)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Steve Martinelli \u003cstevemar@ca.ibm.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-04-08 15:17:06 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add security details to keysone docs"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"First draft of adding keystone security docs produced"},{"line_number":10,"context_line":"by nkinder."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"AAAAWn%2F%2F3vw%3D","line":7,"updated":"2014-04-08 20:23:49.000000000","message":"keystone is misspelled.\n\nAlso, the project is already known so could just remove it.","commit_id":"3ae408b760f42809090c1a584deb283dbe763b01"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd2a9c19a5edf8cf435b1ba755b0435bd8cf379e","unresolved":false,"context_lines":[{"line_number":10,"context_line":"by nkinder."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I6f527daa222b6f54a7bf1f5cdb372909b68bff44"},{"line_number":13,"context_line":"Co-Authored-By: Steve Martinelli \u003cstevemar@ca.ibm.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"AAAAWn%2F%2F3qY%3D","line":13,"updated":"2014-04-08 20:45:19.000000000","message":"Co-Authored by Nathan Kinder?","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"91e928c65c950335cac749aed3294a7fc2a01367","unresolved":false,"context_lines":[{"line_number":10,"context_line":"by nkinder."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I6f527daa222b6f54a7bf1f5cdb372909b68bff44"},{"line_number":13,"context_line":"Co-Authored-By: Steve Martinelli \u003cstevemar@ca.ibm.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"AAAAWn%2F%2F3Ws%3D","line":13,"in_reply_to":"AAAAWn%2F%2F3qY%3D","updated":"2014-04-08 21:21:33.000000000","message":"I set the author to Nathan in line 2.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"}],"doc/source/security_details.rst":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"unresolved":false,"context_lines":[{"line_number":197,"context_line":"Passwords"},{"line_number":198,"context_line":"~~~~~~~~~"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"* SSL/TLS must be enabled in Keystone to prevent clients from sending "},{"line_number":201,"context_line":"  passwords over the network in clear-text."},{"line_number":202,"context_line":"* Passwords are truncated to a maximum length prior to hashing"},{"line_number":203,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAWn%2F%2F3vU%3D","line":200,"updated":"2014-04-08 20:23:49.000000000","message":"remove whitespace at end of line.","commit_id":"3ae408b760f42809090c1a584deb283dbe763b01"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"unresolved":false,"context_lines":[{"line_number":229,"context_line":"  * Persistent storage."},{"line_number":230,"context_line":"  * SSL/TLS can be used to protect the connection to the database."},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"* Expired tokens are not automatically removed from the backend. The "},{"line_number":233,"context_line":"  `keystone-manage token_flush` command should be used to periodically"},{"line_number":234,"context_line":"  remove expired tokens (via cron)."},{"line_number":235,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAWn%2F%2F3vI%3D","line":232,"updated":"2014-04-08 20:23:49.000000000","message":"remove whitespace","commit_id":"3ae408b760f42809090c1a584deb283dbe763b01"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"unresolved":false,"context_lines":[{"line_number":247,"context_line":"* Allow support for LDAP SASL bind methods(such as DIGEST-MD5 and GSSAPI)."},{"line_number":248,"context_line":"* Allow other forms of external authentication to avoid using passwords"},{"line_number":249,"context_line":"  (Kerberos, SAML)."},{"line_number":250,"context_line":"  "}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAWn%2F%2F3uw%3D","line":250,"updated":"2014-04-08 20:23:49.000000000","message":"remove whitespace.","commit_id":"3ae408b760f42809090c1a584deb283dbe763b01"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd2a9c19a5edf8cf435b1ba755b0435bd8cf379e","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Implemented Crypto"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"None."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Used Crypto"},{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3ps%3D","line":26,"updated":"2014-04-08 20:45:19.000000000","message":"Should clarify here just saying something like \"Keystone doesn\u0027t have an home-brewed encryption implementations, everything is used from Python Standard libraries or third party libraries\" (if that\u0027s accurate)","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"ad71f4e4d2e65b7da21d73225fd3a80272f9643a","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Implemented Crypto"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"None."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Used Crypto"},{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2F%2FdA%3D","line":26,"in_reply_to":"AAAAWn%2F%2F3WE%3D","updated":"2014-04-09 01:26:41.000000000","message":"As far as I could see, that is indeed accurate.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"91e928c65c950335cac749aed3294a7fc2a01367","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Implemented Crypto"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"None."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Used Crypto"},{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3WE%3D","line":26,"in_reply_to":"AAAAWn%2F%2F3ps%3D","updated":"2014-04-08 21:21:33.000000000","message":"agree, if that\u0027s accurate.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"4275630bf850d89c90f715fe24f7c24bfeb8cfbe","unresolved":false,"context_lines":[{"line_number":37,"context_line":"* PyCrypto"},{"line_number":38,"context_line":"* hashlib"},{"line_number":39,"context_line":"* python-ldap (ultimately uses GnuTLS, NSS, or OpenSSL depends on platform)"},{"line_number":40,"context_line":"* requests (for keystoneclient HTTPS usage - need to investigate underlying"},{"line_number":41,"context_line":"  crypto usage)"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Encryption Algorithms"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2FQo8%3D","line":40,"updated":"2014-04-15 19:27:54.000000000","message":"Requests uses stdlib - https://github.com/kennethreitz/requests/blob/master/requests/packages/urllib3/connection.py","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd2a9c19a5edf8cf435b1ba755b0435bd8cf379e","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Encryption Algorithms"},{"line_number":44,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* Memcache backend encryption"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":" * Algorithm: AES"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3pQ%3D","line":45,"updated":"2014-04-08 20:45:19.000000000","message":"We use base64 encoding, wondering where that fits in here? \n\nhttps://github.com/openstack/keystone/blob/master/keystone/common/pemutils.py#L508","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"ad71f4e4d2e65b7da21d73225fd3a80272f9643a","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Encryption Algorithms"},{"line_number":44,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* Memcache backend encryption"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":" * Algorithm: AES"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2F%2FZY%3D","line":45,"in_reply_to":"AAAAWn%2F%2F3pQ%3D","updated":"2014-04-09 01:26:41.000000000","message":"Base64 encoding does not count as encryption.  It really should be thought of as plain text, as it provides zero security.  Think of it the same as representing characters as Unicode escape sequences instead of ASCII to represent strings (\"ABC\" \u003d \"\\u0041\\u0042\\u0043\").\n\nThere is no purpose in calling out base64 in this document.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd2a9c19a5edf8cf435b1ba755b0435bd8cf379e","unresolved":false,"context_lines":[{"line_number":63,"context_line":" * Implementation: OpenSSL"},{"line_number":64,"context_line":" * Source:"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  * keystone/common/openssl.py"},{"line_number":67,"context_line":"  * keystoneclient/common/cms.py"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":" * Details:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3nE%3D","line":66,"updated":"2014-04-08 20:45:19.000000000","message":"Should we add class notation to this? \n\nkeystone.common.openssl.BaseCertificateConfigure\n\nMight make things a little easier to find if we document some of the bigger modules.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"ad71f4e4d2e65b7da21d73225fd3a80272f9643a","unresolved":false,"context_lines":[{"line_number":63,"context_line":" * Implementation: OpenSSL"},{"line_number":64,"context_line":" * Source:"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  * keystone/common/openssl.py"},{"line_number":67,"context_line":"  * keystoneclient/common/cms.py"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":" * Details:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2F%2FZI%3D","line":66,"in_reply_to":"AAAAWn%2F%2F3VE%3D","updated":"2014-04-09 01:26:41.000000000","message":"Yeah, class notation would be much better than source file names IMHO.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"91e928c65c950335cac749aed3294a7fc2a01367","unresolved":false,"context_lines":[{"line_number":63,"context_line":" * Implementation: OpenSSL"},{"line_number":64,"context_line":" * Source:"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"  * keystone/common/openssl.py"},{"line_number":67,"context_line":"  * keystoneclient/common/cms.py"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":" * Details:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3VE%3D","line":66,"in_reply_to":"AAAAWn%2F%2F3nE%3D","updated":"2014-04-08 21:21:33.000000000","message":"I\u0027m okay with that notation, if others want it that way, i\u0027ll change it up.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd2a9c19a5edf8cf435b1ba755b0435bd8cf379e","unresolved":false,"context_lines":[{"line_number":69,"context_line":" * Details:"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  * 2048, sha1 defaults"},{"line_number":72,"context_line":"  * Configurable via openssl.conf."},{"line_number":73,"context_line":"  * Keys/Certs can be created outside of Keystone and dropped in."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Hashing Algorithms"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3mc%3D","line":72,"updated":"2014-04-08 20:45:19.000000000","message":"and configurable through the keystone.conf: \n\nhttps://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L1209","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd2a9c19a5edf8cf435b1ba755b0435bd8cf379e","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  * 2048, sha1 defaults"},{"line_number":72,"context_line":"  * Configurable via openssl.conf."},{"line_number":73,"context_line":"  * Keys/Certs can be created outside of Keystone and dropped in."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Hashing Algorithms"},{"line_number":76,"context_line":"~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3mQ%3D","line":73,"updated":"2014-04-08 20:45:19.000000000","message":"Should we list the configuration options this can be done with? \n\nhttps://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L1196-L1205","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"ad71f4e4d2e65b7da21d73225fd3a80272f9643a","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  * 2048, sha1 defaults"},{"line_number":72,"context_line":"  * Configurable via openssl.conf."},{"line_number":73,"context_line":"  * Keys/Certs can be created outside of Keystone and dropped in."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Hashing Algorithms"},{"line_number":76,"context_line":"~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2F%2FY0%3D","line":73,"in_reply_to":"AAAAWn%2F%2F3SQ%3D","updated":"2014-04-09 01:26:41.000000000","message":"Agreed.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"91e928c65c950335cac749aed3294a7fc2a01367","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  * 2048, sha1 defaults"},{"line_number":72,"context_line":"  * Configurable via openssl.conf."},{"line_number":73,"context_line":"  * Keys/Certs can be created outside of Keystone and dropped in."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Hashing Algorithms"},{"line_number":76,"context_line":"~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3SQ%3D","line":73,"in_reply_to":"AAAAWn%2F%2F3mQ%3D","updated":"2014-04-08 21:21:33.000000000","message":"we should reference the config options like CONF.config_option, it\u0027s already done one below.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd2a9c19a5edf8cf435b1ba755b0435bd8cf379e","unresolved":false,"context_lines":[{"line_number":109,"context_line":""},{"line_number":110,"context_line":"* LDAP password hashing"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":" * Algorithm: md5"},{"line_number":113,"context_line":" * Configurable: No"},{"line_number":114,"context_line":" * Implementation: PassLib"},{"line_number":115,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3j8%3D","line":112,"updated":"2014-04-08 20:45:19.000000000","message":"doesn\u0027t this use sha1 salted? \nhttps://github.com/openstack/keystone/blob/master/keystone/common/utils.py#L117","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"91e928c65c950335cac749aed3294a7fc2a01367","unresolved":false,"context_lines":[{"line_number":109,"context_line":""},{"line_number":110,"context_line":"* LDAP password hashing"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":" * Algorithm: md5"},{"line_number":113,"context_line":" * Configurable: No"},{"line_number":114,"context_line":" * Implementation: PassLib"},{"line_number":115,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3T0%3D","line":112,"in_reply_to":"AAAAWn%2F%2F3j8%3D","updated":"2014-04-08 21:21:33.000000000","message":"i\u0027ll change md5 to sha1","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"4275630bf850d89c90f715fe24f7c24bfeb8cfbe","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":" * Algorithm: md5"},{"line_number":113,"context_line":" * Configurable: No"},{"line_number":114,"context_line":" * Implementation: PassLib"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":" * Source:"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2FQBE%3D","line":114,"updated":"2014-04-15 19:27:54.000000000","message":"Maybe callout the implementation like:\n\n  PassLib (sha1 from hashlib; salting from PassLib)","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"4275630bf850d89c90f715fe24f7c24bfeb8cfbe","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":" * Algorithm: sha1"},{"line_number":127,"context_line":" * Configurable: No"},{"line_number":128,"context_line":" * Implementation: oauthlib"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":" * Source:"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2FQAk%3D","line":128,"updated":"2014-04-15 19:27:54.000000000","message":"I think this also uses hashlib for the actual algorithm.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9da25072ea091ca143c59ca61e5d17f9d7dc4196","unresolved":false,"context_lines":[{"line_number":154,"context_line":" * Details:"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"  * Required for EC2 compatibility, so it cannot be configurable."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"* Memcache signing"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":" * Algorithm: sha384"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3f0%3D","line":157,"updated":"2014-04-08 20:50:01.000000000","message":"I wonder if it would be useful to add a field for every section that clarifies if the encryption can be leveraged from the CLI, or if it pretty much stays internal to Keystone. \n\nLike here we could document that a user can grab EC2 generated certificates from the CLI, but they can\u0027t increase their strength. \n\nOr maybe that would be best in another section, specifically for what an end user can get at?","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"ad71f4e4d2e65b7da21d73225fd3a80272f9643a","unresolved":false,"context_lines":[{"line_number":154,"context_line":" * Details:"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"  * Required for EC2 compatibility, so it cannot be configurable."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"* Memcache signing"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":" * Algorithm: sha384"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2F%2FVQ%3D","line":157,"in_reply_to":"AAAAWn%2F%2F3TM%3D","updated":"2014-04-09 01:26:41.000000000","message":"My intention of \"configurable\" was so a deployer would be able to know if they can control the algorithm used for a particular purpose.  For example, someone may have a requirement that says md5 can\u0027t be used at all in their environment.  The \"configurable\" section is to let them know if they can do anything about it.  If there is a strong reason why it can\u0027t be configurable (like EC2 and S3 compatibility), it\u0027s important for us to call out so deployers understand why.\n\nIf we want to describe end-user facing vs. server side only, we should probably list that separately somehow.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"91e928c65c950335cac749aed3294a7fc2a01367","unresolved":false,"context_lines":[{"line_number":154,"context_line":" * Details:"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"  * Required for EC2 compatibility, so it cannot be configurable."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"* Memcache signing"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":" * Algorithm: sha384"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3TM%3D","line":157,"in_reply_to":"AAAAWn%2F%2F3f0%3D","updated":"2014-04-08 21:21:33.000000000","message":"I think that is the intention of the \"Configurable: Yes/No\" section.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd2a9c19a5edf8cf435b1ba755b0435bd8cf379e","unresolved":false,"context_lines":[{"line_number":183,"context_line":" * Details:"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"  * The algorithm is non-configurable, but the number of rounds is"},{"line_number":186,"context_line":"    configurable via CONF.crypt_strength (default\u003d40000)."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Sensitive Data"},{"line_number":189,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3i0%3D","line":186,"updated":"2014-04-08 20:45:19.000000000","message":"I like having the configuration option here, makes it easier if you need to reference something in your deployment.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"ad71f4e4d2e65b7da21d73225fd3a80272f9643a","unresolved":false,"context_lines":[{"line_number":183,"context_line":" * Details:"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"  * The algorithm is non-configurable, but the number of rounds is"},{"line_number":186,"context_line":"    configurable via CONF.crypt_strength (default\u003d40000)."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Sensitive Data"},{"line_number":189,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2F%2FVA%3D","line":186,"in_reply_to":"AAAAWn%2F%2F3i0%3D","updated":"2014-04-09 01:26:41.000000000","message":"+1.  It avoids sending people off to dig for how they can change things.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd2a9c19a5edf8cf435b1ba755b0435bd8cf379e","unresolved":false,"context_lines":[{"line_number":232,"context_line":"* Expired tokens are not automatically removed from the backend. The"},{"line_number":233,"context_line":"  `keystone-manage token_flush` command should be used to periodically"},{"line_number":234,"context_line":"  remove expired tokens (via cron)."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Potential Improvements"},{"line_number":237,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3ic%3D","line":235,"updated":"2014-04-08 20:45:19.000000000","message":"(NIT): maybe it would be worth noting if some backends are more \u0027secure\u0027 than others.. from an end user perspective.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"ad71f4e4d2e65b7da21d73225fd3a80272f9643a","unresolved":false,"context_lines":[{"line_number":232,"context_line":"* Expired tokens are not automatically removed from the backend. The"},{"line_number":233,"context_line":"  `keystone-manage token_flush` command should be used to periodically"},{"line_number":234,"context_line":"  remove expired tokens (via cron)."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Potential Improvements"},{"line_number":237,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAW3%2F%2F%2FTs%3D","line":235,"in_reply_to":"AAAAWn%2F%2F3ic%3D","updated":"2014-04-09 01:26:41.000000000","message":"If we know that a particular backend is more secure, we should call that out.  It would hopefully be clear from the security options listed under each backend.\n\nFor each backend, it would be nice to explain how access to the backend is controlled (authentication and authorization) and how the data is protected (encryption and signing).  I was able to determine some of this above, but not all of it. Any help filling those details in would be great.  For example:\n\n- How is access to memcached controlled?  Is there any authentication, or do we just rely on local (or network) access?\n\n- Where are encryption/signing keys set for memcached?  How are they protected?\n\n- SQL details on authentication needs to be added (the \"connection\" setting in the \"[sql]\" section of keystone.conf).  Are there more secure authentication options that we can use other than putting a clear-text password in keystone.conf?\n\n- KVS has no details, as I wasn\u0027t sure of how to protect it.","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"91e928c65c950335cac749aed3294a7fc2a01367","unresolved":false,"context_lines":[{"line_number":232,"context_line":"* Expired tokens are not automatically removed from the backend. The"},{"line_number":233,"context_line":"  `keystone-manage token_flush` command should be used to periodically"},{"line_number":234,"context_line":"  remove expired tokens (via cron)."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Potential Improvements"},{"line_number":237,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAWn%2F%2F3R4%3D","line":235,"in_reply_to":"AAAAWn%2F%2F3ic%3D","updated":"2014-04-08 21:21:33.000000000","message":"elaborate?","commit_id":"b4accb6b9ff4fe6084d2d79016a22249ccc52862"}]}