)]}'
{"doc/source/configuration.rst":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"73e660dd44a7eba13ae8078a7a0201649737556c","unresolved":false,"context_lines":[{"line_number":507,"context_line":"using ``keystone-manage fernet_rotate``."},{"line_number":508,"context_line":""},{"line_number":509,"context_line":".. NOTE::"},{"line_number":510,"context_line":"    The ``fernet`` token provider is experimental."},{"line_number":511,"context_line":""},{"line_number":512,"context_line":".. WARNING::"},{"line_number":513,"context_line":"    UUID, PKI, PKIZ, and Fernet tokens are all bearer tokens, meaning that they"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a1a9d01_c9246fc6","line":510,"updated":"2015-09-29 20:57:48.000000000","message":"It would be nice to indicate why this is experimental.  And it doesn\u0027t have to include a list of bugs, just some blurb about why.","commit_id":"15190bdf1e292c2e4df4fa9a9e11ef3e4b38ee6a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"38a70bcf0916911e12974770a6d9c17d4a07005c","unresolved":false,"context_lines":[{"line_number":507,"context_line":"using ``keystone-manage fernet_rotate``."},{"line_number":508,"context_line":""},{"line_number":509,"context_line":".. NOTE::"},{"line_number":510,"context_line":"    The ``fernet`` token provider is experimental."},{"line_number":511,"context_line":""},{"line_number":512,"context_line":".. WARNING::"},{"line_number":513,"context_line":"    UUID, PKI, PKIZ, and Fernet tokens are all bearer tokens, meaning that they"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a1a9d01_a87a1ebb","line":510,"in_reply_to":"9a1a9d01_c9246fc6","updated":"2015-09-30 22:53:35.000000000","message":"Done","commit_id":"15190bdf1e292c2e4df4fa9a9e11ef3e4b38ee6a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ed5e475cf3f33892c7312e16650f3d30a8553d4f","unresolved":false,"context_lines":[{"line_number":508,"context_line":""},{"line_number":509,"context_line":".. NOTE::"},{"line_number":510,"context_line":"    The ``fernet`` token provider is experimental. The keystone development"},{"line_number":511,"context_line":"    team has not agreed that this is supported at this time."},{"line_number":512,"context_line":""},{"line_number":513,"context_line":".. WARNING::"},{"line_number":514,"context_line":"    UUID, PKI, PKIZ, and Fernet tokens are all bearer tokens, meaning that they"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_00505a09","line":511,"updated":"2015-10-03 12:09:43.000000000","message":"(nit) that this is supported (for production ?) at this time.","commit_id":"29ea31aec0ca8cf01036fbc47d1fd65ef63e4e03"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"071a66a52772fb510af2f6bffb59ace2bd171f62","unresolved":false,"context_lines":[{"line_number":508,"context_line":""},{"line_number":509,"context_line":".. NOTE::"},{"line_number":510,"context_line":"    The ``fernet`` token provider is experimental. The keystone development"},{"line_number":511,"context_line":"    team has not agreed that this is supported at this time."},{"line_number":512,"context_line":""},{"line_number":513,"context_line":".. WARNING::"},{"line_number":514,"context_line":"    UUID, PKI, PKIZ, and Fernet tokens are all bearer tokens, meaning that they"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a2fa921_5b03b40d","line":511,"in_reply_to":"9a1a9d01_00505a09","updated":"2015-10-06 22:24:44.000000000","message":"May want to remove the last sentence.\n\n\"The keystone development team has not agreed that this is supported at this time.\"\n\nWe have to *support* it regardless. Experimental is just a tag signifying that the feature has not been battle tested and we it may change as things turn up.\n\nSupport is a product issue (i.e. whoever is selling an OpenStack distro).","commit_id":"29ea31aec0ca8cf01036fbc47d1fd65ef63e4e03"}],"keystone/common/config.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e9e373fd89493898331af0020f004b55f5a95f46","unresolved":false,"context_lines":[{"line_number":252,"context_line":"                   help\u003d\u0027Controls the token construction, validation, and \u0027"},{"line_number":253,"context_line":"                        \u0027revocation operations. Entrypoint in the \u0027"},{"line_number":254,"context_line":"                        \u0027keystone.token.provider namespace. Core providers \u0027"},{"line_number":255,"context_line":"                        \u0027are [pkiz|pki|uuid].\u0027),"},{"line_number":256,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"},{"line_number":257,"context_line":"                   default\u003d\u0027sql\u0027,"},{"line_number":258,"context_line":"                   help\u003d\u0027Entrypoint for the token persistence backend driver \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba15a1d1_f1933859","line":255,"updated":"2015-09-17 21:02:20.000000000","message":"considering fernet was already an option in kilo this seems like overkill https://github.com/openstack/keystone/blob/stable/kilo/etc/keystone.conf.sample#L1682","commit_id":"72daa5ed764bf290ee3ed752330bf3b008ede0ce"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"538a0c47aeeb7de33677ccbb44ba6e2f13f59abe","unresolved":false,"context_lines":[{"line_number":252,"context_line":"                   help\u003d\u0027Controls the token construction, validation, and \u0027"},{"line_number":253,"context_line":"                        \u0027revocation operations. Entrypoint in the \u0027"},{"line_number":254,"context_line":"                        \u0027keystone.token.provider namespace. Core providers \u0027"},{"line_number":255,"context_line":"                        \u0027are [pkiz|pki|uuid].\u0027),"},{"line_number":256,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"},{"line_number":257,"context_line":"                   default\u003d\u0027sql\u0027,"},{"line_number":258,"context_line":"                   help\u003d\u0027Entrypoint for the token persistence backend driver \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba15a1d1_3db5fe7c","line":255,"in_reply_to":"ba15a1d1_d128749c","updated":"2015-09-18 02:09:24.000000000","message":"That wouldn\u0027t be a bad idea. Removing the option entirely leaves the impression we removed the feature.\n\nAdding something along the lines of uuid being the only officially supported format for production deployments would address Dolph\u0027s comment about PKI and PKIZ token formats, too.","commit_id":"72daa5ed764bf290ee3ed752330bf3b008ede0ce"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"32f3544ea2c4520eede7f90af92b8903fb33251f","unresolved":false,"context_lines":[{"line_number":252,"context_line":"                   help\u003d\u0027Controls the token construction, validation, and \u0027"},{"line_number":253,"context_line":"                        \u0027revocation operations. Entrypoint in the \u0027"},{"line_number":254,"context_line":"                        \u0027keystone.token.provider namespace. Core providers \u0027"},{"line_number":255,"context_line":"                        \u0027are [pkiz|pki|uuid].\u0027),"},{"line_number":256,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"},{"line_number":257,"context_line":"                   default\u003d\u0027sql\u0027,"},{"line_number":258,"context_line":"                   help\u003d\u0027Entrypoint for the token persistence backend driver \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba15a1d1_d128749c","line":255,"in_reply_to":"ba15a1d1_f1933859","updated":"2015-09-17 21:22:00.000000000","message":"I could leave fernet here and add some text that it\u0027s experimental, if that\u0027s what people prefer.","commit_id":"72daa5ed764bf290ee3ed752330bf3b008ede0ce"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"73e660dd44a7eba13ae8078a7a0201649737556c","unresolved":false,"context_lines":[{"line_number":253,"context_line":"                        \u0027revocation operations. Entrypoint in the \u0027"},{"line_number":254,"context_line":"                        \u0027keystone.token.provider namespace. Core providers \u0027"},{"line_number":255,"context_line":"                        \u0027are [uuid|pkiz|pki|fernet]. uuid is supported for \u0027"},{"line_number":256,"context_line":"                        \u0027production environments. fernet is experimental.\u0027),"},{"line_number":257,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"},{"line_number":258,"context_line":"                   default\u003d\u0027sql\u0027,"},{"line_number":259,"context_line":"                   help\u003d\u0027Entrypoint for the token persistence backend driver \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a1a9d01_c90b0f29","line":256,"updated":"2015-09-29 20:57:48.000000000","message":"This comment notes uuid and fernet, but leaves me and probably others wondering what is the state of pkiz and pki.","commit_id":"15190bdf1e292c2e4df4fa9a9e11ef3e4b38ee6a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"38a70bcf0916911e12974770a6d9c17d4a07005c","unresolved":false,"context_lines":[{"line_number":253,"context_line":"                        \u0027revocation operations. Entrypoint in the \u0027"},{"line_number":254,"context_line":"                        \u0027keystone.token.provider namespace. Core providers \u0027"},{"line_number":255,"context_line":"                        \u0027are [uuid|pkiz|pki|fernet]. uuid is supported for \u0027"},{"line_number":256,"context_line":"                        \u0027production environments. fernet is experimental.\u0027),"},{"line_number":257,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"},{"line_number":258,"context_line":"                   default\u003d\u0027sql\u0027,"},{"line_number":259,"context_line":"                   help\u003d\u0027Entrypoint for the token persistence backend driver \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a1a9d01_a861be06","line":256,"in_reply_to":"9a1a9d01_c90b0f29","updated":"2015-09-30 22:53:35.000000000","message":"Done","commit_id":"15190bdf1e292c2e4df4fa9a9e11ef3e4b38ee6a"}],"keystone/token/providers/fernet/core.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e3bf0d007b0d31afa5d42535fd5543686eb83559","unresolved":false,"context_lines":[{"line_number":35,"context_line":"        self.token_formatter \u003d tf.TokenFormatter()"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"        LOG.warning(_LW(\u0027The fernet token provider is experimental and should \u0027"},{"line_number":38,"context_line":"                        \u0027not be used in production environments.\u0027))"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def needs_persistence(self):"},{"line_number":41,"context_line":"        \"\"\"Should the token be written to a backend.\"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"ba15a1d1_fcdb0f7a","line":38,"updated":"2015-09-17 21:38:04.000000000","message":"It feels wrong (mostly: annoying) to start retro-actively issuing these warnings. People are using Fernet in stable/kilo and the current list of bugs stands as accurate as far as we know. I\u0027m not sure any of the tempest failures represent real blockers to production use.","commit_id":"72daa5ed764bf290ee3ed752330bf3b008ede0ce"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"538a0c47aeeb7de33677ccbb44ba6e2f13f59abe","unresolved":false,"context_lines":[{"line_number":35,"context_line":"        self.token_formatter \u003d tf.TokenFormatter()"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"        LOG.warning(_LW(\u0027The fernet token provider is experimental and should \u0027"},{"line_number":38,"context_line":"                        \u0027not be used in production environments.\u0027))"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def needs_persistence(self):"},{"line_number":41,"context_line":"        \"\"\"Should the token be written to a backend.\"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"ba15a1d1_3d6c1e07","line":38,"in_reply_to":"ba15a1d1_fcdb0f7a","updated":"2015-09-18 02:09:24.000000000","message":"The only one that I can think of is the case of revocation events. You trigger a revocation event and as you get a new token, it\u0027s ends up being revoked. \n\nLike you said, I\u0027m not sure how much of a blocker this is since clients can re-authenticate on 401...","commit_id":"72daa5ed764bf290ee3ed752330bf3b008ede0ce"}]}