<div dir="ltr"><div class="gmail_extra">We recently merged an implementation for GET /v3/catalog which finally enables POST /v3/auth/tokens?nocatalog to be a reasonable default behavior, at the cost of an extra HTTP call from remote service back to keystone where necessary.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Spec: <a href="https://github.com/openstack/keystone-specs/blob/master/specs/juno/get-catalog.rst">https://github.com/openstack/keystone-specs/blob/master/specs/juno/get-catalog.rst</a></div>
<div class="gmail_extra">Blueprint: <a href="https://blueprints.launchpad.net/keystone/+spec/get-catalog">https://blueprints.launchpad.net/keystone/+spec/get-catalog</a></div><div class="gmail_extra">API change: <a href="https://review.openstack.org/#/c/106854/1/v3/src/markdown/identity-api-v3.md">https://review.openstack.org/#/c/106854/1/v3/src/markdown/identity-api-v3.md</a></div>
<div class="gmail_extra">Implementation: <a href="https://review.openstack.org/#/c/106893/">https://review.openstack.org/#/c/106893/</a></div><div class="gmail_extra"><br></div><div class="gmail_extra">I also filed wishlist bug 1350000 ("UUID is a more friendly default token provider than PKI") recently, based on the developer community's recent discussions, which Morgan has subsequently raised to the the mailing list with a survey.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Bug: <a href="https://bugs.launchpad.net/keystone/+bug/1350000">https://bugs.launchpad.net/keystone/+bug/1350000</a><br></div><div class="gmail_extra">Corresponding change of defaults: <a href="https://review.openstack.org/#/c/110488/">https://review.openstack.org/#/c/110488/</a></div>
Survey on the mailing list: <a href="http://lists.openstack.org/pipermail/openstack-dev/2014-July/041474.html">http://lists.openstack.org/pipermail/openstack-dev/2014-July/041474.html</a><div class="gmail_extra"><br><div class="gmail_quote">
On Tue, Jul 22, 2014 at 4:04 AM, Giuseppe Galeota <span dir="ltr"><<a href="mailto:giuseppegaleota@gmail.com" target="_blank">giuseppegaleota@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div style="font-family:verdana,sans-serif;color:rgb(11,83,148)"><br></div><div class="gmail_extra"><div style="font-family:verdana,sans-serif;color:rgb(11,83,148)">
Dear all,</div><div style="font-family:verdana,sans-serif;color:rgb(11,83,148)">have you some good news about the problem related to <div style="display:inline">the "</div>
<span style="color:rgb(0,0,0);font-family:Tahoma">Keystone PKI token too much long</span>" for Barbican?</div><div style="font-family:verdana,sans-serif;color:rgb(11,83,148)"><br></div><div style="font-family:verdana,sans-serif;color:rgb(11,83,148)">
Thank you,</div><div style="font-family:verdana,sans-serif;color:rgb(11,83,148)">Giuseppe</div><div class="gmail_extra"><br></div><br><br><div class="gmail_quote">2014-01-31 14:27 GMT+01:00 Ferreira, Rafael <span dir="ltr"><<a href="mailto:raf@io.com" target="_blank">raf@io.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>By the way, you can achieve the same benefits of uuid tokens (shorter tokens) with PKI by simply using a md5 hash of the PKI token for your X-Auth headers. This is poorly documented but it seems to work just fine. </div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;border-width:1pt medium medium;border-style:solid none none;padding:3pt 0in 0in;border-top-color:rgb(181,196,223)">
<span style="font-weight:bold">From: </span>Adam Young <<a href="mailto:ayoung@redhat.com" target="_blank">ayoung@redhat.com</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, January 28, 2014 at 1:41 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a>" <<a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack] [Barbican] Keystone PKI token too much long<br>
</div>
<div><br>
</div>
<div>
<div bgcolor="#FFFFFF" text="#000000"><div>
<div>On 01/22/2014 12:21 PM, John Wood wrote:<br>
</div>
<blockquote type="cite">
<div style="direction:ltr;font-family:Tahoma;color:rgb(0,0,0);font-size:10pt">
(Adding another member of our team Douglas)
<div><br>
</div>
<div>Hello Giuseppe,</div>
<div><br>
</div>
<div>For questions about news or patches for Keystone's PKI vs UUID modes, you might reach out to the
<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">
openstack-dev@lists.openstack.org</a> mailing list, with the subject line prefixed with [openstack-dev] [keystone] </div>
<div><br>
</div>
<div>Our observation has been that the PKI mode can generate large text blocks for tokens (esp. for large service catalogs) that cause http header errors. </div>
<div><br>
</div>
<div>Regarding the specific barbican scripts you are running, we haven't run those in a while, so I'll investigate as we might need to update them. Please email back your /etc/barbican/barbican-api-paste.ini paste config file when you have a chance as well.
</div>
<div><br>
</div>
<div>Thanks,</div>
<div>John</div>
<div><br>
</div>
<div><br>
<div style="font-family:'Times New Roman';color:rgb(0,0,0);font-size:16px">
<hr>
<div style="direction:ltr"><font face="Tahoma" color="#000000"><b>From:</b> Giuseppe Galeota [<a href="mailto:giuseppegaleota@gmail.com" target="_blank">giuseppegaleota@gmail.com</a>]<br>
<b>Sent:</b> Wednesday, January 22, 2014 7:36 AM<br>
<b>To:</b> <a href="mailto:openstack@lists.openstack.org" target="_blank">
openstack@lists.openstack.org</a><br>
<b>Cc:</b> John Wood<br>
<b>Subject:</b> [Openstack] [Barbican] <div style="font-family:verdana,sans-serif;color:rgb(11,83,148);display:inline"></div>Keystone PKI token too much long<br>
</font><br>
</div>
<div>
<div dir="ltr">Dear all,
<div>I have configured Keystone for Barbican using this <a href="https://github.com/cloudkeep/barbican/wiki/Developer-Guide-for-Keystone" target="_blank">
guide</a>.</div>
<div><br>
</div>
<div>Is there any news or patch about the need to use a shorter token? I would not use a modified token.</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
Its a known problem. You can request a token without the service catalog using an extension.<br>
<br>
One possible future enhancement is to compress the key.<br>
<br>
<br>
</div><blockquote type="cite">
<div style="direction:ltr;font-family:Tahoma;color:rgb(0,0,0);font-size:10pt">
<div>
<div style="font-family:'Times New Roman';color:rgb(0,0,0);font-size:16px">
<div>
<div dir="ltr"><div>
<div><br>
</div>
<div>Following you can find an extract of the linked guide:</div>
</div><div><div>
<ul>
<li><span style="color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:15.333333015441895px;line-height:17px">(Optional) Typical keystone setup creates PKI tokens that are long, do not fit easily into curl requests
without splitting into components. For testing purposes suggest updating the keystone database with a shorter token-id. (An alternative is to set up keystone to generate uuid tokens.) From the above output grad the token expiry value, referred to as "x-y-z"</span><br>
</li></ul>
</div><div style="color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:15.333333015441895px;line-height:17px">
<pre style="font-family:Consolas,'Liberation Mono',Courier,monospace;font-size:13px;margin-top:15px;margin-bottom:15px;border:1px solid rgb(221,221,221);line-height:19px;overflow:auto;padding:6px 10px;word-wrap:normal;background-color:rgb(248,248,248)">
<span>mysql</span> <span style="font-weight:bold">-</span><span>u</span> <span>root</span><span>use</span> <span>keystone</span><span>;</span><span>update</span> <span>token</span> <span>set</span> <span>id</span><span style="font-weight:bold">=</span><span style="color:rgb(221,17,68)">"foo"</span> <span>where</span> <span>expires</span><span style="font-weight:bold">=</span><span style="color:rgb(221,17,68)">"x-y-z"</span> <span>;</span></pre>
</div>
</div>
<div><br>
</div>
<div>Thank you,</div>
<div>Giuseppe</div>
</div>
</div>
</div>
</div>
</div><div>
<br>
<fieldset></fieldset> <br>
<pre>_______________________________________________
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a></pre>
</div></blockquote>
<br>
</div>
</div>
</span>The communication contained in this e-mail is confidential and is intended only for the named recipient(s) and may contain information that is privileged, proprietary, attorney work product or exempt from disclosure under applicable law. If you have
received this message in error, or are not the named recipient(s), please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. Please immediately notify the sender of
the error, and delete this communication including any attached files from your system. Thank you for your cooperation.
</div>
<br>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div><br></div></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div>