<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>You know it’s an interesting discussion thread on keystone when both Termie and I are watching, chuckling, and grimacing in remembered pain …</div>
<div><br>
</div>
<div>-joe</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Andy Smith <<a href="mailto:andyster@gmail.com">andyster@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Date: </span>Friday, April 8, 2016 at 9:12 AM<br>
<span style="font-weight:bold">To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [openstack-dev] [tc][ptl][keystone] Proposal to split authentication part out of Keystone to separated project<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">Aaaaaahahahahhahahahhaahhahahahahahahahahhahhahahahahhahaha</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Thu, Apr 7, 2016 at 6:23 AM Lance Bragstad <<a href="mailto:lbragstad@gmail.com">lbragstad@gmail.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">In response to point 2.2, the progress with Fernet in the last year has exposed performance pain points in keystone. Finding sensible solutions for those issues is crucial in order for people to adopt Fernet. In Mitaka we had a lot of discussion
that resulted in landing several performance related patches.
<div><br>
</div>
<div>As of today, we're already focusing on scalability, performance, and simplicity. I'm afraid a project split would only delay the work we're doing right now.</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Apr 6, 2016 at 5:34 PM, Morgan Fainberg <span dir="ltr">
<<a href="mailto:morgan.fainberg@gmail.com" target="_blank">morgan.fainberg@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">
<div>
<div>On Wed, Apr 6, 2016 at 6:29 PM, David Stanek <span dir="ltr"><<a href="mailto:dstanek@dstanek.com" target="_blank">dstanek@dstanek.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><br>
<div class="gmail_quote"><span>
<div dir="ltr">On Wed, Apr 6, 2016 at 3:26 PM Boris Pavlovic <<a href="mailto:bpavlovic@mirantis.com" target="_blank">bpavlovic@mirantis.com</a>> wrote:</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div><br>
</div>
<div>2) This will reduce scope of Keystone, which means 2 things</div>
<div>2.1) Smaller code base that has less issues and is simpler for testing</div>
<div>2.2) Keystone team would be able to concentrate more on fixing perf/scalability issues of authorization, which is crucial at the moment for large clouds.</div>
</div>
</blockquote>
<div><br>
</div>
</span>
<div>I'm not sure that this is entirely true. If we truly just split up the project, meaning we don't remove functionality, then we'd have the same number of bugs and work. It would just be split across two projects.</div>
<div><br>
</div>
<div>I think the current momentum to get out of the authn business is still our best bet. As Steve mentioned this is ongoing work.</div>
<span><font color="#888888">
<div><br>
</div>
<div>-- David</div>
</font></span></div>
</div>
<br>
</blockquote>
<div><br>
</div>
</div>
</div>
<div>What everyone else said... but add in the need then to either pass the AuthN over to the Assignment/AuthZ api or bake it in (via apache module?) and we are basically where we are now.</div>
<div><br>
</div>
<div>Steve alluded to splitting out the authentication bit (but not to a new service), the idea there is to make it so AuthN is not part of the CRUD interface of the server. All being said, AuthN and AuthZ are going to be hard to split into two separate services
and with exception of the unfounded "scope" benefit, we already can handle most of what you've proposed with zero changes to Keystone.</div>
<div><br>
</div>
<div>Cheers,</div>
<div>--Morgan</div>
</div>
<br>
</div>
</div>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
</blockquote>
</div>
<br>
</div>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote>
</div>
</div>
</div>
</span>
</body>
</html>