviate"},{"line_number":23,"context_line":"stress on the backend when getting hammered with authentication request."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_09f3059f","line":23,"updated":"2014-11-03 14:49:19.000000000","message":"s/request/requests","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"3b7c0d08bbcf9255f8160a298bdaca0b8b5dab05","unresolved":false,"context_lines":[{"line_number":20,"context_line":"refresh token is to allow keystone a way to reuse valid token, limit the amount"},{"line_number":21,"context_line":"of tokens created, and reduce the write operations being done to a backend."},{"line_number":22,"context_line":"Having a refresh token mechanism will provide keystone a way to alleviate"},{"line_number":23,"context_line":"stress on the backend when getting hammered with authentication request."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_03f4b985","line":23,"in_reply_to":"7a8c0949_09f3059f","updated":"2014-11-05 14:57:17.000000000","message":"Done","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"9fcdf64e9f355cd2ed2eb18fd3171bbd3e6c9cf7","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Add logic to auth controllers to return an existing access token matching the"},{"line_number":32,"context_line":"authenticate request\u0027s scope. A refresh token can be requested while an"},{"line_number":33,"context_line":"existing token is within the refresh window. The refresh window is the"},{"line_number":34,"context_line":"expiration that determines the length of time that a user is able to retrieve"},{"line_number":35,"context_line":"an existing access token."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Add logic to the token backend driver to get a token by scope that falls"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_7a09a9dc","line":34,"updated":"2014-11-03 18:38:28.000000000","message":"Can you also include  \"number of times\" + refresh window.?\n\nSay I get a token at 4:00 and  the refresh windows  in 45 min.  An attacker can easily get a token every 44th minute to have a token which is always valid","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"3b7c0d08bbcf9255f8160a298bdaca0b8b5dab05","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Add logic to auth controllers to return an existing access token matching the"},{"line_number":32,"context_line":"authenticate request\u0027s scope. A refresh token can be requested while an"},{"line_number":33,"context_line":"existing token is within the refresh window. The refresh window is the"},{"line_number":34,"context_line":"expiration that determines the length of time that a user is able to retrieve"},{"line_number":35,"context_line":"an existing access token."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Add logic to the token backend driver to get a token by scope that falls"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_106401e4","line":34,"in_reply_to":"7a8c0949_7a09a9dc","updated":"2014-11-05 14:57:17.000000000","message":"In order to get a refresh token, a user still needs to do a valid authenticate request. In this case it means that the user\u0027s credentials have been compromised, right? Even without the refreshed token, if the attacker know the user\u0027s credentials he can always get a new token. If the attacker got the token by spoofing, we can always revoke the token.","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"6fe0461aad66b10cc4b0ab5f361d4cc67b22433f","unresolved":false,"context_lines":[{"line_number":41,"context_line":"------------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Create a middleware, only downside would be the refactoring involving"},{"line_number":44,"context_line":"request validation and binding operations."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Security Impact"},{"line_number":47,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_895b7586","line":44,"updated":"2014-11-03 14:49:19.000000000","message":"What middleware? could you elaborate more on this? or be more specific.","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"3b7c0d08bbcf9255f8160a298bdaca0b8b5dab05","unresolved":false,"context_lines":[{"line_number":41,"context_line":"------------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Create a middleware, only downside would be the refactoring involving"},{"line_number":44,"context_line":"request validation and binding operations."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Security Impact"},{"line_number":47,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_23f3759f","line":44,"in_reply_to":"7a8c0949_895b7586","updated":"2014-11-05 14:57:17.000000000","message":"Done","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"6fe0461aad66b10cc4b0ab5f361d4cc67b22433f","unresolved":false,"context_lines":[{"line_number":56,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":57,"context_line":"  a new way to access sensitive information or a new way to login?"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"  Yes, authenticating within the refresh window will return an existing token."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_89a0d544","line":59,"updated":"2014-11-03 14:49:19.000000000","message":"Well, it wouldn\u0027t really affect the API by itself, right? What would happen is that you would just get the same token as before. But as far as I understood this wouldn\u0027t really affect the API, as it doesn\u0027t really take off or add fields to it.","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"3b7c0d08bbcf9255f8160a298bdaca0b8b5dab05","unresolved":false,"context_lines":[{"line_number":56,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":57,"context_line":"  a new way to access sensitive information or a new way to login?"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"  Yes, authenticating within the refresh window will return an existing token."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_43eec1b5","line":59,"in_reply_to":"7a8c0949_89a0d544","updated":"2014-11-05 14:57:17.000000000","message":"Done","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"6fe0461aad66b10cc4b0ab5f361d4cc67b22433f","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  of this include launching subprocesses for each connection, or entity"},{"line_number":77,"context_line":"  expansion attacks in XML."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"  No"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Notifications Impact"},{"line_number":82,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_49c8ad22","line":79,"updated":"2014-11-03 14:49:19.000000000","message":"Instead of having the template\u0027s questions being answered, could you put some paragraphs explaining in a more detailed and verbose way the actual security impacts that this feature brings?","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"3b7c0d08bbcf9255f8160a298bdaca0b8b5dab05","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  of this include launching subprocesses for each connection, or entity"},{"line_number":77,"context_line":"  expansion attacks in XML."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"  No"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Notifications Impact"},{"line_number":82,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_4f6254ae","line":79,"in_reply_to":"7a8c0949_49c8ad22","updated":"2014-11-05 14:57:17.000000000","message":"Done","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"6fe0461aad66b10cc4b0ab5f361d4cc67b22433f","unresolved":false,"context_lines":[{"line_number":92,"context_line":"------------------"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"An improvement in performance should be expected, since less write operations"},{"line_number":95,"context_line":"will be made against a given backend."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Other Deployer Impact"},{"line_number":98,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_e9ab191c","line":95,"updated":"2014-11-03 14:49:19.000000000","message":"Well, now for every token there will be a search to see if there is a valid token (or one that hasn\u0027t expired); But I guess this operation is more light-weight than writing to the database; specially if in the backend the tokens are indexed in an optimal way... now, are they?","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"3b7c0d08bbcf9255f8160a298bdaca0b8b5dab05","unresolved":false,"context_lines":[{"line_number":92,"context_line":"------------------"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"An improvement in performance should be expected, since less write operations"},{"line_number":95,"context_line":"will be made against a given backend."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Other Deployer Impact"},{"line_number":98,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_6f59d0fd","line":95,"in_reply_to":"7a8c0949_e9ab191c","updated":"2014-11-05 14:57:17.000000000","message":"Done","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"6fe0461aad66b10cc4b0ab5f361d4cc67b22433f","unresolved":false,"context_lines":[{"line_number":111,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"},{"line_number":112,"context_line":"  something that has to be explicitly enabled?"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"  This would be a feature and disabled by default."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Developer Impact"},{"line_number":117,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_09ab051e","line":114,"updated":"2014-11-03 14:49:19.000000000","message":"Same as with the stuff from before, could you put a paragraph instead of answering the questions from the template?","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"3b7c0d08bbcf9255f8160a298bdaca0b8b5dab05","unresolved":false,"context_lines":[{"line_number":111,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"},{"line_number":112,"context_line":"  something that has to be explicitly enabled?"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"  This would be a feature and disabled by default."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Developer Impact"},{"line_number":117,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_8f5c3cef","line":114,"in_reply_to":"7a8c0949_09ab051e","updated":"2014-11-05 14:57:17.000000000","message":"Done","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"6fe0461aad66b10cc4b0ab5f361d4cc67b22433f","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"* Implement backend method to search token by scope"},{"line_number":137,"context_line":"* Add flag to Keystone configuration file"},{"line_number":138,"context_line":"* Add logic to return refresh token"},{"line_number":139,"context_line":"* Add user/deployer documentation for configuring refresh tokens"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_494b4d87","line":138,"updated":"2014-11-03 14:49:19.000000000","message":"* the refreshed token?","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"3b7c0d08bbcf9255f8160a298bdaca0b8b5dab05","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"* Implement backend method to search token by scope"},{"line_number":137,"context_line":"* Add flag to Keystone configuration file"},{"line_number":138,"context_line":"* Add logic to return refresh token"},{"line_number":139,"context_line":"* Add user/deployer documentation for configuring refresh tokens"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_cf6d649b","line":138,"in_reply_to":"7a8c0949_494b4d87","updated":"2014-11-05 14:57:17.000000000","message":"Done","commit_id":"c854834d5668d03d80704dec41d3f4f31266acc9"}],"specs/kilo/token-reuse.rst":[{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"147f51cc9550906aa095ece2c1403f6cc31d8d99","unresolved":false,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"* Implement backend method to search token by scope"},{"line_number":145,"context_line":"* Add flag to enable/disable token reuse in the keystone.conf file"},{"line_number":146,"context_line":"* Add option to set the time for the reuse window in the keystone.conf file"},{"line_number":147,"context_line":"* Add logic to return an existing access token"},{"line_number":148,"context_line":"* Add user/deployer documentation for configuring token reuse"},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a8c0949_c7d7f221","line":146,"updated":"2014-11-06 22:36:01.000000000","message":"You changed the topic. Initially I thought you are going to implement refresh token.  Token reuse is entirely different topic.\n\n1) This needs DB schema change ( please mention that)\n2) You need to store scope of token.  \n3) Basically it is a combination of (user_id , scope , socpe_id(domain/project , methods)","commit_id":"2c8197d293c8215baffd34bf575bbaed2a009663"}]}