)]}'
{"doc/source/developer/specs/tenant-scoped-admin-web-API.rst":[{"author":{"_account_id":16068,"name":"Tobias Henkel","email":"tobias.henkel@bmw.de","username":"tobias.henkel"},"change_message_id":"3c05ab1f66cb55751a0412c94fcb03e89013a83a","unresolved":false,"context_lines":[{"line_number":502,"context_line":"    # (optional) Ensure a Token cannot be valid for longer than this amount of time, in seconds"},{"line_number":503,"context_line":"    max_token_age \u003d 1800000"},{"line_number":504,"context_line":"    # (optional) Account for skew between clocks, in seconds"},{"line_number":505,"context_line":"    skew \u003d 3"},{"line_number":506,"context_line":""},{"line_number":507,"context_line":"    # asymmetrical encryption"},{"line_number":508,"context_line":"    [auth \"my_oidc_idp\"]"}],"source_content_type":"text/x-rst","patch_set":35,"id":"3fa7e38b_1c2ef741","line":505,"updated":"2019-12-04 18:22:22.000000000","message":"I wonder if we should support skew at all. What is the intended use of this? If clocks are out of sync because of broken clock sync the skew won\u0027t be constant.","commit_id":"c4a20d5be0df247d0b255583229ccb802444a639"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"2f0a2abaa4372bf51283680f5b103e7f40554320","unresolved":false,"context_lines":[{"line_number":502,"context_line":"    # (optional) Ensure a Token cannot be valid for longer than this amount of time, in seconds"},{"line_number":503,"context_line":"    max_token_age \u003d 1800000"},{"line_number":504,"context_line":"    # (optional) Account for skew between clocks, in seconds"},{"line_number":505,"context_line":"    skew \u003d 3"},{"line_number":506,"context_line":""},{"line_number":507,"context_line":"    # asymmetrical encryption"},{"line_number":508,"context_line":"    [auth \"my_oidc_idp\"]"}],"source_content_type":"text/x-rst","patch_set":35,"id":"3fa7e38b_ae83e202","line":505,"in_reply_to":"3fa7e38b_1c2ef741","updated":"2019-12-05 09:20:04.000000000","message":"The JWT RFC says implementations *may* account for clock skew: https://tools.ietf.org/html/rfc7519#section-4.1.4\n\nMy personal opinion is that it\u0027s better to fix clock sync rather than set the leeway here, but we should allow people to do it if they have no other way to account for time discrepancies.","commit_id":"c4a20d5be0df247d0b255583229ccb802444a639"}],"zuul/driver/auth/jwt.py":[{"author":{"_account_id":30637,"name":"Jan Kubovy","email":"jan.kubovy@bmw.de","username":"kubovy"},"change_message_id":"fde28312e3de018795f0af11d887b35ef7522c7f","unresolved":false,"context_lines":[{"line_number":45,"context_line":"        try:"},{"line_number":46,"context_line":"            self.token_expiry \u003d float(conf.get(\u0027token_expiry\u0027, math.inf))"},{"line_number":47,"context_line":"        except ValueError:"},{"line_number":48,"context_line":"            raise Exception(\u0027token_expiry must be an integer\u0027)"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    def _decode(self, rawToken):"},{"line_number":51,"context_line":"        raise NotImplementedError"}],"source_content_type":"text/x-python","patch_set":29,"id":"3fa7e38b_ad2f1a86","line":48,"range":{"start_line":48,"start_character":18,"end_line":48,"end_character":27},"updated":"2019-09-27 05:51:01.000000000","message":"why not to raise a ValueError with a more precise message instead of the more generic Exception?","commit_id":"a9e6aca590cd2d6171991efabc9e6bff62e23f2e"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"75c10f61c0f8a69df6121923d2362065842ed90e","unresolved":false,"context_lines":[{"line_number":43,"context_line":"            else:"},{"line_number":44,"context_line":"                self.allow_authz_override \u003d False"},{"line_number":45,"context_line":"        try:"},{"line_number":46,"context_line":"            self.token_expiry \u003d float(conf.get(\u0027token_expiry\u0027, math.inf))"},{"line_number":47,"context_line":"        except ValueError:"},{"line_number":48,"context_line":"            raise ValueError(\u0027token_expiry must be a numerical value\u0027)"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"3fa7e38b_8ff2286e","line":46,"updated":"2019-11-25 21:41:25.000000000","message":"Nit you may want to call this self.max_token_age or similar to distinguish it from the per token expiry.","commit_id":"94b2e0cdd4c946d56cda0f3f41b3518d5968cc90"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"315299867630588886c28b7532721b4c490228ce","unresolved":false,"context_lines":[{"line_number":43,"context_line":"            else:"},{"line_number":44,"context_line":"                self.allow_authz_override \u003d False"},{"line_number":45,"context_line":"        try:"},{"line_number":46,"context_line":"            self.token_expiry \u003d float(conf.get(\u0027token_expiry\u0027, math.inf))"},{"line_number":47,"context_line":"        except ValueError:"},{"line_number":48,"context_line":"            raise ValueError(\u0027token_expiry must be a numerical value\u0027)"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"3fa7e38b_ca1c8716","line":46,"in_reply_to":"3fa7e38b_8ff2286e","updated":"2019-11-26 11:21:36.000000000","message":"Done","commit_id":"94b2e0cdd4c946d56cda0f3f41b3518d5968cc90"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"75c10f61c0f8a69df6121923d2362065842ed90e","unresolved":false,"context_lines":[{"line_number":86,"context_line":"        expires \u003d decoded.get(\u0027exp\u0027, 0)"},{"line_number":87,"context_line":"        issued_at \u003d decoded.get(\u0027iat\u0027, 0)"},{"line_number":88,"context_line":"        now \u003d time.time()"},{"line_number":89,"context_line":"        if issued_at \u003e now:"},{"line_number":90,"context_line":"            raise exceptions.AuthTokenUnauthorizedException("},{"line_number":91,"context_line":"                msg\u003d\u0027\"iat\" claim set in the future\u0027,"},{"line_number":92,"context_line":"                realm\u003dself.realm"}],"source_content_type":"text/x-python","patch_set":32,"id":"3fa7e38b_af4364af","line":89,"updated":"2019-11-25 21:41:25.000000000","message":"Do we need to allow for clock skew and possibly allow for small variance here?\n\nI\u0027m just thinking if a client has some skew from zuul and creates a new token then uses it immediately it is possible that things go quickly enough, even with minor skew, that this check will fail.","commit_id":"94b2e0cdd4c946d56cda0f3f41b3518d5968cc90"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"315299867630588886c28b7532721b4c490228ce","unresolved":false,"context_lines":[{"line_number":86,"context_line":"        expires \u003d decoded.get(\u0027exp\u0027, 0)"},{"line_number":87,"context_line":"        issued_at \u003d decoded.get(\u0027iat\u0027, 0)"},{"line_number":88,"context_line":"        now \u003d time.time()"},{"line_number":89,"context_line":"        if issued_at \u003e now:"},{"line_number":90,"context_line":"            raise exceptions.AuthTokenUnauthorizedException("},{"line_number":91,"context_line":"                msg\u003d\u0027\"iat\" claim set in the future\u0027,"},{"line_number":92,"context_line":"                realm\u003dself.realm"}],"source_content_type":"text/x-python","patch_set":32,"id":"3fa7e38b_0a237f5a","line":89,"in_reply_to":"3fa7e38b_af4364af","updated":"2019-11-26 11:21:36.000000000","message":"I don\u0027t mind accounting for clock skew, how much leeway should we authorize?","commit_id":"94b2e0cdd4c946d56cda0f3f41b3518d5968cc90"}]}