Non-persistent PKI tokens
With token revocation events in place, we no longer have a need to store a token revocation list. The token revocation list is the primary reason why keystone bothers to persist PKI tokens, so without it, PKI tokens can become completely ephemeral.
Two steps are required to make that happen:
1) revise code that validates tokens from the token backend to pull from context instead
2) allow deployers to opt out of token persistence (UUID tokens must still be persisted)
Blueprint information
- Status:
- Complete
- Approver:
- Dolph Mathews
- Priority:
- Low
- Drafter:
- None
- Direction:
- Needs approval
- Assignee:
- Morgan Fainberg
- Definition:
- Superseded
- Series goal:
- None
- Implementation:
-
Good progress
- Milestone target:
- None
- Started by
- Dolph Mathews
- Completed by
- Dolph Mathews
Related branches
Related bugs
| Bug #1257723: "Timed out trying to delete user" resolved by heat-engine restart | Fix Released |
Sprints
Whiteboard
Spec: https:/
Gerrit topic: https:/
Addressed by: https:/
Use CMS to decode PKI tokens
Addressed by: https:/
Consolidate provider calls to token_api.
Addressed by: https:/
Pass token expiry to the .create_token() method
Gerrit topic: https:/
Addressed by: https:/
Do not support toggling key_manglers in cache layer
Addressed by: https:/
Remove deprecated token_api.
Addressed by: https:/
Add the new KeystoneTokenModel
Bumping to j3 as discussed at the hackathon -dolph
Addressed by: https:/
Sync with oslo-incubator
Addressed by: https:/
Move token_api.unique_id to token_provider_api
Addressed by: https:/
Move keystone.
Addressed by: https:/
Consolidate `assert_
Addressed by: https:/
Mark the 'check_vX_token' methods deprecated
Addressed by: https:/
Move token persistence classes to token.persistence module
Addressed by: https:/
Make token_provider_api contain token persistence
Addressed by: https:/
Remove assignment controller dependency on token_api
Addressed by: https:/
Expose token revocation list via token_provider_api
Addressed by: https:/
Remove ec2 contrib dependency on token_api
Addressed by: https:/
Remove trust dependency on token_api
Addressed by: https:/
Sample config update
Addressed by: https:/
Remove duplicated asserts
Addressed by: https:/
Update AuthContextMidd
Addressed by: https:/
Add __repr__ to KeystoneToken model
Addressed by: https:/
Do not overwrite token expires with lower resolution
Addressed by: https:/
Convert (for mysql) revocation events expires_at to varchar
Addressed by: https:/
Add audit ids to tokens
Addressed by: https:/
Sync with oslo-incubator
Addressed by: https:/
Revoke by Audit Id / Audit Id Chain instead of expires
Addressed by: https:/
Remove SAML2 plugin dependency on token_api
Addressed by: https:/
Remove identity_api dependency on token_api
Addressed by: https:/
Add extra guarding to revoke_by_audit_id methods
Gerrit topic: https:/
Addressed by: https:/
Remove wsgi and base controller dependency on token_api
Addressed by: https:/
Notification Constant Cleanup and internal notify type
Addressed by: https:/
Remove assignment_api dependency on token_api
Addressed by: https:/
Remove oauth controller dependency on token_api
Addressed by: https:/
Mark methods on token_api deprecated
Addressed by: https:/
Non-persistent Token Driver
Addressed by: https:/
Fix Python3 issue with token data helper test
Addressed by: https:/
Make persistence manager in token_provider_api private
Addressed by: https:/
Update tests to not use token_api
Addressed by: https:/
Notification Cleanup: Objects for actions
Addressed by: https:/
Comments to docstrings for notification emit methods
Addressed by: https:/
Kilo version of non-persistent token specification
Addressed by: https:/
Token Provider Cleanup Spec
procedural change of milestone target, feel free to target to mitaka-2 or mitaka-3. also feel free to mark this as superseded by other blueprints (fernet or otherwise) or won't fix since it's PKI related (deprecated)
Work Items
Dependency tree
* Blueprints in grey have been implemented.
