)]}'
{"specs/keystone/backlog/json-web-tokens.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"43292d85c84083788022b610401ff33f9aa8ce57","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"JSON Web Token is a type of non-persistent bearer token similar to the fernet"},{"line_number":15,"context_line":"tokens we use today. JWT is an `open standard`_ with `actively maintained"},{"line_number":16,"context_line":"libraries`_."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":".. _`open standard`: https://tools.ietf.org/html/rfc7519"},{"line_number":19,"context_line":".. _`actively maintained libraries`: https://jwt.io/#libraries"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_bb6d7fcd","line":16,"range":{"start_line":15,"start_character":21,"end_line":16,"end_character":12},"updated":"2017-10-13 14:26:18.000000000","message":"I can already feel the win!","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"08d532a9a2c8bfae1d98062fb4bf90fb48461a2c","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"JSON Web Token is a type of non-persistent bearer token similar to the fernet"},{"line_number":15,"context_line":"tokens we use today. JWT is an `open standard`_ with `actively maintained"},{"line_number":16,"context_line":"libraries`_."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":".. _`open standard`: https://tools.ietf.org/html/rfc7519"},{"line_number":19,"context_line":".. _`actively maintained libraries`: https://jwt.io/#libraries"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_aadf6338","line":16,"range":{"start_line":15,"start_character":21,"end_line":16,"end_character":12},"in_reply_to":"5f4e5783_bb6d7fcd","updated":"2017-10-13 16:37:48.000000000","message":"++","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"43292d85c84083788022b610401ff33f9aa8ce57","unresolved":false,"context_lines":[{"line_number":32,"context_line":"However, the fernet format has its own problems that make it non-ideal. We have"},{"line_number":33,"context_line":"been `bitten`_ by the fact that `fernet tokens do not support sub-second"},{"line_number":34,"context_line":"precision`_, a fault which is built into `the fernet spec`_ itself, not simply"},{"line_number":35,"context_line":"the `cryptography` implementation of it. The spec is largely abandoned, making"},{"line_number":36,"context_line":"it hard to `get changes into it`_ and thereby into the `cryptography`"},{"line_number":37,"context_line":"implementation of it. Moreover, the fernet spec is not recognized by any"},{"line_number":38,"context_line":"standards body and therefore not as closely audited as an IETF standard, making"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_1bb3734f","line":35,"range":{"start_line":35,"start_character":5,"end_line":35,"end_character":17},"updated":"2017-10-13 14:26:18.000000000","message":"nit: are these meant to be italicized or literals? I think single ` is italics and `` makes it a literal.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"30af36ac0ccbc2b2aa0380b7d6b4cac9a14be9cb","unresolved":false,"context_lines":[{"line_number":32,"context_line":"However, the fernet format has its own problems that make it non-ideal. We have"},{"line_number":33,"context_line":"been `bitten`_ by the fact that `fernet tokens do not support sub-second"},{"line_number":34,"context_line":"precision`_, a fault which is built into `the fernet spec`_ itself, not simply"},{"line_number":35,"context_line":"the `cryptography` implementation of it. The spec is largely abandoned, making"},{"line_number":36,"context_line":"it hard to `get changes into it`_ and thereby into the `cryptography`"},{"line_number":37,"context_line":"implementation of it. Moreover, the fernet spec is not recognized by any"},{"line_number":38,"context_line":"standards body and therefore not as closely audited as an IETF standard, making"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_e490f44c","line":35,"range":{"start_line":35,"start_character":5,"end_line":35,"end_character":17},"in_reply_to":"5f4e5783_1bb3734f","updated":"2017-10-13 15:33:04.000000000","message":"I was going for italics but I\u0027m not actually sure which one is the right one to use for library names, I\u0027m fine with changing it","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"08d532a9a2c8bfae1d98062fb4bf90fb48461a2c","unresolved":false,"context_lines":[{"line_number":29,"context_line":"problems. It is already deprecated and we intend to eventually remove it, in"},{"line_number":30,"context_line":"favor of non-persistent token formats."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"However, the fernet format has its own problems that make it non-ideal. We have"},{"line_number":33,"context_line":"been `bitten`_ by the fact that `fernet tokens do not support sub-second"},{"line_number":34,"context_line":"precision`_, a fault which is built into `the fernet spec`_ itself, not simply"},{"line_number":35,"context_line":"the `cryptography` implementation of it. The spec is largely abandoned, making"},{"line_number":36,"context_line":"it hard to `get changes into it`_ and thereby into the `cryptography`"},{"line_number":37,"context_line":"implementation of it. Moreover, the fernet spec is not recognized by any"},{"line_number":38,"context_line":"standards body and therefore not as closely audited as an IETF standard, making"},{"line_number":39,"context_line":"it more susceptable to zero-day vulnerabilities."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"It would be nice to offer a new type of token that is backed by a widely used"},{"line_number":42,"context_line":"standard before we totally remove support for UUID tokens."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_2aeb73dc","line":39,"range":{"start_line":32,"start_character":0,"end_line":39,"end_character":48},"updated":"2017-10-13 16:37:48.000000000","message":"JWT explicitly has the same issues with sub-second not being supported. I would avoid implying JWT solves this issue.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de8499d6231b2054ba13e3b66b9c8df129d9be2f","unresolved":false,"context_lines":[{"line_number":29,"context_line":"problems. It is already deprecated and we intend to eventually remove it, in"},{"line_number":30,"context_line":"favor of non-persistent token formats."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"However, the fernet format has its own problems that make it non-ideal. We have"},{"line_number":33,"context_line":"been `bitten`_ by the fact that `fernet tokens do not support sub-second"},{"line_number":34,"context_line":"precision`_, a fault which is built into `the fernet spec`_ itself, not simply"},{"line_number":35,"context_line":"the `cryptography` implementation of it. The spec is largely abandoned, making"},{"line_number":36,"context_line":"it hard to `get changes into it`_ and thereby into the `cryptography`"},{"line_number":37,"context_line":"implementation of it. Moreover, the fernet spec is not recognized by any"},{"line_number":38,"context_line":"standards body and therefore not as closely audited as an IETF standard, making"},{"line_number":39,"context_line":"it more susceptable to zero-day vulnerabilities."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"It would be nice to offer a new type of token that is backed by a widely used"},{"line_number":42,"context_line":"standard before we totally remove support for UUID tokens."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_b2e8f9e1","line":39,"range":{"start_line":32,"start_character":0,"end_line":39,"end_character":48},"in_reply_to":"5f4e5783_2aeb73dc","updated":"2017-10-13 20:00:24.000000000","message":"Done","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"43292d85c84083788022b610401ff33f9aa8ce57","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"It would be nice to offer a new type of token that is backed by a widely used"},{"line_number":42,"context_line":"standard before we totally remove support for UUID tokens."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":".. _`bitten`: https://bugs.launchpad.net/keystone/+bug/1473567"},{"line_number":45,"context_line":".. _`fernet tokens do not support sub-second precision`: https://github.com/fernet/spec/issues/12"},{"line_number":46,"context_line":".. _`the fernet spec`: https://github.com/fernet/spec/blob/master/Spec.md"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_9bf523f0","line":43,"updated":"2017-10-13 14:26:18.000000000","message":"These are all absolutely fantastic points, and we should pursue this for these points alone. But, another advantage is the JWT is used by other things in the industry (k8s, mosquito, etc), making it easier to for keystone to integrate with those things on some level.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"30af36ac0ccbc2b2aa0380b7d6b4cac9a14be9cb","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"It would be nice to offer a new type of token that is backed by a widely used"},{"line_number":42,"context_line":"standard before we totally remove support for UUID tokens."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":".. _`bitten`: https://bugs.launchpad.net/keystone/+bug/1473567"},{"line_number":45,"context_line":".. _`fernet tokens do not support sub-second precision`: https://github.com/fernet/spec/issues/12"},{"line_number":46,"context_line":".. _`the fernet spec`: https://github.com/fernet/spec/blob/master/Spec.md"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_0491d047","line":43,"in_reply_to":"5f4e5783_9bf523f0","updated":"2017-10-13 15:33:04.000000000","message":"++","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de8499d6231b2054ba13e3b66b9c8df129d9be2f","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"It would be nice to offer a new type of token that is backed by a widely used"},{"line_number":42,"context_line":"standard before we totally remove support for UUID tokens."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":".. _`bitten`: https://bugs.launchpad.net/keystone/+bug/1473567"},{"line_number":45,"context_line":".. _`fernet tokens do not support sub-second precision`: https://github.com/fernet/spec/issues/12"},{"line_number":46,"context_line":".. _`the fernet spec`: https://github.com/fernet/spec/blob/master/Spec.md"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_92e5fd0b","line":43,"in_reply_to":"5f4e5783_9bf523f0","updated":"2017-10-13 20:00:24.000000000","message":"Done","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"43292d85c84083788022b610401ff33f9aa8ce57","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Authenticated Encryption which eliminates the need to sign after encryption."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Similar to the fernet, JWTs will require a key repository be set up to use for"},{"line_number":63,"context_line":"signing tokens. A new keystone-manage command will be added to handle secret"},{"line_number":64,"context_line":"generation and rotation which will likely re-use much of the utilities in the"},{"line_number":65,"context_line":"fernet_setup and fernet_rotate commands. JWE can use symmetric keys for"},{"line_number":66,"context_line":"encryption and signing the way fernet does but it is more typical to use an"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_fb3897a0","line":63,"range":{"start_line":63,"start_character":22,"end_line":63,"end_character":37},"updated":"2017-10-13 14:26:18.000000000","message":"nit: could wrap this in literals.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de8499d6231b2054ba13e3b66b9c8df129d9be2f","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Authenticated Encryption which eliminates the need to sign after encryption."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Similar to the fernet, JWTs will require a key repository be set up to use for"},{"line_number":63,"context_line":"signing tokens. A new keystone-manage command will be added to handle secret"},{"line_number":64,"context_line":"generation and rotation which will likely re-use much of the utilities in the"},{"line_number":65,"context_line":"fernet_setup and fernet_rotate commands. JWE can use symmetric keys for"},{"line_number":66,"context_line":"encryption and signing the way fernet does but it is more typical to use an"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_b2d11926","line":63,"range":{"start_line":63,"start_character":22,"end_line":63,"end_character":37},"in_reply_to":"5f4e5783_fb3897a0","updated":"2017-10-13 20:00:24.000000000","message":"Done","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"43292d85c84083788022b610401ff33f9aa8ce57","unresolved":false,"context_lines":[{"line_number":107,"context_line":"---------------"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Since JWT is a widely used web standard, this will have a net positive impact"},{"line_number":110,"context_line":"on security. Choosing to use JWE, an optional feature of the JWT spec, will"},{"line_number":111,"context_line":"ensure that the data within the token is at least as secure as it is in fernet"},{"line_number":112,"context_line":"tokens. These will still be bearer tokens and so interception of one must still"},{"line_number":113,"context_line":"be guarded against."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_1bf81347","line":112,"range":{"start_line":110,"start_character":13,"end_line":112,"end_character":7},"updated":"2017-10-13 14:26:18.000000000","message":"+1 to finding a library that supports this.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"43292d85c84083788022b610401ff33f9aa8ce57","unresolved":false,"context_lines":[{"line_number":138,"context_line":"repository will contain asymmetric key pairs rather than just secret keys. The"},{"line_number":139,"context_line":"deployer will need to take care to sync and rotate keys the way they do with"},{"line_number":140,"context_line":"fernet tokens."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Developer Impact"},{"line_number":143,"context_line":"----------------"},{"line_number":144,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_7b614705","line":141,"updated":"2017-10-13 14:26:18.000000000","message":"One optional feature that we could add here would be keeping the offline validation bits in middleware. Since JWT uses asynchronous cryptography, we can keep the offline validation path and offer that to deployments who are already relying on it if they are PKI.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b4a1b85aef4ba3a60e42602ece890d87231c3f13","unresolved":false,"context_lines":[{"line_number":138,"context_line":"repository will contain asymmetric key pairs rather than just secret keys. The"},{"line_number":139,"context_line":"deployer will need to take care to sync and rotate keys the way they do with"},{"line_number":140,"context_line":"fernet tokens."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Developer Impact"},{"line_number":143,"context_line":"----------------"},{"line_number":144,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_6174f1fe","line":141,"in_reply_to":"5f4e5783_2a72534a","updated":"2017-10-13 18:08:06.000000000","message":"I was more thinking if there is a way to allow KSM to validate a JWT token signature, then we can allow service to at least check \"yep, this token came from keystone\"... how useful that is depends on the deployment I guess?","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"30af36ac0ccbc2b2aa0380b7d6b4cac9a14be9cb","unresolved":false,"context_lines":[{"line_number":138,"context_line":"repository will contain asymmetric key pairs rather than just secret keys. The"},{"line_number":139,"context_line":"deployer will need to take care to sync and rotate keys the way they do with"},{"line_number":140,"context_line":"fernet tokens."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Developer Impact"},{"line_number":143,"context_line":"----------------"},{"line_number":144,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_e4beb4b2","line":141,"in_reply_to":"5f4e5783_7b614705","updated":"2017-10-13 15:33:04.000000000","message":"I\u0027m not actually sure how this would work, I look forward to seeing the details :)","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"08d532a9a2c8bfae1d98062fb4bf90fb48461a2c","unresolved":false,"context_lines":[{"line_number":138,"context_line":"repository will contain asymmetric key pairs rather than just secret keys. The"},{"line_number":139,"context_line":"deployer will need to take care to sync and rotate keys the way they do with"},{"line_number":140,"context_line":"fernet tokens."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Developer Impact"},{"line_number":143,"context_line":"----------------"},{"line_number":144,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_2a72534a","line":141,"in_reply_to":"5f4e5783_e4beb4b2","updated":"2017-10-13 16:37:48.000000000","message":"Keystone needs to still populate fields for the tokens in the JSON response (data that is only held in the Keystone DB). The ASYM version would allow introspection to be smarter about offline validation with cache rather than strictly caching the entire token response, we could break apart some cache data and KSM could reference the caches directly.\n\nWe cannot allow pure offline validation, it just isn\u0027t possible unless we shove all the token data back into the payload (bad idea[tm])","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"760a555b6dad8c73f4edd50b884c5e27f8c5fe17","unresolved":false,"context_lines":[{"line_number":144,"context_line":""},{"line_number":145,"context_line":"The new token type will reuse much of the work already done for fernet tokens"},{"line_number":146,"context_line":"and will follow similar code paths, so this will be relatively easy to"},{"line_number":147,"context_line":"maintain."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"Implementation"},{"line_number":150,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_14869d67","line":147,"updated":"2017-10-13 18:28:34.000000000","message":"may be worth mentioning it will ease the deprecation/removal of uuid, which will have a large impact in maintenance","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de8499d6231b2054ba13e3b66b9c8df129d9be2f","unresolved":false,"context_lines":[{"line_number":144,"context_line":""},{"line_number":145,"context_line":"The new token type will reuse much of the work already done for fernet tokens"},{"line_number":146,"context_line":"and will follow similar code paths, so this will be relatively easy to"},{"line_number":147,"context_line":"maintain."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"Implementation"},{"line_number":150,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_729cc169","line":147,"in_reply_to":"5f4e5783_14869d67","updated":"2017-10-13 20:00:24.000000000","message":"This is mentioned at lines 41 and 42.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"760a555b6dad8c73f4edd50b884c5e27f8c5fe17","unresolved":false,"context_lines":[{"line_number":163,"context_line":"Work Items"},{"line_number":164,"context_line":"----------"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"* Decide on an implementation library"},{"line_number":167,"context_line":"* Refactor the fernet utilities modules to be generic enough to work with JWT"},{"line_number":168,"context_line":"  or inheritable"},{"line_number":169,"context_line":"* Add a keystone-manage command to set up and rotate JWT signing/encryption"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_348cf97d","line":166,"range":{"start_line":166,"start_character":2,"end_line":166,"end_character":37},"updated":"2017-10-13 18:28:34.000000000","message":"what will be the approach to get a consensus on this? updates in this spec (that can be merged showing the intent to go for it)?","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de8499d6231b2054ba13e3b66b9c8df129d9be2f","unresolved":false,"context_lines":[{"line_number":163,"context_line":"Work Items"},{"line_number":164,"context_line":"----------"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"* Decide on an implementation library"},{"line_number":167,"context_line":"* Refactor the fernet utilities modules to be generic enough to work with JWT"},{"line_number":168,"context_line":"  or inheritable"},{"line_number":169,"context_line":"* Add a keystone-manage command to set up and rotate JWT signing/encryption"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_d29b7563","line":166,"range":{"start_line":166,"start_character":2,"end_line":166,"end_character":37},"in_reply_to":"5f4e5783_348cf97d","updated":"2017-10-13 20:00:24.000000000","message":"We can drive that discussion once someone steps up to drive the work, IMO.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"43292d85c84083788022b610401ff33f9aa8ce57","unresolved":false,"context_lines":[{"line_number":168,"context_line":"  or inheritable"},{"line_number":169,"context_line":"* Add a keystone-manage command to set up and rotate JWT signing/encryption"},{"line_number":170,"context_line":"  keys"},{"line_number":171,"context_line":"* Write a new TokenFormatter class for JWT"},{"line_number":172,"context_line":"* Refactor the fernet token provider module to be inheritable or generic"},{"line_number":173,"context_line":"* Add a keystone doctor command to validate the setup in the same way that"},{"line_number":174,"context_line":"  fernet is validated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_fe4e456d","line":171,"range":{"start_line":171,"start_character":2,"end_line":171,"end_character":42},"updated":"2017-10-13 14:26:18.000000000","message":"We might be able to rework the TokenFormatter to be really generic and lean on the @crypto property (totally an implementation detail).\n\nhttps://github.com/openstack/keystone/blob/13280c25bf626ac28a96c63210cb3018bce07a69/keystone/token/providers/fernet/token_formatters.py#L49-L55\n\n\nWe kinda figured something like this would happen when we originally built fernet. I remember having conversations with Dolph about the ability to move to things like this.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b4a1b85aef4ba3a60e42602ece890d87231c3f13","unresolved":false,"context_lines":[{"line_number":168,"context_line":"  or inheritable"},{"line_number":169,"context_line":"* Add a keystone-manage command to set up and rotate JWT signing/encryption"},{"line_number":170,"context_line":"  keys"},{"line_number":171,"context_line":"* Write a new TokenFormatter class for JWT"},{"line_number":172,"context_line":"* Refactor the fernet token provider module to be inheritable or generic"},{"line_number":173,"context_line":"* Add a keystone doctor command to validate the setup in the same way that"},{"line_number":174,"context_line":"  fernet is validated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_e159018e","line":171,"range":{"start_line":171,"start_character":2,"end_line":171,"end_character":42},"in_reply_to":"5f4e5783_c4fdf86e","updated":"2017-10-13 18:08:06.000000000","message":"++","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de8499d6231b2054ba13e3b66b9c8df129d9be2f","unresolved":false,"context_lines":[{"line_number":168,"context_line":"  or inheritable"},{"line_number":169,"context_line":"* Add a keystone-manage command to set up and rotate JWT signing/encryption"},{"line_number":170,"context_line":"  keys"},{"line_number":171,"context_line":"* Write a new TokenFormatter class for JWT"},{"line_number":172,"context_line":"* Refactor the fernet token provider module to be inheritable or generic"},{"line_number":173,"context_line":"* Add a keystone doctor command to validate the setup in the same way that"},{"line_number":174,"context_line":"  fernet is validated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_72d8411d","line":171,"range":{"start_line":171,"start_character":2,"end_line":171,"end_character":42},"in_reply_to":"5f4e5783_e159018e","updated":"2017-10-13 20:00:24.000000000","message":"Done","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"30af36ac0ccbc2b2aa0380b7d6b4cac9a14be9cb","unresolved":false,"context_lines":[{"line_number":168,"context_line":"  or inheritable"},{"line_number":169,"context_line":"* Add a keystone-manage command to set up and rotate JWT signing/encryption"},{"line_number":170,"context_line":"  keys"},{"line_number":171,"context_line":"* Write a new TokenFormatter class for JWT"},{"line_number":172,"context_line":"* Refactor the fernet token provider module to be inheritable or generic"},{"line_number":173,"context_line":"* Add a keystone doctor command to validate the setup in the same way that"},{"line_number":174,"context_line":"  fernet is validated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_c4fdf86e","line":171,"range":{"start_line":171,"start_character":2,"end_line":171,"end_character":42},"in_reply_to":"5f4e5783_fe4e456d","updated":"2017-10-13 15:33:04.000000000","message":"Yep, the class looks like it\u0027s meant to be inherited. We should move it out of the fernet/ path though.","commit_id":"9f55ba398da83cd1e9b51dc652455e5817d3af7e"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"b04ce1a1cc0add4a916c8051031856733811db4d","unresolved":false,"context_lines":[{"line_number":106,"context_line":"---------------"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Since JWT is a widely used web standard, this will have a net positive impact"},{"line_number":109,"context_line":"on security. Choosing to use JWE, an optional feature of the JWT spec, will"},{"line_number":110,"context_line":"ensure that the data within the token is at least as secure as it is in fernet"},{"line_number":111,"context_line":"tokens. These will still be bearer tokens and so interception of one must still"},{"line_number":112,"context_line":"be guarded against."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_e3f1b302","line":111,"range":{"start_line":109,"start_character":13,"end_line":111,"end_character":7},"updated":"2017-10-17 19:09:54.000000000","message":"So for this spec we will need to use JWE then, not make it optional, correct?","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"4183254863d3c6cf8744aa801c0227b8ab8cc343","unresolved":false,"context_lines":[{"line_number":106,"context_line":"---------------"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Since JWT is a widely used web standard, this will have a net positive impact"},{"line_number":109,"context_line":"on security. Choosing to use JWE, an optional feature of the JWT spec, will"},{"line_number":110,"context_line":"ensure that the data within the token is at least as secure as it is in fernet"},{"line_number":111,"context_line":"tokens. These will still be bearer tokens and so interception of one must still"},{"line_number":112,"context_line":"be guarded against."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_a36f3b29","line":111,"range":{"start_line":109,"start_character":13,"end_line":111,"end_character":7},"in_reply_to":"5f4e5783_031a8fca","updated":"2017-10-17 19:23:37.000000000","message":"cool, thanks!","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"74263e215ae7629da4c187746619ffdc3539d196","unresolved":false,"context_lines":[{"line_number":106,"context_line":"---------------"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Since JWT is a widely used web standard, this will have a net positive impact"},{"line_number":109,"context_line":"on security. Choosing to use JWE, an optional feature of the JWT spec, will"},{"line_number":110,"context_line":"ensure that the data within the token is at least as secure as it is in fernet"},{"line_number":111,"context_line":"tokens. These will still be bearer tokens and so interception of one must still"},{"line_number":112,"context_line":"be guarded against."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_c436bc03","line":111,"range":{"start_line":109,"start_character":13,"end_line":111,"end_character":7},"in_reply_to":"5f4e5783_215342e4","updated":"2017-10-17 21:28:29.000000000","message":"Kind of. If the token is still valid you could get information about the token that way. But if the token is expired or revoked you would just get a 401 and no information about the token or the user or scope.\n\nIt doesn\u0027t provide a huge benefit but it\u0027s at least important to not backstep over features we get from fernet.","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9c9ab86e61d9487d1784f7f3fafb3a8325827a00","unresolved":false,"context_lines":[{"line_number":106,"context_line":"---------------"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Since JWT is a widely used web standard, this will have a net positive impact"},{"line_number":109,"context_line":"on security. Choosing to use JWE, an optional feature of the JWT spec, will"},{"line_number":110,"context_line":"ensure that the data within the token is at least as secure as it is in fernet"},{"line_number":111,"context_line":"tokens. These will still be bearer tokens and so interception of one must still"},{"line_number":112,"context_line":"be guarded against."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_66b56acd","line":111,"range":{"start_line":109,"start_character":13,"end_line":111,"end_character":7},"in_reply_to":"5f4e5783_a36f3b29","updated":"2017-10-20 09:41:22.000000000","message":"Clarified in a new review","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"c7ea8f8bb0a968773a989576ca4ce5c92afd05b9","unresolved":false,"context_lines":[{"line_number":106,"context_line":"---------------"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Since JWT is a widely used web standard, this will have a net positive impact"},{"line_number":109,"context_line":"on security. Choosing to use JWE, an optional feature of the JWT spec, will"},{"line_number":110,"context_line":"ensure that the data within the token is at least as secure as it is in fernet"},{"line_number":111,"context_line":"tokens. These will still be bearer tokens and so interception of one must still"},{"line_number":112,"context_line":"be guarded against."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_215342e4","line":111,"range":{"start_line":109,"start_character":13,"end_line":111,"end_character":7},"in_reply_to":"5f4e5783_a36f3b29","updated":"2017-10-17 20:38:37.000000000","message":"With the current default policy for validating tokens, you can send the same token as both x-subject-token and x-auth-token and get the information of the token back. Doesn\u0027t that make it so that encryption doesn\u0027t bring much to the table?","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9c9ab86e61d9487d1784f7f3fafb3a8325827a00","unresolved":false,"context_lines":[{"line_number":106,"context_line":"---------------"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Since JWT is a widely used web standard, this will have a net positive impact"},{"line_number":109,"context_line":"on security. Choosing to use JWE, an optional feature of the JWT spec, will"},{"line_number":110,"context_line":"ensure that the data within the token is at least as secure as it is in fernet"},{"line_number":111,"context_line":"tokens. These will still be bearer tokens and so interception of one must still"},{"line_number":112,"context_line":"be guarded against."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_46ccae69","line":111,"range":{"start_line":109,"start_character":13,"end_line":111,"end_character":7},"in_reply_to":"5f4e5783_c436bc03","updated":"2017-10-20 09:41:22.000000000","message":"Clarified in a new review","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b522a39794b4b3b0e639eab197695b1131d0de85","unresolved":false,"context_lines":[{"line_number":106,"context_line":"---------------"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Since JWT is a widely used web standard, this will have a net positive impact"},{"line_number":109,"context_line":"on security. Choosing to use JWE, an optional feature of the JWT spec, will"},{"line_number":110,"context_line":"ensure that the data within the token is at least as secure as it is in fernet"},{"line_number":111,"context_line":"tokens. These will still be bearer tokens and so interception of one must still"},{"line_number":112,"context_line":"be guarded against."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_031a8fca","line":111,"range":{"start_line":109,"start_character":13,"end_line":111,"end_character":7},"in_reply_to":"5f4e5783_e3f1b302","updated":"2017-10-17 19:22:34.000000000","message":"Right - it\u0027s optional in the IETF standard but we won\u0027t make it configurable in keystone, it\u0027ll just be part of how the token is built.","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"1ea087fc7a152b5ae0f2c02083369469d3ad4fc3","unresolved":false,"context_lines":[{"line_number":165,"context_line":"* Decide on an implementation library"},{"line_number":166,"context_line":"* Refactor the fernet utilities modules to be generic enough to work with JWT"},{"line_number":167,"context_line":"  or inheritable"},{"line_number":168,"context_line":"* Add a ``keystone-manage`` command to set up and rotate JWT signing/encryption"},{"line_number":169,"context_line":"  keys"},{"line_number":170,"context_line":"* Generalize the ``TokenFormatter`` class to support JWT"},{"line_number":171,"context_line":"* Refactor the fernet token provider module to be inheritable or generic"},{"line_number":172,"context_line":"* Add a keystone doctor command to validate the setup in the same way that"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_baf820c4","line":169,"range":{"start_line":168,"start_character":2,"end_line":169,"end_character":6},"updated":"2017-10-19 22:56:19.000000000","message":"can we re-use the logic we have for fernet too? or is rotation different for jwt?","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9c9ab86e61d9487d1784f7f3fafb3a8325827a00","unresolved":false,"context_lines":[{"line_number":165,"context_line":"* Decide on an implementation library"},{"line_number":166,"context_line":"* Refactor the fernet utilities modules to be generic enough to work with JWT"},{"line_number":167,"context_line":"  or inheritable"},{"line_number":168,"context_line":"* Add a ``keystone-manage`` command to set up and rotate JWT signing/encryption"},{"line_number":169,"context_line":"  keys"},{"line_number":170,"context_line":"* Generalize the ``TokenFormatter`` class to support JWT"},{"line_number":171,"context_line":"* Refactor the fernet token provider module to be inheritable or generic"},{"line_number":172,"context_line":"* Add a keystone doctor command to validate the setup in the same way that"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_269e5254","line":169,"range":{"start_line":168,"start_character":2,"end_line":169,"end_character":6},"in_reply_to":"3f4b6375_12c71448","updated":"2017-10-20 09:41:22.000000000","message":"Actually already addressed in the proposed change section.","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8958c6f0622005b7eddebd341fec40f866090ee5","unresolved":false,"context_lines":[{"line_number":165,"context_line":"* Decide on an implementation library"},{"line_number":166,"context_line":"* Refactor the fernet utilities modules to be generic enough to work with JWT"},{"line_number":167,"context_line":"  or inheritable"},{"line_number":168,"context_line":"* Add a ``keystone-manage`` command to set up and rotate JWT signing/encryption"},{"line_number":169,"context_line":"  keys"},{"line_number":170,"context_line":"* Generalize the ``TokenFormatter`` class to support JWT"},{"line_number":171,"context_line":"* Refactor the fernet token provider module to be inheritable or generic"},{"line_number":172,"context_line":"* Add a keystone doctor command to validate the setup in the same way that"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_620e6f3c","line":169,"range":{"start_line":168,"start_character":2,"end_line":169,"end_character":6},"in_reply_to":"3f4b6375_269e5254","updated":"2017-10-20 14:57:17.000000000","message":"Yep - and the nice this is the each keystone node will have their own private keys, but they never leave the actual node. Only the public keys need to be replicated, which is a better security model.","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8529aa0ebd80f5f61b307df35163b3fed5e93a7e","unresolved":false,"context_lines":[{"line_number":165,"context_line":"* Decide on an implementation library"},{"line_number":166,"context_line":"* Refactor the fernet utilities modules to be generic enough to work with JWT"},{"line_number":167,"context_line":"  or inheritable"},{"line_number":168,"context_line":"* Add a ``keystone-manage`` command to set up and rotate JWT signing/encryption"},{"line_number":169,"context_line":"  keys"},{"line_number":170,"context_line":"* Generalize the ``TokenFormatter`` class to support JWT"},{"line_number":171,"context_line":"* Refactor the fernet token provider module to be inheritable or generic"},{"line_number":172,"context_line":"* Add a keystone doctor command to validate the setup in the same way that"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_12c71448","line":169,"range":{"start_line":168,"start_character":2,"end_line":169,"end_character":6},"in_reply_to":"3f4b6375_baf820c4","updated":"2017-10-20 06:41:06.000000000","message":"It will be basically the same, we\u0027ll just have to account for key pairs instead of single secret keys.","commit_id":"ae7760d282aaf58a7ed87caea36f3f79b60b3a68"}]}