List Revocation Events
List the events that lead to revoked tokens instead of the revoked token ids
revocation events will be a tuple: UserId, ProjectId, time.
The list of revocation events will only last until the project has expired.
Revocation lists will be grouped by domain id or project id
As a consequence of this blueprint, GET /v3/auth/
This will close bug 1242620.
Blueprint information
- Status:
- Complete
- Approver:
- None
- Priority:
- High
- Drafter:
- Adam Young
- Direction:
- Needs approval
- Assignee:
- Adam Young
- Definition:
- New
- Series goal:
- Accepted for icehouse
- Implementation:
-
Implemented
- Milestone target:
-
2014.1
- Started by
- Dolph Mathews
- Completed by
- Thierry Carrez
Related branches
Related bugs
Sprints
Whiteboard
https:/
I like the concept of grouping by domain (vs. group by project). As long as we
collect the revocation events for a given domain (if we don't know about the
domain yet, aka no events on the notification bus, no record of revocation
events). If an event for a (never before seen) domain comes across the bus,
we should request the full list of events for that domain. Would you expect a
complete refresh of the list on a domain for an event? --morganfainberg
Advantages
==========
- we can drop token persistence completely for PKI tokens (revocation list is
the only reason we need it today)
Alternative
OCSP - Online certificate status protocol
Disadvantages
============
- tokens MUST be re-issued with the exact same expires_at to support explicit token revocation. issuing tokens with shorter expiration is no longer a valid option in the future.
To be Addressed:
===========
Similar to other service we need to provide links in the events packet. Primarily we need to know the location of the bus from which to receive deltas.
Gerrit topic: https:/
Addressed by: https:/
API
Gerrit topic: https:/
Addressed by: https:/
Token Revocation Extension
Addressed by: https:/
append extension name to trust notifications
Addressed by: https:/
Don't duplicate the existing config file list
Addressed by: https:/
initialize environment for tests that call popen
Addressed by: https:/
Allow event callback registration for arbitrary resource types
Addressed by: https:/
Notifications upon disable
Addressed by: https:/
Additional notifications for revocations
Addressed by: https:/
revocation events
Gerrit topic: https:/
Gerrit topic: https:/
Addressed by: https:/
SQL Backend for Revocation Events
Addressed by: https:/
Revocation events for keystonemiddleware
Work Items
Work items:
[ayoung] Define format for reporting items: TODO
[ayoung] spec out tool to determine if a token matches revocation criteria: TODO
[ayoung] determine how to report revoking a specific token: TODO
[ayoung] determine how to report token chain of allocation: TODO
Dependency tree
* Blueprints in grey have been implemented.
