<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
The basic idea is to let the openstack clients decide what sort of
token optimization to use - for example, while a normal client uses
uuid tokens, some services like heat or magnum may opt for pki
tokens for their operations. A service like nova, configured for PKI
will validate that token without going to any keystone server, but
if it gets a uuid token then validates it with a keystone endpoint.
I'm under the impression that the different token formats have
different use-cases, so am wondering if there is a conceptual reason
why multiple token formats are an either/or scenario.<br>
<br>
<div class="moz-cite-prefix">On 3/8/2016 8:06 AM, Matt Fischer
wrote:<br>
</div>
<blockquote
cite="mid:CAHr1CO_dpwgSDYUmfXCC+UySnBo1+nHJmouWjnFefXLOEXxBYA@mail.gmail.com"
type="cite">
<div dir="ltr">This would be complicated to setup. How would the
Openstack services validate the token? Which keystone node would
they use? A better question is why would you want to do this? </div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Mar 8, 2016 at 8:45 AM, rezroo
<span dir="ltr"><<a moz-do-not-send="true"
href="mailto:openstack@roodsari.us" target="_blank">openstack@roodsari.us</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Keystone
supports both tokens and ec2 credentials simultaneously, but
as far as I can tell, will only do a single token format
(uuid, pki/z, fernet) at a time. Is it possible or advisable
to configure keystone to issue multiple token formats? For
example, I could configure two keystone servers, each using
a different token format, so depending on endpoint used, I
could get a uuid or pki token. Each service can use either
token format, so is there a conceptual or implementation
issue with this setup?<br>
Thanks,<br>
Reza<br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a moz-do-not-send="true"
href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe"
rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a moz-do-not-send="true"
href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev"
rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: <a class="moz-txt-link-abbreviated" href="mailto:OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>