<div dir="ltr">Hi Lance,<div><br></div><div>Thank you for the documentation link. It really solves the problem with trust expiration. I really like an idea to restrict trust to specific roles. This is great.</div><div><br>
</div><div>As you mentioned, you use sql to store trusts information. Do you use any encryption for that? I am thinking from security perspective, if you have trust information in DB it might be not safe as this trust is a long term authentication.</div>
<div><br></div><div>Thanks</div><div>Georgy</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jan 17, 2014 at 10:31 AM, Lance D Bragstad <span dir="ltr"><<a href="mailto:ldbragst@us.ibm.com" target="_blank">ldbragst@us.ibm.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>
<p><font face="sans-serif">Hi Georgy, </font><br>
<br>
<font face="sans-serif">The following might help with some of the trust questions you have, if you haven't looked at it already:</font><br>
<a href="https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-trust-ext.md" target="_blank"><font size="3" color="#0000FF" face="serif"><u>https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-trust-ext.md</u></font></a><font size="3" face="serif"> </font><br>
<br>
<font face="sans-serif">As far as storage implementation, trust uses sql and kvs backends. Trusts can be given an expiration but if an expiration is not given the trust is valid until it is explicitly revoked (taken from the link above): </font><br>
<br>
<font color="#333333" face="Arial"> Optionally, the trust may only be valid for a specified time period, as defined by </font><font size="1" color="#333333" face="Consolas">expires_at</font><font color="#333333" face="Arial">. If no</font><font size="1" color="#333333" face="Consolas">expires_at</font><font color="#333333" face="Arial"> is specified, then the trust is valid until it is explicitly revoked.</font><font size="3" face="serif"> </font><font face="sans-serif"><br>
</font><br>
<font face="sans-serif">Trusts can also be given 'uses' so that you can set a limit to how many times a trust will issue a token to the trustee. That functionality hasn't landed yet but it is up for review: </font><a href="https://review.openstack.org/#/c/56243/" target="_blank"><font size="3" color="#0000FF" face="serif"><u>https://review.openstack.org/#/c/56243/</u></font></a><font size="3" face="serif"> </font><br>
<br>
<font face="sans-serif">Hope this helps! </font><br>
<br>
<font face="sans-serif"><br>
Best Regards, <br>
<br>
Lance Bragstad <br>
</font><br>
<br>
<img width="16" height="16" src="cid:1__=08BBF6F0DFF718F58f9e8a93df938@us.ibm.com" border="0" alt="Inactive hide details for Georgy Okrokvertskhov ---01/17/2014 12:11:46 PM---Hi, In Solum project we want to use Keystone trusts"><font color="#424282" face="sans-serif">Georgy Okrokvertskhov ---01/17/2014 12:11:46 PM---Hi, In Solum project we want to use Keystone trusts to work with other</font><br>
<br>
<font size="1" color="#5F5F5F" face="sans-serif">From: </font><font size="1" face="sans-serif">Georgy Okrokvertskhov <<a href="mailto:gokrokvertskhov@mirantis.com" target="_blank">gokrokvertskhov@mirantis.com</a>></font><br>
<font size="1" color="#5F5F5F" face="sans-serif">To: </font><font size="1" face="sans-serif">OpenStack Development Mailing List <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>>, </font><br>
<font size="1" color="#5F5F5F" face="sans-serif">Date: </font><font size="1" face="sans-serif">01/17/2014 12:11 PM</font><br>
<font size="1" color="#5F5F5F" face="sans-serif">Subject: </font><font size="1" face="sans-serif">[openstack-dev] [Solum][Keystone] Best practices for storing keystone trusts information</font><br>
</p><hr width="100%" size="2" align="left" noshade style="color:#8091a5"><div><div class="h5"><br>
<br>
<br>
<font size="3" face="serif">Hi,</font><br>
<br>
<font size="3" face="serif">In Solum project we want to use Keystone trusts to work with other OpenStack services on behalf of user. Trusts are long term entities and a service should keep them for a long time. </font><br>
<br>
<font size="3" face="serif">I want to understand what are best practices for working with trusts and storing them in a service?</font><br>
<br>
<font size="3" face="serif">What are the options to keep trust? I see obvious approaches like keep them in a service DB or keep them in memory. Are there any other approaches?</font><br>
<br>
<font size="3" face="serif">Is there a proper way to renew trust? For example if I have a long term task which is waiting for external event, how to keep trust fresh for a long and unpredicted period?</font><br>
<br>
<font size="3" face="serif">Thanks</font><br>
</div></div><font size="3" face="serif">Georgy</font><tt><font>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
</font></tt><tt><font><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></font></tt><tt><font><br>
</font></tt><br>
<p></p></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br>
</div></div>