Keystone Lightweight Tokens
KLWT tokens provide a way to represent a token, allowing for tokens to be non-persistent. KLWT tokens provide integrity and confidentiality, when optionally using encryption, by being signed by Keystone. KLWT tokens contain some amount of token information, including the user, the issued at time, the expiration time, and the digest of the signed information. Regardless if encryption is used, the tokens are authentic since they are signed and validated by Keystone.
Blueprint information
- Status:
- Complete
- Approver:
- None
- Priority:
- Medium
- Drafter:
- Lance Bragstad
- Direction:
- Approved
- Assignee:
- Lance Bragstad
- Definition:
- Approved
- Series goal:
- Accepted for kilo
- Implementation:
-
Implemented
- Milestone target:
-
2015.1.0
- Started by
- Steve Martinelli
- Completed by
- Morgan Fainberg
Related branches
Related bugs
Sprints
Whiteboard
Gerrit topic: https:/
Addressed by: https:/
Keystone Lightweight Tokens (KLWT)
Addressed by: https:/
Use revocation events for lightweight tokens
Addressed by: https:/
Implement KLWT for v2.0 tokens
Gerrit topic: https:/
Gerrit topic: https:/
Addressed by: https:/
Convert audit_ids to bytes before msgpacking
Addressed by: https:/
Add unscoped token formatter for Fernet tokens
Addressed by: https:/
Federated token formatter
Addressed by: https:/
Add Federation mixin for setting up data
Addressed by: https:/
Refactor: rename the "standard" token formatter to "scoped"
Addressed by: https:/
Refactor: don't require token formatters to understand "token_data"
Addressed by: https:/
Refactor: remove Fernet formatter's dep on trust_api / v3 token helper
Addressed by: https:/
Remove redundant creation timestamp from fernet tokens
Addressed by: https:/
Remove the expiration timestamp from Fernet tokens
Addressed by: https:/
Drop Fernet token prefixes & add domain-scoped Fernet tokens
Addressed by: https:/
Refactor: make Fernet token creation/validation API agnostic
Addressed by: https:/
Allow methods to be carried in Fernet tokens.
Addressed by: https:/
Replace the expiration timestamp in Fernet tokens with a ttl
Gerrit topic: https:/
Addressed by: https:/
Use existing token test for Fernet tokens.
Addressed by: https:/
Add inline comment and docstrings fixes for Fernet
Addressed by: https:/
Cleanup Fernet testcases and add comments.
