)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"e8d6e1aa6c21427fa7511fbcbb4d1272575e0441","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Adam Young \u003cayoung@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-05-29 22:15:44 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Session Tokens"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Blueprint session-extendable-tokens"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1ae5cdf2_d6463823","line":7,"updated":"2014-05-30 10:10:04.000000000","message":"Even though you are adding the link to the blueprint, I would prefer a more descriptive commit title","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Adam Young \u003cayoung@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-05-29 22:15:44 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Session Tokens"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Blueprint session-extendable-tokens"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1ae5cdf2_afe3b331","line":7,"in_reply_to":"1ae5cdf2_d6463823","updated":"2014-06-03 05:40:03.000000000","message":"++","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8929112532fcd65d5ff927fd2412bb76c5e4f5c6","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-07-09 17:47:45 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Session Tokens"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Matchi the implementation of unscoped tokens to the needs of web"},{"line_number":10,"context_line":"applications like Horizon"},{"line_number":11,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"baada198_95e0ecfb","line":8,"updated":"2014-07-10 07:09:15.000000000","message":"Typo, Match or Matching","commit_id":"7ada953046572e86cceaea91ef32f108a6571132"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"adad472ef9ae614966b67eb9f7539a98bffebef8","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Keystone token as a record of authentication.  Limit the scope of what"},{"line_number":12,"context_line":"can be done with such a token, and allow the lifespan of the token to"},{"line_number":13,"context_line":"extend with web based (keep alive) activity, so the user does not have"},{"line_number":14,"context_line":"to resbumit their origianl credentails too often."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Blueprint session-extendable-tokens"},{"line_number":17,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"5a890539_6bb0af8b","line":14,"updated":"2014-12-02 20:24:08.000000000","message":"original*","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"}],"specs/juno/session-tokens.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"1ae5cdf2_4fc5cf8c","updated":"2014-06-03 05:40:03.000000000","message":"Avoid using double spaces, we don\u0027t use them in our docs or api-specs.\n\nSingle spaces for all the things!","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6edc15d65fb8c9446d907cc3581053b6bc176005","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Session Tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"  https://blueprints.launchpad.net/keystone/+spec/session-extendable-tokens"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_17ccd034","line":9,"updated":"2014-06-02 17:10:38.000000000","message":"The \u0027\u003d\u003d\u0027 here should be the same length as the title: \n\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n    Session Tokens\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Session Tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"  https://blueprints.launchpad.net/keystone/+spec/session-extendable-tokens"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_cfd1df58","line":9,"in_reply_to":"1ae5cdf2_17ccd034","updated":"2014-06-03 05:40:03.000000000","message":"++","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"e8d6e1aa6c21427fa7511fbcbb4d1272575e0441","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"  https://blueprints.launchpad.net/keystone/+spec/session-extendable-tokens"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"  Short lived, unscoped tokens.  Used by Horizon and similar applications"},{"line_number":15,"context_line":"  these tokens can only be used with Keystone.  They will serve as a cache"},{"line_number":16,"context_line":"  of authentication, so that the other services do not need to record the"},{"line_number":17,"context_line":"  users credentials.  A session token will be used to get a scoped token."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_f6f894c6","line":14,"updated":"2014-05-30 10:10:04.000000000","message":"Can you rephrase these first sentences? The first three could be written more coherently, or at least they look confusing to me.","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"91827d993007b84879e0b8e151e16e4078d7f818","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"  https://blueprints.launchpad.net/keystone/+spec/session-extendable-tokens"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"  Short lived, unscoped tokens.  Used by Horizon and similar applications"},{"line_number":15,"context_line":"  these tokens can only be used with Keystone.  They will serve as a cache"},{"line_number":16,"context_line":"  of authentication, so that the other services do not need to record the"},{"line_number":17,"context_line":"  users credentials.  A session token will be used to get a scoped token."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_71499c8a","line":14,"in_reply_to":"1ae5cdf2_f6f894c6","updated":"2014-06-02 19:39:48.000000000","message":"they\u0027re not even sentences in the first place","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6edc15d65fb8c9446d907cc3581053b6bc176005","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"   Tokens exchanged for other  tokens should only decrease in power.  However,"},{"line_number":23,"context_line":"   Horizon requires a   scoped token to be converted to a differently scoped"},{"line_number":24,"context_line":"   token.  Horizon then revokes the old token.  It does this so that it only"},{"line_number":25,"context_line":"   needs to hold on to   a single token.  However, it is a security risk:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_7ac5f98c","line":22,"updated":"2014-06-02 17:10:38.000000000","message":"decrease in power? What does this mean exactly?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"91827d993007b84879e0b8e151e16e4078d7f818","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"   Tokens exchanged for other  tokens should only decrease in power.  However,"},{"line_number":23,"context_line":"   Horizon requires a   scoped token to be converted to a differently scoped"},{"line_number":24,"context_line":"   token.  Horizon then revokes the old token.  It does this so that it only"},{"line_number":25,"context_line":"   needs to hold on to   a single token.  However, it is a security risk:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_d159905b","line":22,"updated":"2014-06-02 19:39:48.000000000","message":"unindent all the arbitrarily indented things","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6edc15d65fb8c9446d907cc3581053b6bc176005","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"   Tokens exchanged for other  tokens should only decrease in power.  However,"},{"line_number":23,"context_line":"   Horizon requires a   scoped token to be converted to a differently scoped"},{"line_number":24,"context_line":"   token.  Horizon then revokes the old token.  It does this so that it only"},{"line_number":25,"context_line":"   needs to hold on to   a single token.  However, it is a security risk:"},{"line_number":26,"context_line":"   one expoesed token can   provide all access to all rolesa user has."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_1ad5d542","line":23,"updated":"2014-06-02 17:10:38.000000000","message":"remove extra space \u0027a scoped\u0027","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6650,"name":"Eric Peterson","email":"ejpetey@gmail.com","username":"ericpeterson-l"},"change_message_id":"f8c9b1ad1ad22bba669a11aa9f6b64d29d513314","unresolved":false,"context_lines":[{"line_number":23,"context_line":"   Horizon requires a   scoped token to be converted to a differently scoped"},{"line_number":24,"context_line":"   token.  Horizon then revokes the old token.  It does this so that it only"},{"line_number":25,"context_line":"   needs to hold on to   a single token.  However, it is a security risk:"},{"line_number":26,"context_line":"   one expoesed token can   provide all access to all rolesa user has."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"   In addition, as the lifespan of the token shrinks, Horizon will start to"},{"line_number":29,"context_line":"   randomly log users out.  This is not how a session is supposed to work."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_724eebc2","line":26,"updated":"2014-06-10 22:25:04.000000000","message":"Why is this a horizon problem?  This is an issue with how tokens are obtained with keystone..... Horizon is using the model keystone has.  I would focus the communication on the perspective of why the change is needed within keystone.","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":23,"context_line":"   Horizon requires a   scoped token to be converted to a differently scoped"},{"line_number":24,"context_line":"   token.  Horizon then revokes the old token.  It does this so that it only"},{"line_number":25,"context_line":"   needs to hold on to   a single token.  However, it is a security risk:"},{"line_number":26,"context_line":"   one expoesed token can   provide all access to all rolesa user has."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"   In addition, as the lifespan of the token shrinks, Horizon will start to"},{"line_number":29,"context_line":"   randomly log users out.  This is not how a session is supposed to work."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_0fdf473c","line":26,"updated":"2014-06-03 05:40:03.000000000","message":"s/expoesed/exposed","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"e8d6e1aa6c21427fa7511fbcbb4d1272575e0441","unresolved":false,"context_lines":[{"line_number":23,"context_line":"   Horizon requires a   scoped token to be converted to a differently scoped"},{"line_number":24,"context_line":"   token.  Horizon then revokes the old token.  It does this so that it only"},{"line_number":25,"context_line":"   needs to hold on to   a single token.  However, it is a security risk:"},{"line_number":26,"context_line":"   one expoesed token can   provide all access to all rolesa user has."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"   In addition, as the lifespan of the token shrinks, Horizon will start to"},{"line_number":29,"context_line":"   randomly log users out.  This is not how a session is supposed to work."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_166fc093","line":26,"updated":"2014-05-30 10:10:04.000000000","message":"s/rolesa/roles a/","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6650,"name":"Eric Peterson","email":"ejpetey@gmail.com","username":"ericpeterson-l"},"change_message_id":"f8c9b1ad1ad22bba669a11aa9f6b64d29d513314","unresolved":false,"context_lines":[{"line_number":26,"context_line":"   one expoesed token can   provide all access to all rolesa user has."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"   In addition, as the lifespan of the token shrinks, Horizon will start to"},{"line_number":29,"context_line":"   randomly log users out.  This is not how a session is supposed to work."},{"line_number":30,"context_line":"   Instead, a Horizon session should only live 10 minutes (be default) but be"},{"line_number":31,"context_line":"   extended when ever the user communicates with the server.  Horizon can"},{"line_number":32,"context_line":"   choose to limit how often it contacts Keystone (every minute probably is OK)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_72fc2b3f","line":29,"updated":"2014-06-10 22:25:04.000000000","message":"It\u0027s not clear why they are \"randomly\" logged out.  They are logged out if either the session is too old, or if the token is no longer valid.  Neither of these events are random.","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":30,"context_line":"   Instead, a Horizon session should only live 10 minutes (be default) but be"},{"line_number":31,"context_line":"   extended when ever the user communicates with the server.  Horizon can"},{"line_number":32,"context_line":"   choose to limit how often it contacts Keystone (every minute probably is OK)"},{"line_number":33,"context_line":"   and the expiration time of the Session should be extended when it does."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_4fe86fe2","line":33,"updated":"2014-06-03 05:40:03.000000000","message":"extended by another 10 minutes?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"91827d993007b84879e0b8e151e16e4078d7f818","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Proposed Change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Create a new class of unscoped tokens:session tokens."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Aspects of  session tokens:"},{"line_number":42,"context_line":"*  have default expirey of 10 minutes."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_7140bc56","line":39,"updated":"2014-06-02 19:39:48.000000000","message":"?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7860302fc92cb63d51e108f5225dab7b836baa4e","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Create a new class of unscoped tokens:session tokens."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Aspects of  session tokens:"},{"line_number":42,"context_line":"*  have default expirey of 10 minutes."},{"line_number":43,"context_line":"*  can have their expiration time extended."},{"line_number":44,"context_line":"*  Only unscoped."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_af4ad3a9","line":41,"updated":"2014-06-03 05:51:21.000000000","message":"also, this list is just being rendered as a long string. \n\ni.e.: Aspects of session tokens: * have default expirey of 10 minutes. * can have their expiration time extended. * Only unscoped. * have no catalog, except for the identity service/endpoint * Are only honored by Keystone * Can be exchanged for a scoped token with a longer expiration time","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Create a new class of unscoped tokens:session tokens."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Aspects of  session tokens:"},{"line_number":42,"context_line":"*  have default expirey of 10 minutes."},{"line_number":43,"context_line":"*  can have their expiration time extended."},{"line_number":44,"context_line":"*  Only unscoped."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_4f214f4c","line":41,"updated":"2014-06-03 05:40:03.000000000","message":"s/Aspects/Properties?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Create a new class of unscoped tokens:session tokens."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Aspects of  session tokens:"},{"line_number":42,"context_line":"*  have default expirey of 10 minutes."},{"line_number":43,"context_line":"*  can have their expiration time extended."},{"line_number":44,"context_line":"*  Only unscoped."},{"line_number":45,"context_line":"*  have no catalog, except for the identity service/endpoint"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_0f282733","line":42,"updated":"2014-06-03 05:40:03.000000000","message":"capitalize all start of the bullet points, you do it for some already\n\nsuggest re-word to \"Have a default expire time of 10 minutes.\"\n\nWill this be configurable?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Aspects of  session tokens:"},{"line_number":42,"context_line":"*  have default expirey of 10 minutes."},{"line_number":43,"context_line":"*  can have their expiration time extended."},{"line_number":44,"context_line":"*  Only unscoped."},{"line_number":45,"context_line":"*  have no catalog, except for the identity service/endpoint"},{"line_number":46,"context_line":"*  Are only honored by Keystone"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_2f2b2331","line":43,"updated":"2014-06-03 05:40:03.000000000","message":"extended how? by refreshing the token? By configuring default time?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"91827d993007b84879e0b8e151e16e4078d7f818","unresolved":false,"context_lines":[{"line_number":42,"context_line":"*  have default expirey of 10 minutes."},{"line_number":43,"context_line":"*  can have their expiration time extended."},{"line_number":44,"context_line":"*  Only unscoped."},{"line_number":45,"context_line":"*  have no catalog, except for the identity service/endpoint"},{"line_number":46,"context_line":"*  Are only honored by Keystone"},{"line_number":47,"context_line":"*  Can be exchanged for a scoped token with a longer expiration time"},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_5114a04d","line":45,"updated":"2014-06-02 19:39:48.000000000","message":"so, they have a catalog, they just contain an arbitrary endpoint that keystone has no means to accurately select","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"91827d993007b84879e0b8e151e16e4078d7f818","unresolved":false,"context_lines":[{"line_number":43,"context_line":"*  can have their expiration time extended."},{"line_number":44,"context_line":"*  Only unscoped."},{"line_number":45,"context_line":"*  have no catalog, except for the identity service/endpoint"},{"line_number":46,"context_line":"*  Are only honored by Keystone"},{"line_number":47,"context_line":"*  Can be exchanged for a scoped token with a longer expiration time"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_d130b003","line":46,"updated":"2014-06-02 19:39:48.000000000","message":"is this supposed to be enforced? if so, how?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6edc15d65fb8c9446d907cc3581053b6bc176005","unresolved":false,"context_lines":[{"line_number":44,"context_line":"*  Only unscoped."},{"line_number":45,"context_line":"*  have no catalog, except for the identity service/endpoint"},{"line_number":46,"context_line":"*  Are only honored by Keystone"},{"line_number":47,"context_line":"*  Can be exchanged for a scoped token with a longer expiration time"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_fa0669cd","line":47,"updated":"2014-06-02 17:10:38.000000000","message":"Could an addition be make to this section that detailed the lifecycle or workflow this adds?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":50,"context_line":"Alternatives"},{"line_number":51,"context_line":"------------"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Kerberos would not require this.  However, Kerberos is slow (multiple round"},{"line_number":54,"context_line":"trips for each auth) and thus would likely require a mechanism like"},{"line_number":55,"context_line":"this for performance."},{"line_number":56,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_cfbb9fe3","line":53,"updated":"2014-06-03 05:40:03.000000000","message":"I have no idea what the first sentence is conveying in the context of an alternate solution to session tokens.","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"e8d6e1aa6c21427fa7511fbcbb4d1272575e0441","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Kerberos would not require this.  However, Kerberos is slow (multiple round"},{"line_number":54,"context_line":"trips for each auth) and thus would likely require a mechanism like"},{"line_number":55,"context_line":"this for performance."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Data Model Impact"},{"line_number":58,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_762c844b","line":55,"updated":"2014-05-30 10:10:04.000000000","message":"What about having an optional kerberos plugin? or something","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"None.  All changes should be to the token structure itself."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Questions which need to be addressed by this section include:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* What new data objects and/or database schema changes is this going to"},{"line_number":65,"context_line":"  require?"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_2fb963e9","line":62,"updated":"2014-06-03 05:40:03.000000000","message":"Please remove the questions if your answer is None. It makes for a harder review of the spec.","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  The additional \"session\" keyword will be present in the token request."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  In the future, remove the rule that lets  scoped token be exchanged for"},{"line_number":85,"context_line":"  another scoped token."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_6fca8b6f","line":84,"updated":"2014-06-03 05:40:03.000000000","message":"Why indent here?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"e8d6e1aa6c21427fa7511fbcbb4d1272575e0441","unresolved":false,"context_lines":[{"line_number":117,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":118,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Yes, hte aditional paramter to the token request."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":123,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_d62b982e","line":120,"updated":"2014-05-30 10:10:04.000000000","message":"s/hte/the/","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6edc15d65fb8c9446d907cc3581053b6bc176005","unresolved":false,"context_lines":[{"line_number":117,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":118,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Yes, hte aditional paramter to the token request."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":123,"context_line":"  single API interaction to consume significant server resources? Some examples"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_9acac56c","line":120,"in_reply_to":"1ae5cdf2_d62b982e","updated":"2014-06-02 17:10:38.000000000","message":"parameter*","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":130,"context_line":"Notifications Impact"},{"line_number":131,"context_line":"--------------------"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"Please specify any changes to notifications. Be that an extra notification,"},{"line_number":134,"context_line":"changes to an existing notification, or removing a notification."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_0fad879c","line":133,"updated":"2014-06-03 05:40:03.000000000","message":"drop the boilerplate text","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":141,"context_line":"Aside from the API, are there other ways a user will interact with this"},{"line_number":142,"context_line":"feature?"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"Users will only be able to use the tokens to tlak to keystone itself."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"* Does this change have an impact on python-keystoneclient? What does the user"},{"line_number":147,"context_line":"  interface there look like?"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_2fb083f3","line":144,"updated":"2014-06-03 05:40:03.000000000","message":"s/tlak/talk \n\ncapitalize Keystone\n\nIt sounds like your answer is None anyway","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":146,"context_line":"* Does this change have an impact on python-keystoneclient? What does the user"},{"line_number":147,"context_line":"  interface there look like?"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"Yes.  Keystone client should use a session token to talk to Keystone, and"},{"line_number":150,"context_line":"provide and accces mehtod to the other clients to use that session token"},{"line_number":151,"context_line":"to get tokens for talking to the other services."},{"line_number":152,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_6f91ab51","line":149,"updated":"2014-06-03 05:40:03.000000000","message":"write Keystone client as python-keystoneclient","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  interface there look like?"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"Yes.  Keystone client should use a session token to talk to Keystone, and"},{"line_number":150,"context_line":"provide and accces mehtod to the other clients to use that session token"},{"line_number":151,"context_line":"to get tokens for talking to the other services."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_ef8cdb37","line":150,"updated":"2014-06-03 05:40:03.000000000","message":"s/mehtod/method","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6edc15d65fb8c9446d907cc3581053b6bc176005","unresolved":false,"context_lines":[{"line_number":172,"context_line":"* Will the change include any locking, and if so what considerations are there"},{"line_number":173,"context_line":"  on holding the lock?"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"No"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"Other Deployer Impact"},{"line_number":178,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_9a9f2550","line":175,"updated":"2014-06-02 17:10:38.000000000","message":"what about the frequency at which we retrieve tokens? Will that have a performance impact?","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":204,"context_line":"Assignee(s)"},{"line_number":205,"context_line":"-----------"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"Who is leading the writing of the code? Or is this a blueprint where you\u0027re"},{"line_number":208,"context_line":"throwing it out there to see who picks it up?"},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"If more than one person is working on the implementation, please designate the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_6f78cb2b","line":207,"updated":"2014-06-03 05:40:03.000000000","message":"drop the boilerplate text","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6edc15d65fb8c9446d907cc3581053b6bc176005","unresolved":false,"context_lines":[{"line_number":214,"context_line":"Nathan Kinder"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Other contributors:"},{"line_number":217,"context_line":"Adam Young"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Work Items"},{"line_number":220,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_1ae235d5","line":217,"updated":"2014-06-02 17:10:38.000000000","message":"add launchpad ids, IRC nicks for people who may not be familiar with you or Nathan.","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"85e0f20cb4c2adf9fdcab0b0d62cf027dac89377","unresolved":false,"context_lines":[{"line_number":214,"context_line":"Nathan Kinder"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Other contributors:"},{"line_number":217,"context_line":"Adam Young"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Work Items"},{"line_number":220,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_2f87a310","line":217,"in_reply_to":"1ae5cdf2_1ae235d5","updated":"2014-06-03 05:40:03.000000000","message":"++","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6edc15d65fb8c9446d907cc3581053b6bc176005","unresolved":false,"context_lines":[{"line_number":222,"context_line":"Work items or tasks -- break the feature up into the things that need to be"},{"line_number":223,"context_line":"done to implement it. Those parts might end up being done by different people,"},{"line_number":224,"context_line":"but we\u0027re mostly trying to understand the timeline for implementation."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"Dependencies"},{"line_number":228,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_badce113","line":225,"updated":"2014-06-02 17:10:38.000000000","message":"How is this work going to be broken up? Initial implementation and clean up efforts? At line 84 you mention the removal of exchanging an unscoped token for a scoped one.","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"e8d6e1aa6c21427fa7511fbcbb4d1272575e0441","unresolved":false,"context_lines":[{"line_number":234,"context_line":"Testing"},{"line_number":235,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Majority of testing should b eKeystone unit tests.  Tempest tests should make"},{"line_number":238,"context_line":"use of session tokens wherever they talk directly to Keystone."},{"line_number":239,"context_line":""},{"line_number":240,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_f6e6d415","line":237,"updated":"2014-05-30 10:10:04.000000000","message":"s/b eKeystone/be Keystone/","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6edc15d65fb8c9446d907cc3581053b6bc176005","unresolved":false,"context_lines":[{"line_number":241,"context_line":"Documentation Impact"},{"line_number":242,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"Docs explianin the differnce, especially the part where a user requests a"},{"line_number":245,"context_line":"session token instead of a scoped token by default."},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_faeae90d","line":244,"updated":"2014-06-02 17:10:38.000000000","message":"explaining*","commit_id":"bbba8a1502c570734d86334d91d7bc0b426a5011"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a425968e4c28a3ce9afae24fb82f2a913d7a6854","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Horizon now requires a scoped token to be converted to a differently scoped token.  Horizon then revokes the old token.  It does this so that it only  needs to hold on to a single token.  "},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"The mechanism where a token can be exchanged for another token of greater scope is at odds with accepted security practice.  Access should only decrease the further removed from the initial authenitcation.   Tokens exchanged for other  tokens should only decrease in scope.  As Keystone is currently designed, one exposed token can provide all access to all roles a user has."},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_e64c3979","line":22,"updated":"2014-07-09 18:10:04.000000000","message":"But Horizon is not the only client of Keystone API, there are other clients (both CLI and UI) out there which integrating with Keystone. Lets be honest, this \"escalated privileges\" is really an API problem, not a client problem.","commit_id":"76d4c1c967232cb77e139e756fb590ba4145b1cd"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a425968e4c28a3ce9afae24fb82f2a913d7a6854","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Horizon now requires a scoped token to be converted to a differently scoped token.  Horizon then revokes the old token.  It does this so that it only  needs to hold on to a single token.  "},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"The mechanism where a token can be exchanged for another token of greater scope is at odds with accepted security practice.  Access should only decrease the further removed from the initial authenitcation.   Tokens exchanged for other  tokens should only decrease in scope.  As Keystone is currently designed, one exposed token can provide all access to all roles a user has."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"   When one token is exchanged for another, the expiration time of the new token matches the expiration time of the original token.  This was implemented to limit the exposure if a token were stolen.  However, when the lifespan of a token is short, Horizon will require that the user re-enter their password much more frequently.  Aside from being a suboptimal user experience, it increases the expose of passwords and the corresponding possibility of interdiction."},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_26a55104","line":24,"updated":"2014-07-09 18:10:04.000000000","message":"Lets call it what it is. In security terminology, this constitutes \"escalated privileges\".","commit_id":"76d4c1c967232cb77e139e756fb590ba4145b1cd"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a425968e4c28a3ce9afae24fb82f2a913d7a6854","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"   When one token is exchanged for another, the expiration time of the new token matches the expiration time of the original token.  This was implemented to limit the exposure if a token were stolen.  However, when the lifespan of a token is short, Horizon will require that the user re-enter their password much more frequently.  Aside from being a suboptimal user experience, it increases the expose of passwords and the corresponding possibility of interdiction."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"   In a standard web application, a user enters their credentials at the beginning, and then the session should only live a short time (10 minutes is the norm)before the user would be timed out for inactivity.   Any interaction during that 10 minute window will extend the lifespan of session for another 10 minutes."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_039aff13","line":28,"updated":"2014-07-09 18:10:04.000000000","message":"But\n\nKeystone API !\u003d Web Applications\n\nNot trying to be religious here, but REST API by design have not concept of session right? Then why are we trying to force the session paradigm onto the clients?","commit_id":"76d4c1c967232cb77e139e756fb590ba4145b1cd"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a425968e4c28a3ce9afae24fb82f2a913d7a6854","unresolved":false,"context_lines":[{"line_number":37,"context_line":"*  have default expiration of 10 minutes."},{"line_number":38,"context_line":"*  can have their expiration time extended."},{"line_number":39,"context_line":"*  Only unscoped."},{"line_number":40,"context_line":"*  Have no catalog, except for the identity service/endpoint"},{"line_number":41,"context_line":"*  Are only honored by Keystone"},{"line_number":42,"context_line":"*  Can be exchanged for a scoped token with a longer expiration time"},{"line_number":43,"context_line":"*  The request will return the list of projects."}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_f0306f09","line":40,"updated":"2014-07-09 18:10:04.000000000","message":"This sentence does sound right. You mean having a service catalog only contains identity service endpoints? But then what\u0027s the point, as Horizon already have an identity endpoint to begin with to even be able to obtain a session token?","commit_id":"76d4c1c967232cb77e139e756fb590ba4145b1cd"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a425968e4c28a3ce9afae24fb82f2a913d7a6854","unresolved":false,"context_lines":[{"line_number":38,"context_line":"*  can have their expiration time extended."},{"line_number":39,"context_line":"*  Only unscoped."},{"line_number":40,"context_line":"*  Have no catalog, except for the identity service/endpoint"},{"line_number":41,"context_line":"*  Are only honored by Keystone"},{"line_number":42,"context_line":"*  Can be exchanged for a scoped token with a longer expiration time"},{"line_number":43,"context_line":"*  The request will return the list of projects."},{"line_number":44,"context_line":"*  Will have a timestamp for when they are initially issued.  THis will be passed on to all tokens (both scoped and unscoped) created from the unscoped token.  If the unscoped token is revoked, all tokens with the same (userid, issued-at) value will also be revoked. "}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_b02ef7a3","line":41,"updated":"2014-07-09 18:10:04.000000000","message":"Are there any services currently honoring unscoped tokens?","commit_id":"76d4c1c967232cb77e139e756fb590ba4145b1cd"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a425968e4c28a3ce9afae24fb82f2a913d7a6854","unresolved":false,"context_lines":[{"line_number":39,"context_line":"*  Only unscoped."},{"line_number":40,"context_line":"*  Have no catalog, except for the identity service/endpoint"},{"line_number":41,"context_line":"*  Are only honored by Keystone"},{"line_number":42,"context_line":"*  Can be exchanged for a scoped token with a longer expiration time"},{"line_number":43,"context_line":"*  The request will return the list of projects."},{"line_number":44,"context_line":"*  Will have a timestamp for when they are initially issued.  THis will be passed on to all tokens (both scoped and unscoped) created from the unscoped token.  If the unscoped token is revoked, all tokens with the same (userid, issued-at) value will also be revoked. "},{"line_number":45,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_a3da3315","line":42,"updated":"2014-07-09 18:10:04.000000000","message":"How is this from unscoped tokens? If a session token is compromised, it\u0027s expiration can also be extended indefinitely right, even though it needs to be \"renew\" every 10 minutes? So if an attacker get a hold of a session token, he can keep extending it and still be able to use it to get the scoped tokens.","commit_id":"76d4c1c967232cb77e139e756fb590ba4145b1cd"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a425968e4c28a3ce9afae24fb82f2a913d7a6854","unresolved":false,"context_lines":[{"line_number":41,"context_line":"*  Are only honored by Keystone"},{"line_number":42,"context_line":"*  Can be exchanged for a scoped token with a longer expiration time"},{"line_number":43,"context_line":"*  The request will return the list of projects."},{"line_number":44,"context_line":"*  Will have a timestamp for when they are initially issued.  THis will be passed on to all tokens (both scoped and unscoped) created from the unscoped token.  If the unscoped token is revoked, all tokens with the same (userid, issued-at) value will also be revoked. "},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_c34ac7ab","line":44,"updated":"2014-07-09 18:10:04.000000000","message":"I am interpreting this sentence as a session token can be used to obtain both scoped and unscoped tokens. That right?","commit_id":"76d4c1c967232cb77e139e756fb590ba4145b1cd"}],"specs/kilo/session-tokens.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9f97cd92eb48d1a08a1ebde51bb4a02bc6adca9f","unresolved":false,"context_lines":[{"line_number":27,"context_line":"The mechanism where a token can be exchanged for another token of greater scope"},{"line_number":28,"context_line":"is at odds with security best practices. Access should only decrease the"},{"line_number":29,"context_line":"further removed from the initial authentication. Tokens exchanged for other"},{"line_number":30,"context_line":"tokens should has the same or few capabilities as the original token.  As"},{"line_number":31,"context_line":"Keystone is currently designed, one exposed token can provide all access to all"},{"line_number":32,"context_line":"roles a user has."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9aa7fdbe_e2fe0b38","line":30,"updated":"2014-10-20 04:38:23.000000000","message":"have* and fewer*","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"adad472ef9ae614966b67eb9f7539a98bffebef8","unresolved":false,"context_lines":[{"line_number":36,"context_line":"limit the exposure if a token was stolen. However, when the lifespan of a"},{"line_number":37,"context_line":"token is short, Horizon will require that the user re-enter their password much"},{"line_number":38,"context_line":"more frequently. Aside from being a suboptimal user experience, it increases"},{"line_number":39,"context_line":"the exposure of passwords and the corresponding possibility of interdiction."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"In a standard web application, a user enters their credentials at the"},{"line_number":42,"context_line":"beginning, and then the session should only live a short time (10 minutes is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_8b095b33","line":39,"updated":"2014-12-02 20:24:08.000000000","message":"of being intercepted*?","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0d22dd7f25bd6dff789fdafbc7e30942de4f334c","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Proposed Change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"When the user of a web applicatoin requests a token,  they will receive a"},{"line_number":51,"context_line":"modified form of an unscoped token.  This unscoped token has one property"},{"line_number":52,"context_line":"beyond that specified in the \"Unscoped to scoped only\" Blueprint:  within"},{"line_number":53,"context_line":"a confiugred window, the user can exchange it for another unscoped token"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9aa7fdbe_d73735fd","line":50,"updated":"2014-10-28 01:15:26.000000000","message":"application","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"adad472ef9ae614966b67eb9f7539a98bffebef8","unresolved":false,"context_lines":[{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"When the user of a web applicatoin requests a token,  they will receive a"},{"line_number":51,"context_line":"modified form of an unscoped token.  This unscoped token has one property"},{"line_number":52,"context_line":"beyond that specified in the \"Unscoped to scoped only\" Blueprint:  within"},{"line_number":53,"context_line":"a confiugred window, the user can exchange it for another unscoped token"},{"line_number":54,"context_line":"with an extended expiration time."}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_4e2221a4","line":51,"updated":"2014-12-02 20:24:08.000000000","message":"Why a modified form of an unscoped token? What exactly does that mean?","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"525df45252913511f7d35864de92b7bdb3b424fd","unresolved":false,"context_lines":[{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"When the user of a web applicatoin requests a token,  they will receive a"},{"line_number":51,"context_line":"modified form of an unscoped token.  This unscoped token has one property"},{"line_number":52,"context_line":"beyond that specified in the \"Unscoped to scoped only\" Blueprint:  within"},{"line_number":53,"context_line":"a confiugred window, the user can exchange it for another unscoped token"},{"line_number":54,"context_line":"with an extended expiration time."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_dd6c42a0","line":51,"in_reply_to":"5a890539_4e2221a4","updated":"2014-12-17 21:55:02.000000000","message":"++","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9f97cd92eb48d1a08a1ebde51bb4a02bc6adca9f","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"When the user of a web applicatoin requests a token,  they will receive a"},{"line_number":51,"context_line":"modified form of an unscoped token.  This unscoped token has one property"},{"line_number":52,"context_line":"beyond that specified in the \"Unscoped to scoped only\" Blueprint:  within"},{"line_number":53,"context_line":"a confiugred window, the user can exchange it for another unscoped token"},{"line_number":54,"context_line":"with an extended expiration time."},{"line_number":55,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9aa7fdbe_82e8df7d","line":52,"updated":"2014-10-20 04:38:23.000000000","message":"link this? \n\n\"Unscoped to scoped only\" `blueprint \u003curl\u003e`_","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"525df45252913511f7d35864de92b7bdb3b424fd","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"When the user of a web applicatoin requests a token,  they will receive a"},{"line_number":51,"context_line":"modified form of an unscoped token.  This unscoped token has one property"},{"line_number":52,"context_line":"beyond that specified in the \"Unscoped to scoped only\" Blueprint:  within"},{"line_number":53,"context_line":"a confiugred window, the user can exchange it for another unscoped token"},{"line_number":54,"context_line":"with an extended expiration time."},{"line_number":55,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_bd713679","line":52,"in_reply_to":"9aa7fdbe_82e8df7d","updated":"2014-12-17 21:55:02.000000000","message":"++","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"525df45252913511f7d35864de92b7bdb3b424fd","unresolved":false,"context_lines":[{"line_number":50,"context_line":"When the user of a web applicatoin requests a token,  they will receive a"},{"line_number":51,"context_line":"modified form of an unscoped token.  This unscoped token has one property"},{"line_number":52,"context_line":"beyond that specified in the \"Unscoped to scoped only\" Blueprint:  within"},{"line_number":53,"context_line":"a confiugred window, the user can exchange it for another unscoped token"},{"line_number":54,"context_line":"with an extended expiration time."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"In order to limit the capabilities of this sliding window, the initial"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_3d3706b2","line":53,"updated":"2014-12-17 21:55:02.000000000","message":"configured*","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"525df45252913511f7d35864de92b7bdb3b424fd","unresolved":false,"context_lines":[{"line_number":51,"context_line":"modified form of an unscoped token.  This unscoped token has one property"},{"line_number":52,"context_line":"beyond that specified in the \"Unscoped to scoped only\" Blueprint:  within"},{"line_number":53,"context_line":"a confiugred window, the user can exchange it for another unscoped token"},{"line_number":54,"context_line":"with an extended expiration time."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"In order to limit the capabilities of this sliding window, the initial"},{"line_number":57,"context_line":"and all subsequent token requests will be signed by a private key from"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_5d0852d9","line":54,"updated":"2014-12-17 21:55:02.000000000","message":"what is the \"one property\"? there\u0027s no API docs with this spec","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"525df45252913511f7d35864de92b7bdb3b424fd","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"In order to limit the capabilities of this sliding window, the initial"},{"line_number":57,"context_line":"and all subsequent token requests will be signed by a private key from"},{"line_number":58,"context_line":"the web server.  The corresponding public certificate will be registered"},{"line_number":59,"context_line":"with the Keystone server."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_9d12ba07","line":58,"updated":"2014-12-17 21:55:02.000000000","message":"which web server?","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"525df45252913511f7d35864de92b7bdb3b424fd","unresolved":false,"context_lines":[{"line_number":74,"context_line":"consider include:"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":77,"context_line":"* Yes.  It should make token requests from web applications more secure."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* Does this change alter the API in a way that may impact security, such as"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_5d2f723e","line":77,"updated":"2014-12-17 21:55:02.000000000","message":"describe how","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"adad472ef9ae614966b67eb9f7539a98bffebef8","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":81,"context_line":"  a new way to access sensitive information or a new way to login?"},{"line_number":82,"context_line":"*  Yes, it provides anew mechanism to limit exposure of a users credentials"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"* Does this change involve cryptography or hashing?"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_8e65e9e2","line":82,"updated":"2014-12-02 20:24:08.000000000","message":"a new*","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"525df45252913511f7d35864de92b7bdb3b424fd","unresolved":false,"context_lines":[{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":86,"context_line":"* No"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* Does this change require the use of sudo or any elevated privileges?"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_dd1a8217","line":86,"updated":"2014-12-17 21:55:02.000000000","message":"you made an assertion above that you\u0027re using signatures on token requests, and \"registering\" public certs with keystone","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"adad472ef9ae614966b67eb9f7539a98bffebef8","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":90,"context_line":"* No, but Horizon and comparable web servers already have the potentail"},{"line_number":91,"context_line":"  for an elevated set of priviledges due to their exposure to user credentials."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_ee9bcdc6","line":90,"updated":"2014-12-02 20:24:08.000000000","message":"potential*","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"525df45252913511f7d35864de92b7bdb3b424fd","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":95,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":96,"context_line":"* No new parsing.  This will be an extension to the existing token request."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_5dd69228","line":96,"updated":"2014-12-17 21:55:02.000000000","message":"in other words, you\u0027re adding additional data to the \"token request\" that must be handled, and this document avoids mentioning anything about what that data is. please detail it.","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9f97cd92eb48d1a08a1ebde51bb4a02bc6adca9f","unresolved":false,"context_lines":[{"line_number":113,"context_line":"Other End User Impact"},{"line_number":114,"context_line":"---------------------"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"python-keystoneclient should be made aware when to create an d use a session"},{"line_number":117,"context_line":"token."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Django-openstack-auth will need to make a modified call to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9aa7fdbe_229013ec","line":116,"updated":"2014-10-20 04:38:23.000000000","message":"and*","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"525df45252913511f7d35864de92b7bdb3b424fd","unresolved":false,"context_lines":[{"line_number":122,"context_line":"Performance Impact"},{"line_number":123,"context_line":"------------------"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Should have no difference in performance profile."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Other Deployer Impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_1dec0af3","line":125,"updated":"2014-12-17 21:55:02.000000000","message":"you\u0027re introducing a new authentication and authorization flow -- when it\u0027s utilized, that will *certainly* have an impact on performance.","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9f97cd92eb48d1a08a1ebde51bb4a02bc6adca9f","unresolved":false,"context_lines":[{"line_number":150,"context_line":"Work Items"},{"line_number":151,"context_line":"----------"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Should be done as a single patch to Keystone server."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Dependencies"},{"line_number":156,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9aa7fdbe_42bc376d","line":153,"updated":"2014-10-20 04:38:23.000000000","message":"what about the KSC and DOA work?","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"adad472ef9ae614966b67eb9f7539a98bffebef8","unresolved":false,"context_lines":[{"line_number":162,"context_line":"Documentation Impact"},{"line_number":163,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Docs will need a discussion of the reason to use session tokens."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_0eef391f","line":165,"updated":"2014-12-02 20:24:08.000000000","message":"also documentation on how to set them up if necessary.","commit_id":"1920f516c7365652fb80a9cf15eb79aa87165b67"}],"specs/next/session-tokens.rst":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9dd504e536f95dc91ce2425536b217ee82418db4","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The mechanism where a token can be exchanged for another token of greater scope"},{"line_number":28,"context_line":"is at odds with security best practices. Access should only decrease the"},{"line_number":29,"context_line":"further removed from the initial authentication. Tokens exchanged for other"},{"line_number":30,"context_line":"tokens should only narrow in scope. As Keystone is currently designed, one"},{"line_number":31,"context_line":"exposed token can provide all access to all roles a user has."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_e85cd4f2","line":29,"updated":"2014-07-24 05:45:50.000000000","message":"Can you quantify \"narrow in scope\" and \"access should only decrease\"? What is \"greater scope\"? Greater in the number of roles?\n\nSeem like all we are really talking about is a scoped token can\u0027t be rescoped.","commit_id":"7ada953046572e86cceaea91ef32f108a6571132"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9dd504e536f95dc91ce2425536b217ee82418db4","unresolved":false,"context_lines":[{"line_number":30,"context_line":"tokens should only narrow in scope. As Keystone is currently designed, one"},{"line_number":31,"context_line":"exposed token can provide all access to all roles a user has."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"When one token is exchanged for another, the expiration time of the new token"},{"line_number":34,"context_line":"matches the expiration time of the original token. This was implemented to"},{"line_number":35,"context_line":"limit the exposure if a token was stolen. However, when the lifespan of a"},{"line_number":36,"context_line":"token is short, Horizon will require that the user re-enter their password much"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_e82a142e","line":33,"updated":"2014-07-24 05:45:50.000000000","message":"See my previous comment. Under this proposal, what can I exchange a scoped for? Another scoped token with lesser roles? How does the end user know that?","commit_id":"7ada953046572e86cceaea91ef32f108a6571132"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"571ba6f4bfa534707e89ecd4a563e5941d5c06e3","unresolved":false,"context_lines":[{"line_number":41,"context_line":"beginning, and then the session should only live a short time (10 minutes is"},{"line_number":42,"context_line":"normal) before the user would be timed out for inactivity. Any interaction"},{"line_number":43,"context_line":"between the end user and the web application during that 10 minute window"},{"line_number":44,"context_line":"should extend the lifespan of session for another 10 minutes."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_623a9c35","line":44,"updated":"2014-07-10 22:51:08.000000000","message":"10 minutes from last interaction. Probably good to have some upper limit on this extension in terms of time (from create time) or numbers of times it can be done.","commit_id":"7ada953046572e86cceaea91ef32f108a6571132"},{"author":{"_account_id":1207,"name":"Duncan Thomas","email":"duncan.thomas@gmail.com","username":"duncan-thomas"},"change_message_id":"4724ed4a3a5c57e80cffbbcf66741626f363147b","unresolved":false,"context_lines":[{"line_number":41,"context_line":"beginning, and then the session should only live a short time (10 minutes is"},{"line_number":42,"context_line":"normal) before the user would be timed out for inactivity. Any interaction"},{"line_number":43,"context_line":"between the end user and the web application during that 10 minute window"},{"line_number":44,"context_line":"should extend the lifespan of session for another 10 minutes."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_b163c0af","line":44,"in_reply_to":"baada198_623a9c35","updated":"2014-07-14 18:20:56.000000000","message":"Why? If I\u0027m using the console continuously, having my auth suddenly log me out would be a terrible user experience, and entirely at odds with every sensible webapp in the world....","commit_id":"7ada953046572e86cceaea91ef32f108a6571132"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"9ccf3efbc9c90d65022779eb077b479a96c41f5b","unresolved":false,"context_lines":[{"line_number":41,"context_line":"beginning, and then the session should only live a short time (10 minutes is"},{"line_number":42,"context_line":"normal) before the user would be timed out for inactivity. Any interaction"},{"line_number":43,"context_line":"between the end user and the web application during that 10 minute window"},{"line_number":44,"context_line":"should extend the lifespan of session for another 10 minutes."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_896be2b7","line":44,"in_reply_to":"baada198_b163c0af","updated":"2014-07-22 01:16:21.000000000","message":"Duncan, I think you misread it, and have things backwards.  I am agreeing with what you just said, and trying to support it.","commit_id":"7ada953046572e86cceaea91ef32f108a6571132"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"84977cac9e6b9afc106901e5c8f8f49d6faf25b8","unresolved":false,"context_lines":[{"line_number":41,"context_line":"beginning, and then the session should only live a short time (10 minutes is"},{"line_number":42,"context_line":"normal) before the user would be timed out for inactivity. Any interaction"},{"line_number":43,"context_line":"between the end user and the web application during that 10 minute window"},{"line_number":44,"context_line":"should extend the lifespan of session for another 10 minutes."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_826170d5","line":44,"in_reply_to":"baada198_b163c0af","updated":"2014-07-17 22:40:33.000000000","message":"We also discussed having a configurable window for \"refresh\" that could occur even after expiration. an active session could be used to get a scoped token, an expired session could only be used (within a limited window) to refresh the session.","commit_id":"7ada953046572e86cceaea91ef32f108a6571132"}]}