<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 22 Jun 2016, at 9:42 AM, Matt Fischer <<a href="mailto:matt@mattfischer.com" class="">matt@mattfischer.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote">On Tue, Jun 21, 2016 at 4:21 PM, Sam Morrison <span dir="ltr" class=""><<a href="mailto:sorrison@gmail.com" target="_blank" class="">sorrison@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div class=""><span class=""><blockquote type="cite" class=""><div class=""><br class="">On 22 Jun 2016, at 1:45 AM, Matt Fischer <<a href="mailto:matt@mattfischer.com" target="_blank" class="">matt@mattfischer.com</a>> wrote:</div><br class=""><div class=""><div dir="ltr" class="">I don't have a solution for you, but I will concur that adding revocations kills performance especially as that tree grows. I'm curious what you guys are doing revocations on, anything other than logging out of Horizon?</div><div class="gmail_extra"><br class=""></div></div></blockquote><div class=""><br class=""></div></span>Is there a way to disable revocations?</div><span class="HOEnZb"><font color="#888888" class=""><div class=""><br class=""></div><div class="">Sam</div></font></span></div></blockquote><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I don't think so. There is no no-op driver for it that I can see. I've not tried it but maybe setting the expiration_buffer to a negative value would cause them to not be retained?</div><div class=""><br class=""></div><div class="">They expire at the rate your tokens expire (plus a buffer of 30 min by default) and under typical operation are not generated very often, so usually when you have say 10-20ish in the tree, its not too bad. It gets way worse when you have say 1000 of them. However, in our cloud anyway we just don't generate many. The only things that generate them are Horizon log outs and test suites that add and delete users and groups. If I knew we were generating anymore I'd probably setup an icinga alarm for them. When the table gets large after multiple test runs or we want to do perf tests we end up truncating the table in the DB. However that clearly is not a best security practice.</div></div></div></div>
</div></blockquote></div><br class=""><div class=""><br class=""></div><div class="">How token TTLs are very low so I’d be willing to remove revocation. The bulk of data going though our load balancers on API requests if you take glance images out is requests to the revocation url. </div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>