)]}'
{"specs/keystone/pike/api-keys.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"7525b9445420b34073adb87494f967480bdf3d6f","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Rquirements:"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"* Allow for the creation of many keys (ideally users will create a new API key"},{"line_number":27,"context_line":"  for each cron job, script, etc.)"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"* Force API keys to only be a subset of the roles available to the user"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_af916454","line":27,"updated":"2017-03-02 16:10:10.000000000","message":"I\u0027d like to see \"many\" reduced to an operator-controlled quota per user, primarily to bar against seeing us repeat the pain points of UUID tokens, made worse by the fact that they might not expire.","commit_id":"93e8ab488e98c220ed576da8bf2250e79c94c68a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"7525b9445420b34073adb87494f967480bdf3d6f","unresolved":false,"context_lines":[{"line_number":26,"context_line":"* Allow for the creation of many keys (ideally users will create a new API key"},{"line_number":27,"context_line":"  for each cron job, script, etc.)"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"* Force API keys to only be a subset of the roles available to the user"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"* API keys should be scoped, but there is something to be said about admin jobs"},{"line_number":32,"context_line":"  that cross domain/project boundaries. There is some debate to be had here."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_0fb7d0d8","line":29,"updated":"2017-03-02 16:10:10.000000000","message":"... on the specified scope.","commit_id":"93e8ab488e98c220ed576da8bf2250e79c94c68a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"7525b9445420b34073adb87494f967480bdf3d6f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"* API keys should be scoped, but there is something to be said about admin jobs"},{"line_number":32,"context_line":"  that cross domain/project boundaries. There is some debate to be had here."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"* API keys are to be created once and never stored in keystone. This means"},{"line_number":35,"context_line":"  that a user will not be able to go in and ask for them again. If they lose"},{"line_number":36,"context_line":"  a key they will have to create a new one."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_6f392c41","line":34,"updated":"2017-03-02 16:10:10.000000000","message":"stored in plaintext*","commit_id":"93e8ab488e98c220ed576da8bf2250e79c94c68a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"7525b9445420b34073adb87494f967480bdf3d6f","unresolved":false,"context_lines":[{"line_number":35,"context_line":"  that a user will not be able to go in and ask for them again. If they lose"},{"line_number":36,"context_line":"  a key they will have to create a new one."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"* API keys cannot be used to create a token with a larger scope or lifetime."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_8f558051","line":38,"updated":"2017-03-02 16:10:10.000000000","message":"cannot be used to manipulate/manage API keys at all? i.e. no creating OR revoking API keys.","commit_id":"93e8ab488e98c220ed576da8bf2250e79c94c68a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"7525b9445420b34073adb87494f967480bdf3d6f","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"* To validate we will use the key_id to find the API key and hash the key using"},{"line_number":52,"context_line":"  passlib to verify it. Once verified we will create the context used for policy"},{"line_number":53,"context_line":"  by grabbing the scope and roles assigned to that API key."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* We *may* provide a mechanism to force expiration, but there was some debate on"},{"line_number":56,"context_line":"  this at the PTG."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_ef8fdcc9","line":53,"updated":"2017-03-02 16:10:10.000000000","message":"+1 Maybe implementation details, but it impacts UX a bit -- I assume both are hex-encoded UUID4\u0027s? I\u0027m wondering if we can eliminate the separator character in favor of having fixed-length ID\u0027s... which hex-encoded UUID\u0027s are not (I believe they vary by a character, but I could be wrong).","commit_id":"93e8ab488e98c220ed576da8bf2250e79c94c68a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"7525b9445420b34073adb87494f967480bdf3d6f","unresolved":false,"context_lines":[{"line_number":53,"context_line":"  by grabbing the scope and roles assigned to that API key."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* We *may* provide a mechanism to force expiration, but there was some debate on"},{"line_number":56,"context_line":"  this at the PTG."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"* The key itself can be just 128 or 256 random bytes."},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_ef027c0a","line":56,"updated":"2017-03-02 16:10:10.000000000","message":"Expiration would make this useless for long-running jobs.","commit_id":"93e8ab488e98c220ed576da8bf2250e79c94c68a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"7525b9445420b34073adb87494f967480bdf3d6f","unresolved":false,"context_lines":[{"line_number":66,"context_line":"---------------"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* A compromise will be limited to the authorization of the API key, but will"},{"line_number":69,"context_line":"  last until the compromise is noticed."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"* Passwords are no longer needed in configuration files."},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_aaca326c","line":69,"updated":"2017-03-02 16:10:10.000000000","message":"... and the key is explicitly revoked.","commit_id":"93e8ab488e98c220ed576da8bf2250e79c94c68a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"7525b9445420b34073adb87494f967480bdf3d6f","unresolved":false,"context_lines":[{"line_number":68,"context_line":"* A compromise will be limited to the authorization of the API key, but will"},{"line_number":69,"context_line":"  last until the compromise is noticed."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"* Passwords are no longer needed in configuration files."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"[I\u0027m sure there is more here]"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_caa046a2","line":71,"updated":"2017-03-02 16:10:10.000000000","message":"However, API keys are a lot like passwords in that they are shared secrets, possibly without expiration.","commit_id":"93e8ab488e98c220ed576da8bf2250e79c94c68a"}]}