<div dir="ltr">I don't think your example is right: "<span style="font-size:12.8px">PKI will validate that token without going to any keystone server". How would it track revoked tokens? I'm pretty sure that they still get validated, they are stored in the DB even.</span><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">I also disagree that there are different use cases. Just switch to fernet and save yourself what's going to be weeks of pain with probably no improvement in anything with this idea.</span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 8, 2016 at 9:56 AM, rezroo <span dir="ltr"><<a href="mailto:openstack@roodsari.us" target="_blank">openstack@roodsari.us</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
The basic idea is to let the openstack clients decide what sort of
token optimization to use - for example, while a normal client uses
uuid tokens, some services like heat or magnum may opt for pki
tokens for their operations. A service like nova, configured for PKI
will validate that token without going to any keystone server, but
if it gets a uuid token then validates it with a keystone endpoint.
I'm under the impression that the different token formats have
different use-cases, so am wondering if there is a conceptual reason
why multiple token formats are an either/or scenario.<div><div class="h5"><br>
<br>
<div>On 3/8/2016 8:06 AM, Matt Fischer
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">This would be complicated to setup. How would the
Openstack services validate the token? Which keystone node would
they use? A better question is why would you want to do this? </div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Mar 8, 2016 at 8:45 AM, rezroo
<span dir="ltr"><<a href="mailto:openstack@roodsari.us" target="_blank">openstack@roodsari.us</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Keystone
supports both tokens and ec2 credentials simultaneously, but
as far as I can tell, will only do a single token format
(uuid, pki/z, fernet) at a time. Is it possible or advisable
to configure keystone to issue multiple token formats? For
example, I could configure two keystone servers, each using
a different token format, so depending on endpoint used, I
could get a uuid or pki token. Each service can use either
token format, so is there a conceptual or implementation
issue with this setup?<br>
Thanks,<br>
Reza<br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset></fieldset>
<br>
<pre>__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: <a href="mailto:OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</pre>
</blockquote>
<br>
</div></div></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>