<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Courier New;color: #000000;font-size: 12pt;">
Hello, Matt,
<div><br>
</div>
<div>Thank you for your reply, just as what you mentioned, for the slow changed data, aync. replication should work. My concerns is that the impact of replication delay, for example (though it's quite low chance to happen):</div>
<div><br>
</div>
<div>1) <span style="font-size: 12pt;">Add new user/group/role in </span><span style="font-size: 12pt;">RegionOne, before the new user/group/role are replicated to RegionTwo, the new user begin to access RegionTwo service, then because the data has not arrived
yet, the user's request to RegionTwo may be rejected for the token vaildation failed in local KeyStone.
</span><span style="font-size: 12pt;"> </span></div>
<div><span style="font-size: 12pt;"><br>
</span></div>
<div><span style="font-size: 12pt;">2)In token revoke case. If we remove the user'role in RegionOne, the token in RegionOne will be invalid immediately, but before the remove operation replicated to the RegionTwo, the user can still use the token to access
the services in RegionTwo. Although it may last in very short interval.</span></div>
<div><span style="font-size: 12pt;"><br>
</span></div>
<div>Is there someone can evaluate the security risk is affordable or not.</div>
<div><span style="font-size: 12pt;"><br>
</span></div>
<div>
<div>
<div style="font-family:Tahoma; font-size:13px">
<div>
<div><font size="3" face="Courier New">Best Regards</font></div>
<font size="3" face="Courier New">Chaoyi Huang (joehuang)</font></div>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF144493" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Matt Fischer [matt@mattfischer.com]<br>
<b>Sent:</b> 25 February 2017 11:38<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] [keystone]PKI token VS Fernet token<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div><br>
</div>
<div>At last, we still have one question:</div>
<div>For public cloud, it is very common that multi regions are deployed. And the distance is usually very far between the regions. So the transport delay is really a problem. Fernet token requires the data must be the same. Because of the slow connection and
high time delay, in our opinion, it is <span style="color:rgb(51,51,51); font-family:arial; font-size:13px">unrealistic that let the keystones from different regions to use the same keystone datacenter. Any idea about this problem? Thanks.</span></div>
<div><br>
</div>
<div>
<p class="MsoNormal" style="font-size:14px"><span lang="EN-US" style="font-size:10.5pt; color:red"> </span></p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>There's nothing in Fernet tokens that would cause an issue with the transportation delay. You could mail the Fernet keys to each region and you're still fine, why? Because key rotation means that the "next key" is already in place on every box when you
rotate keys. There is a widely held misconception that all keystone nodes must instantaneously sync keys in every region or it won't work, that is simply not true. In fact the main reason we switched to Fernet was to REDUCE the load on our cross-region replication.
Without a database full of tokens to deal with, there's basically nothing to replicate as joe says below. User/group/role changes for us was more of a few times a day operation rather than getting a token which is thousands of times per second.</div>
<div><br>
</div>
<div><br>
</div>
<div> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>