<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 07/07/2014 10:33 AM, Marco Fargetta
wrote:<br>
</div>
<blockquote
cite="mid:20140707143337.GF4312@sonny.areagrid.ct.infn.it"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">3. Unscoped tokens should be very short lived: 10 minutes.
Unscoped tokens should be infinitely extensible: If I hand an
unscoped token to keystone, I get one good for another 10 minutes.
</pre>
</blockquote>
<pre wrap="">Using this time limit horizon should extend all the unscoped token
every x min (with x< 10). Is this useful or could be long lived but
revocable by Keystone? In this case, after the unscoped token is
revoked it cannot be used to get a scoped token.
</pre>
</blockquote>
<pre wrap="">Close. I was thinking more along the lines of Horizon looking at
the unscoped token and, if it is about to expire, exchanging one
unscoped token for another. The unscoped tokens would have a short
time-to-live (10 minutes) and any scoped tokens they create would
have the same time span: we could in theory make the unscoped last
longer, but I don't really think it would be necessary.
</pre>
</blockquote>
<pre wrap="">
When should Horizon check the token validity? If it depends from external
events, like user interactions, I think the time-frame should be similar to the
user session to avoid the need of authenticate users many times inside the session.
If you use an external thread to renew the token then they could be shorter but
this would generate some traffic to evaluate.</pre>
</blockquote>
<br>
The session token would be saved in the users HTTP session cookie.
When a user interacts with Horizon, django-openstack-auth would
check for the presence of the session cookie, and, if the cookie is
about to expire, extend it.<br>
<br>
It does mean that the Horizon web app can only perform operations
when actively initiated by the user, otherwise the session will be
automatically extended forever if the user justs sits on the page.
Using an ajax approach with automatically timed refreshes, could
potentially lead to this, but it is not the case now.<br>
<br>
The threshold to refresh should be fairly close to session time
out: If the session times out in 20 minutes, don't refresh every 30
seconds. If the token duration is 10 minutes, and the user triggers
a Horizon request at 9 minutes and 30 seconds, django-openstack-auth
can refresh the token: a 30 second window is reasonable.<br>
<blockquote
cite="mid:20140707143337.GF4312@sonny.areagrid.ct.infn.it"
type="cite">
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
OpenStack-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>