)]}'
{"doc/source/configuration.rst":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"200edfa15a9504d3a663d30ec3d88bd375e0e5a5","unresolved":false,"context_lines":[{"line_number":208,"context_line":"PKI-based tokens are Cryptographic Message Syntax (CMS) strings that can be"},{"line_number":209,"context_line":"verified offline using keystone\u0027s public signing key. The only reason for them"},{"line_number":210,"context_line":"to be persisted by the identity service is to later build token revocation"},{"line_number":211,"context_line":"lists (explicit lists of tokens that have been revoked), otherwise they are"},{"line_number":212,"context_line":"theoretically ephemeral. PKI tokens should therefore have much better scaling"},{"line_number":213,"context_line":"characteristics (decentralized validation). They are base-64 encoded (and are"},{"line_number":214,"context_line":"therefore not URL-friendly without encoding) and may be too long to fit in"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F%2BiQs%3D","line":211,"updated":"2013-11-25 00:18:22.000000000","message":"suggest remove \"explicit\" ... not sure what it means here.","commit_id":"5b04a7954cfd718c05dd11fdfc392c27c6c4a608"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"200edfa15a9504d3a663d30ec3d88bd375e0e5a5","unresolved":false,"context_lines":[{"line_number":210,"context_line":"to be persisted by the identity service is to later build token revocation"},{"line_number":211,"context_line":"lists (explicit lists of tokens that have been revoked), otherwise they are"},{"line_number":212,"context_line":"theoretically ephemeral. PKI tokens should therefore have much better scaling"},{"line_number":213,"context_line":"characteristics (decentralized validation). They are base-64 encoded (and are"},{"line_number":214,"context_line":"therefore not URL-friendly without encoding) and may be too long to fit in"},{"line_number":215,"context_line":"either headers or URLs if they contain extensive service catalogs or other"},{"line_number":216,"context_line":"additional attributes."}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F%2BiQo%3D","line":213,"updated":"2013-11-25 00:18:22.000000000","message":"... but they don\u0027t (always) because the servers requesting the revocation list can overwhelm the Keystone server.","commit_id":"5b04a7954cfd718c05dd11fdfc392c27c6c4a608"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b16bbf6fe0065fb5ad1f3745d981e41042351256","unresolved":false,"context_lines":[{"line_number":210,"context_line":"to be persisted by the identity service is to later build token revocation"},{"line_number":211,"context_line":"lists (explicit lists of tokens that have been revoked), otherwise they are"},{"line_number":212,"context_line":"theoretically ephemeral. PKI tokens should therefore have much better scaling"},{"line_number":213,"context_line":"characteristics (decentralized validation). They are base-64 encoded (and are"},{"line_number":214,"context_line":"therefore not URL-friendly without encoding) and may be too long to fit in"},{"line_number":215,"context_line":"either headers or URLs if they contain extensive service catalogs or other"},{"line_number":216,"context_line":"additional attributes."}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F99Og%3D","line":213,"in_reply_to":"AAAATn%2F%2BiQo%3D","updated":"2013-12-04 01:31:19.000000000","message":"though one could also call back to Keystone to validate PKI tokens by hashing it as the token ID","commit_id":"5b04a7954cfd718c05dd11fdfc392c27c6c4a608"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"41730750d2922976a79a874805a457f20268512c","unresolved":false,"context_lines":[{"line_number":217,"context_line":""},{"line_number":218,"context_line":".. WARNING::"},{"line_number":219,"context_line":"    Both UUID- and PKI-based tokens are bearer tokens, meaning that they must"},{"line_number":220,"context_line":"    be protected from unnecessary disclosure to prevent unauthorized access."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"The current architectural approaches for both UUID- and PKI-based tokens have"},{"line_number":223,"context_line":"pain points exposed by environments under heavy load (search bugs and"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F%2Bzpk%3D","line":220,"updated":"2013-11-19 22:00:36.000000000","message":"Any docs on the protection part besides the basics? Or are we just assuming common sense?","commit_id":"5b04a7954cfd718c05dd11fdfc392c27c6c4a608"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b16bbf6fe0065fb5ad1f3745d981e41042351256","unresolved":false,"context_lines":[{"line_number":217,"context_line":""},{"line_number":218,"context_line":".. WARNING::"},{"line_number":219,"context_line":"    Both UUID- and PKI-based tokens are bearer tokens, meaning that they must"},{"line_number":220,"context_line":"    be protected from unnecessary disclosure to prevent unauthorized access."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"The current architectural approaches for both UUID- and PKI-based tokens have"},{"line_number":223,"context_line":"pain points exposed by environments under heavy load (search bugs and"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F99r4%3D","line":220,"in_reply_to":"AAAATn%2F%2Bzpk%3D","updated":"2013-12-04 01:31:19.000000000","message":"Yeah seem like this warning message is about making a general statement then offer anything useful to the target audience.","commit_id":"5b04a7954cfd718c05dd11fdfc392c27c6c4a608"}]}