)]}'
{"specs/keystone/ongoing/reservations.rst":[{"author":{"_account_id":15742,"name":"Paulo Ewerton Gomes Fragoso","email":"pauloewerton@lsd.ufcg.edu.br","username":"pauloewerton"},"change_message_id":"ecab56ecc9d0c1407c1e408520c9de686156f75a","unresolved":false,"context_lines":[{"line_number":19,"context_line":"the token."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"In this spec we propose a different model to the token forwarding model,"},{"line_number":22,"context_line":"tenantively called Reservations. A reservation is an authorization for a user"},{"line_number":23,"context_line":"to perform one, specific action."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_bdd48047","line":22,"range":{"start_line":22,"start_character":0,"end_line":22,"end_character":11},"updated":"2016-06-21 20:30:23.000000000","message":"tentatively","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"200242156582a1baf782ea98e1645b9a0ec8434d","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Problem Description"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"OpenStack services only communicate with each other over the public REST APIs"},{"line_number":29,"context_line":"that regular users have access to. A side effect of this is when you do service"},{"line_number":30,"context_line":"to service communication it goes through the same token authentication process"},{"line_number":31,"context_line":"regardless of whether the user has previously been validated by another"},{"line_number":32,"context_line":"service."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_bfce1f58","line":29,"range":{"start_line":28,"start_character":0,"end_line":29,"end_character":33},"updated":"2016-06-22 07:39:34.000000000","message":"API exposure is really at the deployer\u0027s discretion. For example, the APIs service by public endpoint maybe different from APIs service by internal or admin endpoints. Per my understanding, the only APIs that deployer is obligated to expose publicly are the ones mandated by defcore.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e39e3972cd77b3431432dc205c94b83e1f95c3d1","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Problem Description"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"OpenStack services only communicate with each other over the public REST APIs"},{"line_number":29,"context_line":"that regular users have access to. A side effect of this is when you do service"},{"line_number":30,"context_line":"to service communication it goes through the same token authentication process"},{"line_number":31,"context_line":"regardless of whether the user has previously been validated by another"},{"line_number":32,"context_line":"service."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_d1ff6265","line":29,"range":{"start_line":28,"start_character":0,"end_line":29,"end_character":33},"in_reply_to":"3aaa91ec_338515ad","updated":"2016-06-23 06:22:41.000000000","message":"What\u0027s internal endpoint for then? If internal endpoint is protected by a tightly-controlled internal network, the only users that can access it are the internal services right? Now imagine you have different policies per endpoint. In other words, authorization get treated differently depending on where the call comes from.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"bf9950824b195154954503513437be9df91171dc","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Problem Description"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"OpenStack services only communicate with each other over the public REST APIs"},{"line_number":29,"context_line":"that regular users have access to. A side effect of this is when you do service"},{"line_number":30,"context_line":"to service communication it goes through the same token authentication process"},{"line_number":31,"context_line":"regardless of whether the user has previously been validated by another"},{"line_number":32,"context_line":"service."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_338515ad","line":29,"range":{"start_line":28,"start_character":0,"end_line":29,"end_character":33},"in_reply_to":"3aaa91ec_bfce1f58","updated":"2016-06-23 00:27:07.000000000","message":"Ok, exposure is a different concept here. What i mean is that there is no back channel way for nova to ask neutron to do something that a user couldn\u0027t call. All functions are expected to be public.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"200242156582a1baf782ea98e1645b9a0ec8434d","unresolved":false,"context_lines":[{"line_number":40,"context_line":"experience for users because the operation may have been running a significant"},{"line_number":41,"context_line":"time before failure occurs. It also presents a difficult rollback operation for"},{"line_number":42,"context_line":"services because initial service to service requests may succeed which then"},{"line_number":43,"context_line":"cannot be rolled back with the expired token."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Proposed Change"},{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_eadd8771","line":43,"updated":"2016-06-22 07:39:34.000000000","message":"This all depends on how the system is setup. When it comes to security, we really need to take the totality of the system into consideration. For example, if the services are communicating with each other over a tightly-controlled internal network, then all the services are really at equal risk. In that case, it may not be a stretch to assume that services are implicitly trusted each other. In that case, it may be acceptable to validate the token once at ingress and trust it throughout the job regardless of its expiration. On the other hand, if the token is compromised and we need to stop the job immediately, do we also need a halt mechanism and do the necessary cleanups?","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e39e3972cd77b3431432dc205c94b83e1f95c3d1","unresolved":false,"context_lines":[{"line_number":40,"context_line":"experience for users because the operation may have been running a significant"},{"line_number":41,"context_line":"time before failure occurs. It also presents a difficult rollback operation for"},{"line_number":42,"context_line":"services because initial service to service requests may succeed which then"},{"line_number":43,"context_line":"cannot be rolled back with the expired token."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Proposed Change"},{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_3169868c","line":43,"in_reply_to":"3aaa91ec_133c59e1","updated":"2016-06-23 06:22:41.000000000","message":"Understood. All I am saying is that Keystone should not dictate how security should be. Keystone merely need to provide the flexibility for deployers to implement a cloud which satisfies their own security and compliance requirements. For example, if a deployer wants to use a shared memcache to facilitate token validation, how\u0027s that any less risky than implicit trust among internal services.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"bf9950824b195154954503513437be9df91171dc","unresolved":false,"context_lines":[{"line_number":40,"context_line":"experience for users because the operation may have been running a significant"},{"line_number":41,"context_line":"time before failure occurs. It also presents a difficult rollback operation for"},{"line_number":42,"context_line":"services because initial service to service requests may succeed which then"},{"line_number":43,"context_line":"cannot be rolled back with the expired token."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Proposed Change"},{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_133c59e1","line":43,"in_reply_to":"3aaa91ec_eadd8771","updated":"2016-06-23 00:27:07.000000000","message":"I proposed ingress only checking as service user permissions [1] and a number of concerns were raised. I don\u0027t think we get to rely on the fact that the deployment was done securely.\n\n\n[1] https://review.openstack.org/#/c/317266/","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"545043cb4a8c4ba94e4c486fbfcb3c0ca3862614","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Proposed Change"},{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"In which he ponders"},{"line_number":49,"context_line":"-------------------"},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1aa78d24_763af935","line":47,"updated":"2016-07-09 20:09:39.000000000","message":"Add in a change that says a token alone will only be accepted within 10 minutes of its issue, but will be accepted in conjunction with ID from a service and we can get rid of most revoations, and drop the \"bearer\" nature of tokens.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"200242156582a1baf782ea98e1645b9a0ec8434d","unresolved":false,"context_lines":[{"line_number":53,"context_line":"would consult the authentication, authorization and quota systems to authorize"},{"line_number":54,"context_line":"the request and forward it to the appropriate service. Interservice"},{"line_number":55,"context_line":"communication would then happen over service APIs that are independant of those"},{"line_number":56,"context_line":"presented to users and does not trigger policy checks again."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"This system would not need to transfer tokens because everything behind the API"},{"line_number":59,"context_line":"layer is trusted, instead it would need to transfer context specific to the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_8ab043f6","line":56,"updated":"2016-06-22 07:39:34.000000000","message":"You mean like Cascading/Tricycle? :-)","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e39e3972cd77b3431432dc205c94b83e1f95c3d1","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"This system would not need to transfer tokens because everything behind the API"},{"line_number":59,"context_line":"layer is trusted, instead it would need to transfer context specific to the"},{"line_number":60,"context_line":"user request being made between all services implementing the request."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"This data is not just context though. By process of creating this data we have"},{"line_number":63,"context_line":"validated the user\u0027s right to perform the operation on the specified resources"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_f136dee5","line":60,"range":{"start_line":60,"start_character":69,"end_line":60,"end_character":70},"updated":"2016-06-23 06:22:41.000000000","message":"This is possible today, with a shared memcache among all the services running within a control plane. With memcache integrity and encryption enabled, all service can share the same key derivation secret and therefore have access to the same ring of memcacheds. Token is validated once at ingress and other services can pull the token from the shared memcache.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d4fb96b8eb1cbb81892c2bb97d44489c7efcad6b","unresolved":false,"context_lines":[{"line_number":69,"context_line":"like this."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Firstly there is no current way to know where a user\u0027s request"},{"line_number":72,"context_line":"entered the deployment. Glance is unaware of whether a user wanted to list"},{"line_number":73,"context_line":"images or if nova is preforming the operation on behalf of a user."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Secondly with only public interfaces we can not simply trust that one service"},{"line_number":76,"context_line":"has correctly forwarded the authentication details as it may be being spoofed"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1aa78d24_20de6b11","line":73,"range":{"start_line":72,"start_character":23,"end_line":73,"end_character":66},"updated":"2016-07-05 05:28:10.000000000","message":"can nova add something to the context or the token, enough information to indicate a service is sending the token over?","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":15742,"name":"Paulo Ewerton Gomes Fragoso","email":"pauloewerton@lsd.ufcg.edu.br","username":"pauloewerton"},"change_message_id":"ecab56ecc9d0c1407c1e408520c9de686156f75a","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Firstly there is no current way to know where a user\u0027s request"},{"line_number":72,"context_line":"entered the deployment. Glance is unaware of whether a user wanted to list"},{"line_number":73,"context_line":"images or if nova is preforming the operation on behalf of a user."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Secondly with only public interfaces we can not simply trust that one service"},{"line_number":76,"context_line":"has correctly forwarded the authentication details as it may be being spoofed"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_fd860812","line":73,"range":{"start_line":73,"start_character":21,"end_line":73,"end_character":31},"updated":"2016-06-21 20:30:23.000000000","message":"performing","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d4fb96b8eb1cbb81892c2bb97d44489c7efcad6b","unresolved":false,"context_lines":[{"line_number":72,"context_line":"entered the deployment. Glance is unaware of whether a user wanted to list"},{"line_number":73,"context_line":"images or if nova is preforming the operation on behalf of a user."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Secondly with only public interfaces we can not simply trust that one service"},{"line_number":76,"context_line":"has correctly forwarded the authentication details as it may be being spoofed"},{"line_number":77,"context_line":"by a user."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"So from a trusted transfer perspective we already have a service (keystone)"},{"line_number":80,"context_line":"that is trusted by all other services and could be used to validate the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1aa78d24_c0c4c760","line":77,"range":{"start_line":75,"start_character":0,"end_line":77,"end_character":10},"updated":"2016-07-05 05:28:10.000000000","message":"thanks for adding this","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":15742,"name":"Paulo Ewerton Gomes Fragoso","email":"pauloewerton@lsd.ufcg.edu.br","username":"pauloewerton"},"change_message_id":"ecab56ecc9d0c1407c1e408520c9de686156f75a","unresolved":false,"context_lines":[{"line_number":85,"context_line":"presented to a service then this operation must be part of a larger ongoing"},{"line_number":86,"context_line":"operation."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"A reservation is therefore singlue use replacement for a token for interservice"},{"line_number":89,"context_line":"communication but that only authenticates the bearer to perform a specific"},{"line_number":90,"context_line":"operation and any flow on operations."},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_5dd11cfb","line":88,"range":{"start_line":88,"start_character":27,"end_line":88,"end_character":34},"updated":"2016-06-21 20:30:23.000000000","message":"single","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d4fb96b8eb1cbb81892c2bb97d44489c7efcad6b","unresolved":false,"context_lines":[{"line_number":85,"context_line":"presented to a service then this operation must be part of a larger ongoing"},{"line_number":86,"context_line":"operation."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"A reservation is therefore singlue use replacement for a token for interservice"},{"line_number":89,"context_line":"communication but that only authenticates the bearer to perform a specific"},{"line_number":90,"context_line":"operation and any flow on operations."},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1aa78d24_409d7758","line":88,"range":{"start_line":88,"start_character":2,"end_line":88,"end_character":79},"updated":"2016-07-05 05:28:10.000000000","message":"single use... what if there is more than one step necessary for the operation?\n\nuser\u0027s token calls nova, which calls glance for images, which calls cinder for volumes and calls neutron for an IP? (or does nova call each of these and one reservation per call?)\n\nis there a scenario where there is indeed multiple steps? image backup to swift?","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9e3d92fc737a4683638005d479e1389577a8f94e","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":"A reservation is therefore singlue use replacement for a token for interservice"},{"line_number":89,"context_line":"communication but that only authenticates the bearer to perform a specific"},{"line_number":90,"context_line":"operation and any flow on operations."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Proposal"},{"line_number":93,"context_line":"--------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_8ec3c2ec","line":90,"range":{"start_line":90,"start_character":18,"end_line":90,"end_character":25},"updated":"2016-06-24 00:35:42.000000000","message":"follow-on","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":15742,"name":"Paulo Ewerton Gomes Fragoso","email":"pauloewerton@lsd.ufcg.edu.br","username":"pauloewerton"},"change_message_id":"ecab56ecc9d0c1407c1e408520c9de686156f75a","unresolved":false,"context_lines":[{"line_number":102,"context_line":"Instead of auth_token middleware validating a token and returning the data"},{"line_number":103,"context_line":"associated with the token auth_token middleware on first receiving a request"},{"line_number":104,"context_line":"with a token will ask keystone to create a reservation and include the details"},{"line_number":105,"context_line":"of the request that are being made. Keystone then issues a reservation to the"},{"line_number":106,"context_line":"service. The reservation contains the majority of data present in the token"},{"line_number":107,"context_line":"however is only valid for a specific operation."},{"line_number":108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_1d9f9404","line":105,"range":{"start_line":105,"start_character":20,"end_line":105,"end_character":23},"updated":"2016-06-21 20:30:23.000000000","message":"is","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e2b05cb27fa6259e40949957ebcbc553038d3d15","unresolved":false,"context_lines":[{"line_number":106,"context_line":"service. The reservation contains the majority of data present in the token"},{"line_number":107,"context_line":"however is only valid for a specific operation."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"A reservation is entirely a service side concept and will never be exposed to"},{"line_number":110,"context_line":"users."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"When a service passes a request to another service instead of passing the user"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_93d082cb","line":109,"updated":"2016-06-27 21:44:59.000000000","message":"This is good to know!","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d4fb96b8eb1cbb81892c2bb97d44489c7efcad6b","unresolved":false,"context_lines":[{"line_number":110,"context_line":"users."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"When a service passes a request to another service instead of passing the user"},{"line_number":113,"context_line":"token it passes the reservation. This is used to signify that the follow on"},{"line_number":114,"context_line":"operation is part of the existing operation. This reservation is validated in a"},{"line_number":115,"context_line":"similar way to a token today."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Walkthrough"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1aa78d24_c0ee87b3","line":114,"range":{"start_line":113,"start_character":9,"end_line":114,"end_character":43},"updated":"2016-07-05 05:28:10.000000000","message":"this goes back to what I asked earlier, what does this information look like? why can\u0027t we add it to the context?","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9e3d92fc737a4683638005d479e1389577a8f94e","unresolved":false,"context_lines":[{"line_number":112,"context_line":"When a service passes a request to another service instead of passing the user"},{"line_number":113,"context_line":"token it passes the reservation. This is used to signify that the follow on"},{"line_number":114,"context_line":"operation is part of the existing operation. This reservation is validated in a"},{"line_number":115,"context_line":"similar way to a token today."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Walkthrough"},{"line_number":118,"context_line":"-----------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_bf7fc664","line":115,"updated":"2016-06-24 00:35:42.000000000","message":"What does a reservation actually look like? How does an admin create a reservation policy? Can you provide an example?","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e2b05cb27fa6259e40949957ebcbc553038d3d15","unresolved":false,"context_lines":[{"line_number":117,"context_line":"Walkthrough"},{"line_number":118,"context_line":"-----------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"For an example we will take nova booting a virtual machine and calling glance:"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Nova receives the user token as today as X-Auth-Token."},{"line_number":123,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_93b52280","line":120,"updated":"2016-06-27 21:44:59.000000000","message":"Have we talked to any of the other OpenStack projects to see if they are willing to use the reservation concept and have they provided feedback on it?","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"c515ff2b2f493a7dfc157e4c1b3aa9c0a215caec","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"* Auth_token middleware uses the service token and the user\u0027s token to create"},{"line_number":125,"context_line":"  a reservation with keystone and receives the reservation data in response."},{"line_number":126,"context_line":"  At this point keystone has the option to validate that this user can perform"},{"line_number":127,"context_line":"  this operation in the deployment."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* Auth_token middleware uses the reservation data to fill the authentication"},{"line_number":130,"context_line":"  headers nova expects today."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_a22c3c4b","line":127,"range":{"start_line":126,"start_character":2,"end_line":127,"end_character":35},"updated":"2016-06-22 10:52:36.000000000","message":"Is this policy ? Isn\u0027t it enforced at service side (with oslo.policy) rather than in keystone ?","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"6717117acb4edc2553b271bc041ca0161eceadb8","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"* Auth_token middleware uses the service token and the user\u0027s token to create"},{"line_number":125,"context_line":"  a reservation with keystone and receives the reservation data in response."},{"line_number":126,"context_line":"  At this point keystone has the option to validate that this user can perform"},{"line_number":127,"context_line":"  this operation in the deployment."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* Auth_token middleware uses the reservation data to fill the authentication"},{"line_number":130,"context_line":"  headers nova expects today."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_54a515b3","line":127,"range":{"start_line":126,"start_character":2,"end_line":127,"end_character":35},"in_reply_to":"3aaa91ec_3308752d","updated":"2016-06-23 10:31:31.000000000","message":"Policies would have to be centralized on keystone, right ?\n\nThis would need to be possible to do (enforce on keystone) at token validation time too, so it doesn\u0027t work just with reservations but also for \"normal\" (not multi-service) operations","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9e3d92fc737a4683638005d479e1389577a8f94e","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"* Auth_token middleware uses the service token and the user\u0027s token to create"},{"line_number":125,"context_line":"  a reservation with keystone and receives the reservation data in response."},{"line_number":126,"context_line":"  At this point keystone has the option to validate that this user can perform"},{"line_number":127,"context_line":"  this operation in the deployment."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* Auth_token middleware uses the reservation data to fill the authentication"},{"line_number":130,"context_line":"  headers nova expects today."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_6933f0f6","line":127,"range":{"start_line":126,"start_character":2,"end_line":127,"end_character":35},"in_reply_to":"3aaa91ec_54a515b3","updated":"2016-06-24 00:35:42.000000000","message":"Yes, we will need centralized policy here. Furthermore, policy merely tells you whether the user can call an API (which may include the query params), but it does not tell which resource the user can act on.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"bf9950824b195154954503513437be9df91171dc","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"* Auth_token middleware uses the service token and the user\u0027s token to create"},{"line_number":125,"context_line":"  a reservation with keystone and receives the reservation data in response."},{"line_number":126,"context_line":"  At this point keystone has the option to validate that this user can perform"},{"line_number":127,"context_line":"  this operation in the deployment."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* Auth_token middleware uses the reservation data to fill the authentication"},{"line_number":130,"context_line":"  headers nova expects today."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_3308752d","line":127,"range":{"start_line":126,"start_character":2,"end_line":127,"end_character":35},"in_reply_to":"3aaa91ec_a22c3c4b","updated":"2016-06-23 00:27:07.000000000","message":"This is indeed policy, and yes currently oslo.policy does that service side. IMO this would be much better but we\u0027d have a long way to go to get there.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"c515ff2b2f493a7dfc157e4c1b3aa9c0a215caec","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"* Auth_token middleware validates with keystone:"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  * the glance service token"},{"line_number":138,"context_line":"  * the nova service token"},{"line_number":139,"context_line":"  * the reservation id"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"  This can all be handled in one request. This validates that only services"},{"line_number":142,"context_line":"  can validate reservations and the X-Service-Token header which is currently"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_05f6fa8e","line":139,"range":{"start_line":137,"start_character":0,"end_line":139,"end_character":22},"updated":"2016-06-22 10:52:36.000000000","message":"Why not simply take glance, nova and user token? Then, if both nova and glance service tokens are valid, the user\u0027s token will always be valid. I am wondering if we need to create a separate concept for this (reservation)\n\nThis way we don\u0027t even need to bother about transport format, etc like we discuss below","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"bf9950824b195154954503513437be9df91171dc","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"* Auth_token middleware validates with keystone:"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  * the glance service token"},{"line_number":138,"context_line":"  * the nova service token"},{"line_number":139,"context_line":"  * the reservation id"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"  This can all be handled in one request. This validates that only services"},{"line_number":142,"context_line":"  can validate reservations and the X-Service-Token header which is currently"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_1621e79f","line":139,"range":{"start_line":137,"start_character":0,"end_line":139,"end_character":22},"in_reply_to":"3aaa91ec_05f6fa8e","updated":"2016-06-23 00:27:07.000000000","message":"Because if the user token is expired there is no way to retrieve the token data from keystone. The API does not support fetching data for expired tokens and depending on the token backend it may not be able to because the information was flushed.\n\nThis was the initial concept in tokyo to skip expiry validation when a service token is present, but it unfortunately isn\u0027t that easy.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"6717117acb4edc2553b271bc041ca0161eceadb8","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"* Auth_token middleware validates with keystone:"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  * the glance service token"},{"line_number":138,"context_line":"  * the nova service token"},{"line_number":139,"context_line":"  * the reservation id"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"  This can all be handled in one request. This validates that only services"},{"line_number":142,"context_line":"  can validate reservations and the X-Service-Token header which is currently"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_949dbd5b","line":139,"range":{"start_line":137,"start_character":0,"end_line":139,"end_character":22},"in_reply_to":"3aaa91ec_1621e79f","updated":"2016-06-23 10:31:31.000000000","message":"What if tokens become expired based on their timeout and only get flushed on what we\u0027re calling reservation timeout (which is higher)?","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9e3d92fc737a4683638005d479e1389577a8f94e","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"* Auth_token middleware validates with keystone:"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  * the glance service token"},{"line_number":138,"context_line":"  * the nova service token"},{"line_number":139,"context_line":"  * the reservation id"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"  This can all be handled in one request. This validates that only services"},{"line_number":142,"context_line":"  can validate reservations and the X-Service-Token header which is currently"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_e96c00d2","line":139,"range":{"start_line":137,"start_character":0,"end_line":139,"end_character":22},"in_reply_to":"3aaa91ec_949dbd5b","updated":"2016-06-24 00:35:42.000000000","message":"same problem as we are having now :-)","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"c515ff2b2f493a7dfc157e4c1b3aa9c0a215caec","unresolved":false,"context_lines":[{"line_number":144,"context_line":""},{"line_number":145,"context_line":"* Auth_token middleware fills the authentication headers as expected."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* As oslo.policy sees that a reservation ID is present it skips validating the"},{"line_number":148,"context_line":"  current operation on behalf of this service."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Transport Format"},{"line_number":151,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_a2b6fcd9","line":148,"range":{"start_line":147,"start_character":2,"end_line":148,"end_character":46},"updated":"2016-06-22 10:52:36.000000000","message":"So only the API entry point has the policy check performed ? For example, nova\u0027s create_server, but the follow up API calls in the same workflow have policy checks skip.\n\nIf so, this is an interesting idea solving another issue that is having authorization for a whole workflow...","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"bf9950824b195154954503513437be9df91171dc","unresolved":false,"context_lines":[{"line_number":144,"context_line":""},{"line_number":145,"context_line":"* Auth_token middleware fills the authentication headers as expected."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* As oslo.policy sees that a reservation ID is present it skips validating the"},{"line_number":148,"context_line":"  current operation on behalf of this service."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Transport Format"},{"line_number":151,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_563b6fd1","line":148,"range":{"start_line":147,"start_character":2,"end_line":148,"end_character":46},"in_reply_to":"3aaa91ec_a2b6fcd9","updated":"2016-06-23 00:27:07.000000000","message":"exactly. I\u0027m not sure how to get there yet, but it also solves things like \"what can this token do\" because keystone could know.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e2b05cb27fa6259e40949957ebcbc553038d3d15","unresolved":false,"context_lines":[{"line_number":150,"context_line":"Transport Format"},{"line_number":151,"context_line":"----------------"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Given the high turnover nature of reservations it will not be possible to store"},{"line_number":154,"context_line":"them in a database. That essentially leaves two options for transport:"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"* Fernet: The core data stored in a reservation will essentially be copied"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_13581256","line":153,"updated":"2016-06-27 21:44:59.000000000","message":"Will audit support be provided?","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"200242156582a1baf782ea98e1645b9a0ec8434d","unresolved":false,"context_lines":[{"line_number":166,"context_line":"* PKI: Given that a reservation has a very short expiry period revocations"},{"line_number":167,"context_line":"  would not be required for signing reservations. The other obvious problem"},{"line_number":168,"context_line":"  from attempting PKI tokens was the token size, which was largely due to the"},{"line_number":169,"context_line":"  size of the signed service catalog."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"  Given that we are essentially coming up with a new token format we could use"},{"line_number":172,"context_line":"  this opportunity to implement either catalog ids or msgpack encoding or any"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_ca51ab64","line":169,"range":{"start_line":169,"start_character":14,"end_line":169,"end_character":36},"updated":"2016-06-22 07:39:34.000000000","message":"with ServiceCatalogNG, we don\u0027t have to embed SC in token data. Nice thing about PKI token is that it is a piece of signed document and that its integrity can be verified independently. Problem with service-to-service trust is that we are blindly trust the integrity of the data coming from the incoming service.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"bf9950824b195154954503513437be9df91171dc","unresolved":false,"context_lines":[{"line_number":166,"context_line":"* PKI: Given that a reservation has a very short expiry period revocations"},{"line_number":167,"context_line":"  would not be required for signing reservations. The other obvious problem"},{"line_number":168,"context_line":"  from attempting PKI tokens was the token size, which was largely due to the"},{"line_number":169,"context_line":"  size of the signed service catalog."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"  Given that we are essentially coming up with a new token format we could use"},{"line_number":172,"context_line":"  this opportunity to implement either catalog ids or msgpack encoding or any"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_f671bba9","line":169,"range":{"start_line":169,"start_character":14,"end_line":169,"end_character":36},"in_reply_to":"3aaa91ec_ca51ab64","updated":"2016-06-23 00:27:07.000000000","message":"It\u0027s been a while since i\u0027ve heard anything about service catalog ng. I\u0027m not going to make that a prerequisite.\n\nWhat i\u0027m saying though is that because this is a new resource type we could define this however we like.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"a02b53ea81c33861967aa1c3412b9a8339bdd7ba","unresolved":false,"context_lines":[{"line_number":186,"context_line":"Continue to encourage the use of trusts for performing long running operations."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"I\u0027m no longer convinced doing nothing is a valid alternative."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Security Impact"},{"line_number":191,"context_line":"---------------"},{"line_number":192,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_75f481f1","line":189,"updated":"2016-06-23 13:43:24.000000000","message":"Let me put my 50 cents here: we can implement policy enforcement in keystone and get rid of tokens at all:\nhttps://review.openstack.org/#/c/325326/","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"70381d4a47adb880bd9c7631a746f55871cffe17","unresolved":false,"context_lines":[{"line_number":186,"context_line":"Continue to encourage the use of trusts for performing long running operations."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"I\u0027m no longer convinced doing nothing is a valid alternative."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Security Impact"},{"line_number":191,"context_line":"---------------"},{"line_number":192,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_2bd492bb","line":189,"in_reply_to":"3aaa91ec_75f481f1","updated":"2016-06-28 13:48:24.000000000","message":"The ideas looks the same except of the level of protection enforcement.\nYour idea is in a gateway on entrance for any user request, mine is to use existing policy enforcement infrastructure.","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":15742,"name":"Paulo Ewerton Gomes Fragoso","email":"pauloewerton@lsd.ufcg.edu.br","username":"pauloewerton"},"change_message_id":"ecab56ecc9d0c1407c1e408520c9de686156f75a","unresolved":false,"context_lines":[{"line_number":246,"context_line":"the service in the same X\\_ headers that auth_token creates today with the"},{"line_number":247,"context_line":"addition of a reservation id."},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"This spec is expected to compliment the existing service token work and so the"},{"line_number":250,"context_line":"service should still forward its token."},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"Policy Future Work"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_d8cfdab1","line":249,"range":{"start_line":249,"start_character":25,"end_line":249,"end_character":35},"updated":"2016-06-21 20:30:23.000000000","message":"complement","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"c515ff2b2f493a7dfc157e4c1b3aa9c0a215caec","unresolved":false,"context_lines":[{"line_number":257,"context_line":""},{"line_number":258,"context_line":"Given that a reservation is requested for a single operation that is known"},{"line_number":259,"context_line":"ahead of time keystone could perform policy checks for that operation for all"},{"line_number":260,"context_line":"known services. We could also enforce that policy only be validated once per"},{"line_number":261,"context_line":"user request by skipping policy checks at the service level when a reservation"},{"line_number":262,"context_line":"is received."},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"This covers both centralized and dynamic policy."},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_c5407259","line":262,"range":{"start_line":260,"start_character":16,"end_line":262,"end_character":12},"updated":"2016-06-22 10:52:36.000000000","message":"+++","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"8659b2bee4c2539b01246bbc011d24ef36e6ec34","unresolved":false,"context_lines":[{"line_number":295,"context_line":"Reservations would become a new API that would require documenting."},{"line_number":296,"context_line":""},{"line_number":297,"context_line":"References"},{"line_number":298,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":299,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_b6c26883","line":298,"range":{"start_line":298,"start_character":0,"end_line":298,"end_character":10},"updated":"2016-06-29 13:42:12.000000000","message":"It would be helpful if you put a few URLs here, such as for Auth_token middleware, Fernet tokens, OpenStack PKI, etc","commit_id":"6cdb53071b5096b8c951324c13a229bf8545dbfc"}]}