)]}'
{"keystone/conf/__init__.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f2ecdf8c0e0de071dd4b0723c977e2348309d2a7","unresolved":false,"context_lines":[{"line_number":35,"context_line":"from keystone.conf import fernet_tokens"},{"line_number":36,"context_line":"from keystone.conf import identity"},{"line_number":37,"context_line":"from keystone.conf import identity_mapping"},{"line_number":38,"context_line":"from keystone.conf import jws_tokens"},{"line_number":39,"context_line":"from keystone.conf import ldap"},{"line_number":40,"context_line":"from keystone.conf import memcache"},{"line_number":41,"context_line":"from keystone.conf import oauth1"}],"source_content_type":"text/x-python","patch_set":4,"id":"9fdfeff1_3054f820","line":38,"range":{"start_line":38,"start_character":26,"end_line":38,"end_character":36},"updated":"2019-01-30 00:38:05.000000000","message":"WIP - I should make this jwt_tokens instead and have a mutually exclusive group for jws_key_repositories and jwe_key_repositories in the future.","commit_id":"47d940ff6af71bb3ceb785e20c93d9bdc3ed8a64"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4e3cbc3c171ffcb01fbcdaf9c082eae8549dea69","unresolved":false,"context_lines":[{"line_number":35,"context_line":"from keystone.conf import fernet_tokens"},{"line_number":36,"context_line":"from keystone.conf import identity"},{"line_number":37,"context_line":"from keystone.conf import identity_mapping"},{"line_number":38,"context_line":"from keystone.conf import jws_tokens"},{"line_number":39,"context_line":"from keystone.conf import ldap"},{"line_number":40,"context_line":"from keystone.conf import memcache"},{"line_number":41,"context_line":"from keystone.conf import oauth1"}],"source_content_type":"text/x-python","patch_set":4,"id":"9fdfeff1_a585ff5b","line":38,"range":{"start_line":38,"start_character":26,"end_line":38,"end_character":36},"in_reply_to":"9fdfeff1_3054f820","updated":"2019-01-30 15:17:50.000000000","message":"Done","commit_id":"47d940ff6af71bb3ceb785e20c93d9bdc3ed8a64"},{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"c2394f4e7c4a7ebe126e6d1459f279444cec85ed","unresolved":false,"context_lines":[{"line_number":35,"context_line":"from keystone.conf import fernet_tokens"},{"line_number":36,"context_line":"from keystone.conf import identity"},{"line_number":37,"context_line":"from keystone.conf import identity_mapping"},{"line_number":38,"context_line":"from keystone.conf import jws_tokens"},{"line_number":39,"context_line":"from keystone.conf import ldap"},{"line_number":40,"context_line":"from keystone.conf import memcache"},{"line_number":41,"context_line":"from keystone.conf import oauth1"}],"source_content_type":"text/x-python","patch_set":4,"id":"9fdfeff1_207fbd15","line":38,"range":{"start_line":38,"start_character":26,"end_line":38,"end_character":36},"in_reply_to":"9fdfeff1_a585ff5b","updated":"2019-01-30 15:57:16.000000000","message":"I think something went missing here, can see the comment \u0027done\u0027 but not the new patch set.","commit_id":"47d940ff6af71bb3ceb785e20c93d9bdc3ed8a64"},{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"c2394f4e7c4a7ebe126e6d1459f279444cec85ed","unresolved":false,"context_lines":[{"line_number":73,"context_line":"    fernet_tokens,"},{"line_number":74,"context_line":"    identity,"},{"line_number":75,"context_line":"    identity_mapping,"},{"line_number":76,"context_line":"    jws_tokens,"},{"line_number":77,"context_line":"    ldap,"},{"line_number":78,"context_line":"    memcache,"},{"line_number":79,"context_line":"    oauth1,"}],"source_content_type":"text/x-python","patch_set":4,"id":"9fdfeff1_e0745538","line":76,"updated":"2019-01-30 15:57:16.000000000","message":"Here too, \u0027jwt_tokens\u0027","commit_id":"47d940ff6af71bb3ceb785e20c93d9bdc3ed8a64"}],"keystone/conf/jws_tokens.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53c8031a58082cce636fe51424b131766afb61da","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    \u0027key_repository\u0027,"},{"line_number":20,"context_line":"    default\u003d\u0027/etc/keystone/jws-keys/\u0027,"},{"line_number":21,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":22,"context_line":"Directory containing JWS keys. This directory must exist before using"},{"line_number":23,"context_line":"`keystone-manage jwt_setup` for the first time, must be writable by the user"},{"line_number":24,"context_line":"running `keystone-manage jwt_setup`, and of course must be readable by"},{"line_number":25,"context_line":"keystone\u0027s server process. It must contain at least one asymmetric key pair. It"}],"source_content_type":"text/x-python","patch_set":2,"id":"9fdfeff1_4312af5a","line":22,"range":{"start_line":22,"start_character":21,"end_line":22,"end_character":25},"updated":"2019-01-21 15:49:47.000000000","message":"JWS keys for JSON Web Tokens.","commit_id":"3676b4a40f42f65afd1991ff6430998537a3a199"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"eb2a1b59a97682f53d0aaa0294304b9f50565a61","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    \u0027key_repository\u0027,"},{"line_number":20,"context_line":"    default\u003d\u0027/etc/keystone/jws-keys/\u0027,"},{"line_number":21,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":22,"context_line":"Directory containing JWS keys. This directory must exist before using"},{"line_number":23,"context_line":"`keystone-manage jwt_setup` for the first time, must be writable by the user"},{"line_number":24,"context_line":"running `keystone-manage jwt_setup`, and of course must be readable by"},{"line_number":25,"context_line":"keystone\u0027s server process. It must contain at least one asymmetric key pair. It"}],"source_content_type":"text/x-python","patch_set":2,"id":"9fdfeff1_e39f23b2","line":22,"range":{"start_line":22,"start_character":21,"end_line":22,"end_character":25},"in_reply_to":"9fdfeff1_4312af5a","updated":"2019-01-21 16:12:59.000000000","message":"Done","commit_id":"3676b4a40f42f65afd1991ff6430998537a3a199"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53c8031a58082cce636fe51424b131766afb61da","unresolved":false,"context_lines":[{"line_number":35,"context_line":"usable with an Elliptic Curve Digital Signature Algorithm using SHA-256."},{"line_number":36,"context_line":"The key can be created out-of-band, or it can be generated using"},{"line_number":37,"context_line":"`keystone-manage jwt_setup`. Note that `keystone-manage` will create ECDSA key"},{"line_number":38,"context_line":"pairs using P-256, or SECP256R1, curves. Note that the keys used in this"},{"line_number":39,"context_line":"repository should only be used for signing and verification. Their usage should"},{"line_number":40,"context_line":"not be mixed with asymmetric encryption, even though the keys themselves may"},{"line_number":41,"context_line":"support that use case."}],"source_content_type":"text/x-python","patch_set":2,"id":"9fdfeff1_e3516310","line":38,"range":{"start_line":38,"start_character":41,"end_line":38,"end_character":55},"updated":"2019-01-21 15:49:47.000000000","message":"Remove this wording since it reads odd with the previous sentence.","commit_id":"3676b4a40f42f65afd1991ff6430998537a3a199"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"eb2a1b59a97682f53d0aaa0294304b9f50565a61","unresolved":false,"context_lines":[{"line_number":35,"context_line":"usable with an Elliptic Curve Digital Signature Algorithm using SHA-256."},{"line_number":36,"context_line":"The key can be created out-of-band, or it can be generated using"},{"line_number":37,"context_line":"`keystone-manage jwt_setup`. Note that `keystone-manage` will create ECDSA key"},{"line_number":38,"context_line":"pairs using P-256, or SECP256R1, curves. Note that the keys used in this"},{"line_number":39,"context_line":"repository should only be used for signing and verification. Their usage should"},{"line_number":40,"context_line":"not be mixed with asymmetric encryption, even though the keys themselves may"},{"line_number":41,"context_line":"support that use case."}],"source_content_type":"text/x-python","patch_set":2,"id":"9fdfeff1_8334174c","line":38,"range":{"start_line":38,"start_character":41,"end_line":38,"end_character":55},"in_reply_to":"9fdfeff1_e3516310","updated":"2019-01-21 16:12:59.000000000","message":"Done","commit_id":"3676b4a40f42f65afd1991ff6430998537a3a199"}],"keystone/conf/jwt_tokens.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53e98453a8fde9b1364db144ac47a2072047cfd2","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"key_repository \u003d cfg.StrOpt("},{"line_number":19,"context_line":"    \u0027key_repository\u0027,"},{"line_number":20,"context_line":"    default\u003d\u0027/etc/keystone/jwt-keys/\u0027,"},{"line_number":21,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":22,"context_line":"Directory containing JWT signing keys. This directory must exist before using"}],"source_content_type":"text/x-python","patch_set":1,"id":"ffd0ebdf_4bf876c3","line":19,"range":{"start_line":19,"start_character":5,"end_line":19,"end_character":19},"updated":"2019-01-04 20:52:48.000000000","message":"I think this implementation is going to need a couple of options. I don\u0027t think we\u0027re going to be able to get away with a single configuration option without making some assumptions like we do with Fernet.\n\nWe can do a couple of things.\n\n1.) We have a single directory which contains only keys for validating tokens. We also have a signing key in a known, hardcoded, location. For example, the directory could be /etc/keystone/jwt-keys/validation-keys/ and the signing key could be /etc/keystone/jwt-keys/private.pem.\n\n2.) We have a single directory for validation keys and a configuration option pointing keystone to the signing key.\n\nThe first option isn\u0027t as complicated and doesn\u0027t require deployers to understand more options than required. Certificate rotation requires a renaming strategy that goes hand-in-hand with distribution across nodes.\n\nThoughts?","commit_id":"6ca7db694ca0a3458c071407b2da1c6f9ffbffd0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"52abe99f459c428428b5464d4ed5640249d86a06","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    \u0027key_repository\u0027,"},{"line_number":20,"context_line":"    default\u003d\u0027/etc/keystone/jwt-keys/\u0027,"},{"line_number":21,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":22,"context_line":"Directory containing JWT signing keys. This directory must exist before using"},{"line_number":23,"context_line":"`keystone-manage jwt_setup` for the first time, must be writable by the user"},{"line_number":24,"context_line":"running `keystone-manage jwt_setup`, and of course must be readable by"},{"line_number":25,"context_line":"keystone\u0027s server process."}],"source_content_type":"text/x-python","patch_set":1,"id":"9fdfeff1_9291daf4","line":22,"range":{"start_line":22,"start_character":21,"end_line":22,"end_character":24},"updated":"2019-01-18 19:02:48.000000000","message":"I think this is going to be too general for this implementation. JWT doesn\u0027t necessarily prescribe encryption or signing in the name and it can be used to represent either.\n\nThe initial implementation of \"JWT\" in keystone is only going to support signing, so we should consider changing this to JWS, instead.\n\nAnother reason to change this to JWS is if we add encryption support for JWTs in the future. Asymmetric signing is done with private keys and validation is done with public keys. Providing encryption with asymmetric key pairs would require the encryption to be done with the public key and validation to be done with the private keys. This might make a difference in how keystone realizes the keys in a repository denoted \"JWT\".\n\nWe might be safer starting with a JWS section where we know the private key is used for signing and the public keys are used for validation. If/when we implement JWE support, we can consider consolidating if there is an opportunity to do so.","commit_id":"6ca7db694ca0a3458c071407b2da1c6f9ffbffd0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"49bae5cf8e93147e02ee81e5da2273468ceb9312","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    \u0027key_repository\u0027,"},{"line_number":20,"context_line":"    default\u003d\u0027/etc/keystone/jwt-keys/\u0027,"},{"line_number":21,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":22,"context_line":"Directory containing JWT signing keys. This directory must exist before using"},{"line_number":23,"context_line":"`keystone-manage jwt_setup` for the first time, must be writable by the user"},{"line_number":24,"context_line":"running `keystone-manage jwt_setup`, and of course must be readable by"},{"line_number":25,"context_line":"keystone\u0027s server process."}],"source_content_type":"text/x-python","patch_set":1,"id":"9fdfeff1_f5513064","line":22,"range":{"start_line":22,"start_character":21,"end_line":22,"end_character":24},"in_reply_to":"9fdfeff1_9291daf4","updated":"2019-01-18 19:43:48.000000000","message":"Related - https://security.stackexchange.com/questions/1806/why-should-one-not-use-the-same-asymmetric-key-for-encryption-as-they-do-for-sig","commit_id":"6ca7db694ca0a3458c071407b2da1c6f9ffbffd0"}]}