)]}'
{"attic/v3/identity-api-v3.rst":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dfc54a1e5e981f5d664fd03d9bf1e5eeb4686a4b","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"- Microversioning of the Identity API."},{"line_number":16,"context_line":"- Addition of the ``password_expires_at`` field to the user response object."},{"line_number":17,"context_line":"-  Inroduce a flag to bypass expiration and revocation checking."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"What\u0027s New in Version 3.6"},{"line_number":20,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a89bdaa_dfd2f2ff","line":17,"range":{"start_line":17,"start_character":3,"end_line":17,"end_character":64},"updated":"2016-09-06 14:06:45.000000000","message":"I think is being proposed for 3.8, not 3.7","commit_id":"63a93e3b906d53794b715bdd5af14088bdcc3e42"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"689ad022e10b4cc8a16c343b66d4cdcbe54ae8e0","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"- Microversioning of the Identity API."},{"line_number":16,"context_line":"- Addition of the ``password_expires_at`` field to the user response object."},{"line_number":17,"context_line":"-  Inroduce a flag to bypass expiration and revocation checking."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"What\u0027s New in Version 3.6"},{"line_number":20,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a89bdaa_76942d8a","line":17,"range":{"start_line":17,"start_character":3,"end_line":17,"end_character":64},"in_reply_to":"9a89bdaa_dfd2f2ff","updated":"2016-09-08 14:40:54.000000000","message":"By the time it gets approved it will be 3.31","commit_id":"63a93e3b906d53794b715bdd5af14088bdcc3e42"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":2089,"context_line":""},{"line_number":2090,"context_line":"::"},{"line_number":2091,"context_line":""},{"line_number":2092,"context_line":"    POST /v3/auth/tokens?noexpire"},{"line_number":2093,"context_line":""},{"line_number":2094,"context_line":"Relationship:"},{"line_number":2095,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/auth_tokens``"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_f76f4dc1","line":2092,"range":{"start_line":2092,"start_character":4,"end_line":2092,"end_character":33},"updated":"2016-09-08 18:14:56.000000000","message":"This is a GET if it\u0027s only used for validation purposes. a POST would be if the token itself is flagged as non-expiring (wedon\u0027t want that).","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"}],"specs/keystone/ongoing/ignore-exipry.rst":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"54a1ec04c64aa09a8e5ab9ed143fc401185b0588","unresolved":false,"context_lines":[{"line_number":98,"context_line":"Developer Impact"},{"line_number":99,"context_line":"----------------"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"THis change will likely require changes to the driver.  UUID tokens"},{"line_number":102,"context_line":"stored in the database will not be able to honor this change.  PKI"},{"line_number":103,"context_line":"tokens will require the full token body to honor this change."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ac06dbe_c1948144","line":102,"range":{"start_line":101,"start_character":56,"end_line":102,"end_character":60},"updated":"2016-08-22 23:19:05.000000000","message":"This is false, the tokens can be muted post fetch from the DB. PKI tokens can just ignore the field but should not under any circumstances return data that differs from the token body.\n\nUUID and PKI tokens could be handled in the same way.\n\n/me puts on end user/operator hat: Please do not introduce MORE differences in how tokens behave than we already have.","commit_id":"949d3cab4de68efc1f2e2bc45bdd00c7a635ca9e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":48,"context_line":"Security Impact"},{"line_number":49,"context_line":"---------------"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Whiole this changes the security profile of OpenStack, it is actually to make"},{"line_number":52,"context_line":"it more secure.  A token validator needds to opt in to thise scheme, and thus"},{"line_number":53,"context_line":"it cannot be used to unrevoke tokens etc.  The expection is that when one"},{"line_number":54,"context_line":"service calls another, that call will be made using a service token in"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_376615ed","line":51,"range":{"start_line":51,"start_character":0,"end_line":51,"end_character":6},"updated":"2016-09-08 18:14:56.000000000","message":"Spelling: While","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":56,"context_line":"that is the link in the chain for authorization.  This is already the"},{"line_number":57,"context_line":"case."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The mnost important benefit will be from the shortening of the expiry"},{"line_number":60,"context_line":"times of tokens.  Tokens used as a proxy for authentication should be"},{"line_number":61,"context_line":"used within a few minutes of issuance.  THis change will allow that to happen."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_b7a065f5","line":59,"range":{"start_line":59,"start_character":4,"end_line":59,"end_character":9},"updated":"2016-09-08 18:14:56.000000000","message":"Spelling: most","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The mnost important benefit will be from the shortening of the expiry"},{"line_number":60,"context_line":"times of tokens.  Tokens used as a proxy for authentication should be"},{"line_number":61,"context_line":"used within a few minutes of issuance.  THis change will allow that to happen."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":""},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_37ad35e9","line":61,"range":{"start_line":61,"start_character":40,"end_line":61,"end_character":44},"updated":"2016-09-08 18:14:56.000000000","message":"Typo: This not THis","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":71,"context_line":"Other End User Impact"},{"line_number":72,"context_line":"---------------------"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Directly hte change will be only in the validation API called by"},{"line_number":75,"context_line":"Middleware.  Indirectly, token expiration times will drop, and other"},{"line_number":76,"context_line":"services will need to react accordingly.  Horizon especially will have"},{"line_number":77,"context_line":"to re-authenticate far more often than it does now."}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_9784415e","line":74,"range":{"start_line":74,"start_character":9,"end_line":74,"end_character":12},"updated":"2016-09-08 18:14:56.000000000","message":"Spelling: the","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":72,"context_line":"---------------------"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Directly hte change will be only in the validation API called by"},{"line_number":75,"context_line":"Middleware.  Indirectly, token expiration times will drop, and other"},{"line_number":76,"context_line":"services will need to react accordingly.  Horizon especially will have"},{"line_number":77,"context_line":"to re-authenticate far more often than it does now."},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_174e713a","line":75,"range":{"start_line":75,"start_character":0,"end_line":75,"end_character":10},"updated":"2016-09-08 18:14:56.000000000","message":"Hm.. \n\nWe may want to implement this as part of delay auth response, where the status is instead of \"invalid\" \"expired: \u003cexpiry\u003e\" so the server can opt to reject or accept.\n\nNot sure the best way to approach this in a generic way. Some middleware fixes will also be required.","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":80,"context_line":"Performance Impact"},{"line_number":81,"context_line":"------------------"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Minimal.  Calls between services will include a service token, which"},{"line_number":84,"context_line":"will have to be validated, but that validation should be cached by the"},{"line_number":85,"context_line":"remote serivce."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Shorter term tokens will mean more tokens are issued.  However, most"},{"line_number":88,"context_line":"CLI operations do not reuse tokens, and thus the pattern should be"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_5702b9b4","line":85,"range":{"start_line":83,"start_character":0,"end_line":85,"end_character":15},"updated":"2016-09-08 18:14:56.000000000","message":"So in the case of service tokens this flag is always used? See my above comment.","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":84,"context_line":"will have to be validated, but that validation should be cached by the"},{"line_number":85,"context_line":"remote serivce."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Shorter term tokens will mean more tokens are issued.  However, most"},{"line_number":88,"context_line":"CLI operations do not reuse tokens, and thus the pattern should be"},{"line_number":89,"context_line":"fairly similar to current usage."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"WebUI should be made aware of the shorter token timeouts and provide a"},{"line_number":92,"context_line":"means refresh.  Since WebUIs do not cache the users credentials, there"},{"line_number":93,"context_line":"will likely be a push to explicitly extend the lifespan of unscoped"},{"line_number":94,"context_line":"tokens when fetched from Horizon or other specific web UIs, but that"},{"line_number":95,"context_line":"is beyond the scope of this spec."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Other Deployer Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_f7274d60","line":95,"range":{"start_line":87,"start_character":0,"end_line":95,"end_character":33},"updated":"2016-09-08 18:14:56.000000000","message":"Good to explain this explicitly, and this is 100% reasonable.","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":102,"context_line":"that a service token needs to have in order to make use of this"},{"line_number":103,"context_line":"feature.  Ideally, the roles will be more granular than jsut \"service.\""},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"UUID tokens stored in the database will require holding on to expired"},{"line_number":106,"context_line":"tokens in order to honor this change, which means providing a larger"},{"line_number":107,"context_line":"window for token flush. PKI tokens that are not stored in the database"},{"line_number":108,"context_line":"(or have been flushed) will require the full token body to honor this"},{"line_number":109,"context_line":"change."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Developer Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_371e150c","line":109,"range":{"start_line":105,"start_character":0,"end_line":109,"end_character":7},"updated":"2016-09-08 18:14:56.000000000","message":"We should bake in a baseline extended window for flush so deployer impact is minimal/sane.","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Developer Impact"},{"line_number":113,"context_line":"----------------"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"This change will likely require changes to the driver."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_57f0f9c8","line":115,"range":{"start_line":115,"start_character":0,"end_line":115,"end_character":54},"updated":"2016-09-08 18:14:56.000000000","message":"NIT: Drop this line, indicate other service developers will need to know how to consume the no-expire tokens. No other developer impact is really added.","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b350e4b530281d98b2f65587d5461bed536a966b","unresolved":false,"context_lines":[{"line_number":144,"context_line":"Documentation Impact"},{"line_number":145,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"This will need to be documented heavily."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a89bdaa_97a361b1","line":147,"range":{"start_line":147,"start_character":0,"end_line":147,"end_character":40},"updated":"2016-09-08 18:14:56.000000000","message":"I would have been snarky and said \"Yes\". ;)","commit_id":"2d1c2b63ac31c5992185fc5ff5269346294ec129"}]}