)]}'
{"specs/keystone/ocata/allow-expired.rst":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"5cd209bc2c777cda840b61b8cfe95da5dd80c966","unresolved":false,"context_lines":[{"line_number":15,"context_line":"initially validating a user token successfully, then it requests an image from"},{"line_number":16,"context_line":"glance, but in the mean time the token expires and so glance rejects the token."},{"line_number":17,"context_line":"This makes debugging timeouts harder and has resulted in services doing"},{"line_number":18,"context_line":"operations as the service user instead of the user inorder to refresh the"},{"line_number":19,"context_line":"token."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_e4ee73eb","line":18,"range":{"start_line":18,"start_character":51,"end_line":18,"end_character":58},"updated":"2017-02-20 16:58:14.000000000","message":"in order","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":18176,"name":"Nisha Yadav","email":"ynisha11@gmail.com","username":"ynisha11"},"change_message_id":"e279b268b9f32612d99f8b38eed28dab6c254340","unresolved":false,"context_lines":[{"line_number":15,"context_line":"initially validating a user token successfully, then it requests an image from"},{"line_number":16,"context_line":"glance, but in the mean time the token expires and so glance rejects the token."},{"line_number":17,"context_line":"This makes debugging timeouts harder and has resulted in services doing"},{"line_number":18,"context_line":"operations as the service user instead of the user inorder to refresh the"},{"line_number":19,"context_line":"token."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_d876b03d","line":18,"range":{"start_line":18,"start_character":51,"end_line":18,"end_character":58},"in_reply_to":"da36d5c6_e4ee73eb","updated":"2017-02-20 18:39:55.000000000","message":"Done","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"5cd209bc2c777cda840b61b8cfe95da5dd80c966","unresolved":false,"context_lines":[{"line_number":27,"context_line":"authentication process regardless of whether the user has previously been"},{"line_number":28,"context_line":"validated by another service."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Keystone tokens being the bearer tokens provide an easy way to accomplish this"},{"line_number":31,"context_line":"continuous user authentication by allowing the service to reuse the same token"},{"line_number":32,"context_line":"when communicating with others. This works most of the time, however there is"},{"line_number":33,"context_line":"an edge case that if the token expiry period is crossed between when the user"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_e4aaf36f","line":30,"range":{"start_line":30,"start_character":0,"end_line":30,"end_character":55},"updated":"2017-02-20 16:58:14.000000000","message":"this is wrong, mainly the \"being the bearer\" part. The older sentence is correct.","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":18176,"name":"Nisha Yadav","email":"ynisha11@gmail.com","username":"ynisha11"},"change_message_id":"e279b268b9f32612d99f8b38eed28dab6c254340","unresolved":false,"context_lines":[{"line_number":27,"context_line":"authentication process regardless of whether the user has previously been"},{"line_number":28,"context_line":"validated by another service."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Keystone tokens being the bearer tokens provide an easy way to accomplish this"},{"line_number":31,"context_line":"continuous user authentication by allowing the service to reuse the same token"},{"line_number":32,"context_line":"when communicating with others. This works most of the time, however there is"},{"line_number":33,"context_line":"an edge case that if the token expiry period is crossed between when the user"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_1804c87c","line":30,"range":{"start_line":30,"start_character":0,"end_line":30,"end_character":55},"in_reply_to":"da36d5c6_e4aaf36f","updated":"2017-02-20 18:39:55.000000000","message":"Hmm, sorry will change it back.","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"5cd209bc2c777cda840b61b8cfe95da5dd80c966","unresolved":false,"context_lines":[{"line_number":43,"context_line":"validated by an existing trusted service."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"As inter-service communication happens over public APIs, a problem arises"},{"line_number":46,"context_line":"because there is no way to know when a user\u0027s request entered deployment. For"},{"line_number":47,"context_line":"example consider Glance, which is unaware of whether a user wanted to list"},{"line_number":48,"context_line":"images or if nova is performing the operation on behalf of a user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_c4c40f42","line":47,"range":{"start_line":46,"start_character":74,"end_line":47,"end_character":7},"updated":"2017-02-20 16:58:14.000000000","message":"For example,","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"5cd209bc2c777cda840b61b8cfe95da5dd80c966","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"As inter-service communication happens over public APIs, a problem arises"},{"line_number":46,"context_line":"because there is no way to know when a user\u0027s request entered deployment. For"},{"line_number":47,"context_line":"example consider Glance, which is unaware of whether a user wanted to list"},{"line_number":48,"context_line":"images or if nova is performing the operation on behalf of a user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_843f7724","line":47,"range":{"start_line":47,"start_character":17,"end_line":47,"end_character":23},"updated":"2017-02-20 16:58:14.000000000","message":"Glance was written like that because it appeared after a period. The correct name is \"glance\". See https://docs.openstack.org/contributor-guide/writing-style/openstack-components.html","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":18176,"name":"Nisha Yadav","email":"ynisha11@gmail.com","username":"ynisha11"},"change_message_id":"e279b268b9f32612d99f8b38eed28dab6c254340","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"As inter-service communication happens over public APIs, a problem arises"},{"line_number":46,"context_line":"because there is no way to know when a user\u0027s request entered deployment. For"},{"line_number":47,"context_line":"example consider Glance, which is unaware of whether a user wanted to list"},{"line_number":48,"context_line":"images or if nova is performing the operation on behalf of a user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_983fd824","line":47,"range":{"start_line":47,"start_character":17,"end_line":47,"end_character":23},"in_reply_to":"da36d5c6_843f7724","updated":"2017-02-20 18:39:55.000000000","message":"Ooh, thanks for the link.","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":18176,"name":"Nisha Yadav","email":"ynisha11@gmail.com","username":"ynisha11"},"change_message_id":"e279b268b9f32612d99f8b38eed28dab6c254340","unresolved":false,"context_lines":[{"line_number":43,"context_line":"validated by an existing trusted service."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"As inter-service communication happens over public APIs, a problem arises"},{"line_number":46,"context_line":"because there is no way to know when a user\u0027s request entered deployment. For"},{"line_number":47,"context_line":"example consider Glance, which is unaware of whether a user wanted to list"},{"line_number":48,"context_line":"images or if nova is performing the operation on behalf of a user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_781144ac","line":47,"range":{"start_line":46,"start_character":74,"end_line":47,"end_character":7},"in_reply_to":"da36d5c6_c4c40f42","updated":"2017-02-20 18:39:55.000000000","message":"Done","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"5cd209bc2c777cda840b61b8cfe95da5dd80c966","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Keystone vs auth_token middleware"},{"line_number":80,"context_line":"+++++++++++++++++++++++++++++++++"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"There have been a few opinions on whether auth_token middleware should be"},{"line_number":83,"context_line":"responsible for setting the ``allow_expired`` flag or whether both tokens"},{"line_number":84,"context_line":"should be submitted to keystone and the server be responsible for assessing the"},{"line_number":85,"context_line":"validity of the service token."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_e21ae316","line":82,"range":{"start_line":82,"start_character":6,"end_line":82,"end_character":10},"updated":"2017-02-20 16:58:14.000000000","message":"I think \"has\" is correct here?","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"00c86a6f2cbde3d6e75e2cd1832cab1dd048e01d","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Keystone vs auth_token middleware"},{"line_number":80,"context_line":"+++++++++++++++++++++++++++++++++"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"There have been a few opinions on whether auth_token middleware should be"},{"line_number":83,"context_line":"responsible for setting the ``allow_expired`` flag or whether both tokens"},{"line_number":84,"context_line":"should be submitted to keystone and the server be responsible for assessing the"},{"line_number":85,"context_line":"validity of the service token."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_b3ad9f33","line":82,"range":{"start_line":82,"start_character":6,"end_line":82,"end_character":10},"in_reply_to":"da36d5c6_1863e81b","updated":"2017-02-20 19:02:47.000000000","message":"Could do \"There are differing opinions...\"?","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"9d0c344771c1510a76dfd317212718b5af881506","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Keystone vs auth_token middleware"},{"line_number":80,"context_line":"+++++++++++++++++++++++++++++++++"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"There have been a few opinions on whether auth_token middleware should be"},{"line_number":83,"context_line":"responsible for setting the ``allow_expired`` flag or whether both tokens"},{"line_number":84,"context_line":"should be submitted to keystone and the server be responsible for assessing the"},{"line_number":85,"context_line":"validity of the service token."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_87e210d4","line":82,"range":{"start_line":82,"start_character":6,"end_line":82,"end_character":10},"in_reply_to":"da36d5c6_b3ad9f33","updated":"2017-02-20 21:40:25.000000000","message":"it is \"there have\" because \"opinions\" is plural :)\n\n[1] http://ell.stackexchange.com/questions/20153/there-has-been-vs-there-have-been","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":18176,"name":"Nisha Yadav","email":"ynisha11@gmail.com","username":"ynisha11"},"change_message_id":"e279b268b9f32612d99f8b38eed28dab6c254340","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Keystone vs auth_token middleware"},{"line_number":80,"context_line":"+++++++++++++++++++++++++++++++++"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"There have been a few opinions on whether auth_token middleware should be"},{"line_number":83,"context_line":"responsible for setting the ``allow_expired`` flag or whether both tokens"},{"line_number":84,"context_line":"should be submitted to keystone and the server be responsible for assessing the"},{"line_number":85,"context_line":"validity of the service token."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_1863e81b","line":82,"range":{"start_line":82,"start_character":6,"end_line":82,"end_character":10},"in_reply_to":"da36d5c6_e21ae316","updated":"2017-02-20 18:39:55.000000000","message":"I still believe \u0027have\u0027 should be used here. Maybe we can get it cross checked by someone else?","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"5cd209bc2c777cda840b61b8cfe95da5dd80c966","unresolved":false,"context_lines":[{"line_number":138,"context_line":"validations at once so this is another validation request for each request."},{"line_number":139,"context_line":"This is a cacheable operation."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"A positive outcome of this change would be for deployers by moving to shorter"},{"line_number":142,"context_line":"token expiry and there are performance implications of this. Two are:"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"* Shorter term tokens will mean more tokens are issued. However token reuse is"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_42bf2fd0","line":141,"range":{"start_line":141,"start_character":57,"end_line":141,"end_character":66},"updated":"2017-02-20 16:58:14.000000000","message":"I prever the old term \"to move\"","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":18176,"name":"Nisha Yadav","email":"ynisha11@gmail.com","username":"ynisha11"},"change_message_id":"e279b268b9f32612d99f8b38eed28dab6c254340","unresolved":false,"context_lines":[{"line_number":138,"context_line":"validations at once so this is another validation request for each request."},{"line_number":139,"context_line":"This is a cacheable operation."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"A positive outcome of this change would be for deployers by moving to shorter"},{"line_number":142,"context_line":"token expiry and there are performance implications of this. Two are:"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"* Shorter term tokens will mean more tokens are issued. However token reuse is"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_d8815091","line":141,"range":{"start_line":141,"start_character":57,"end_line":141,"end_character":66},"in_reply_to":"da36d5c6_42bf2fd0","updated":"2017-02-20 18:39:55.000000000","message":"Sure, done.","commit_id":"67d505afe1fbac9ce565c116c1aba6b7161b69b0"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"a6a6718d51cef2636fffcdedf83cfb21a643a514","unresolved":false,"context_lines":[{"line_number":43,"context_line":"validated by an existing trusted service."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"As inter-service communication happens over public APIs, a problem arises"},{"line_number":46,"context_line":"because there is no way to know when a user\u0027s request entered deployment. For"},{"line_number":47,"context_line":"example, consider glance, which is unaware of whether a user wanted to list"},{"line_number":48,"context_line":"images or if nova is performing the operation on behalf of a user."},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_87305058","line":46,"range":{"start_line":46,"start_character":61,"end_line":46,"end_character":62},"updated":"2017-02-20 21:44:35.000000000","message":"\"entered a deployment\" was correct.","commit_id":"7cc20a0422e75869078b1468e8249e1b64c2af30"},{"author":{"_account_id":18176,"name":"Nisha Yadav","email":"ynisha11@gmail.com","username":"ynisha11"},"change_message_id":"26f20d4f01866832981e3bd0770e516bf7a40283","unresolved":false,"context_lines":[{"line_number":43,"context_line":"validated by an existing trusted service."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"As inter-service communication happens over public APIs, a problem arises"},{"line_number":46,"context_line":"because there is no way to know when a user\u0027s request entered deployment. For"},{"line_number":47,"context_line":"example, consider glance, which is unaware of whether a user wanted to list"},{"line_number":48,"context_line":"images or if nova is performing the operation on behalf of a user."},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_d1059cc2","line":46,"range":{"start_line":46,"start_character":61,"end_line":46,"end_character":62},"in_reply_to":"da36d5c6_87305058","updated":"2017-02-21 08:33:41.000000000","message":"Oh, will change it back.","commit_id":"7cc20a0422e75869078b1468e8249e1b64c2af30"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"a6a6718d51cef2636fffcdedf83cfb21a643a514","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Keystone/auth_token middleware should support that if a token is submitted to"},{"line_number":58,"context_line":"it along with an \"X-Service-Token\" with a service role (to distinguish it from"},{"line_number":59,"context_line":"any old user trying to use an expired token) then it should imply that the"},{"line_number":60,"context_line":"token has been previously validated by a trusted service and so the token"},{"line_number":61,"context_line":"should be accepted and data expect be filled by the service."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The keystone side of this is fairly simple. We add a flag ``?allow_expired\u003d1``"},{"line_number":64,"context_line":"to the existing ``GET /auth/tokens`` validation route that allows fetching an"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_076b801f","line":61,"range":{"start_line":59,"start_character":45,"end_line":61,"end_character":60},"updated":"2017-02-20 21:44:35.000000000","message":"this is wrong, the previous sentence was correct.","commit_id":"7cc20a0422e75869078b1468e8249e1b64c2af30"},{"author":{"_account_id":18176,"name":"Nisha Yadav","email":"ynisha11@gmail.com","username":"ynisha11"},"change_message_id":"26f20d4f01866832981e3bd0770e516bf7a40283","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Keystone/auth_token middleware should support that if a token is submitted to"},{"line_number":58,"context_line":"it along with an \"X-Service-Token\" with a service role (to distinguish it from"},{"line_number":59,"context_line":"any old user trying to use an expired token) then it should imply that the"},{"line_number":60,"context_line":"token has been previously validated by a trusted service and so the token"},{"line_number":61,"context_line":"should be accepted and data expect be filled by the service."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The keystone side of this is fairly simple. We add a flag ``?allow_expired\u003d1``"},{"line_number":64,"context_line":"to the existing ``GET /auth/tokens`` validation route that allows fetching an"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_11b574ed","line":61,"range":{"start_line":59,"start_character":45,"end_line":61,"end_character":60},"in_reply_to":"da36d5c6_076b801f","updated":"2017-02-21 08:33:41.000000000","message":"sorry, will change it back.","commit_id":"7cc20a0422e75869078b1468e8249e1b64c2af30"}]}