<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Hi Subbu,</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">The Ephemeral Token work has been pushed to Juno because of timelines and the need to get the revocation API in place first. I fully expect that the ephemeral tokens, and other related improvements will be part of Juno as a lot of the work has already been spec’d out / started.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Cheers,</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Morgan</div> <div id="bloop_sign_1394658261061348864" class="bloop_sign"><p><strong>—</strong><br>
<strong>Morgan Fainberg</strong><br>
Principal Software Engineer<br>
Core Developer, Keystone<br>
<a href="mailto:m@metacloud.com">m@metacloud.com</a></p></div> <br><p style="color:#000;">On March 12, 2014 at 13:57:44, Subbu Allamaraju (<a href="mailto:subbu@subbu.org">subbu@subbu.org</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>
<title></title>
<div dir="ltr">Adam - can you comment if the status of ephemeral
tokens. All commits for <a href="https://blueprints.launchpad.net/keystone/+spec/ephemeral-pki-tokens">https://blueprints.launchpad.net/keystone/+spec/ephemeral-pki-tokens</a>
have been abandoned.
<div><br></div>
<div>Thanks</div>
<div>Subbu</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Wed, Feb 19, 2014 at 8:50 PM, Adam
Young <span dir="ltr"><<a href="mailto:ayoung@redhat.com" target="_blank">ayoung@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">On 02/19/2014 07:00 PM, Miller, Mark M (EB SW Cloud -
R&D - Corvallis) wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello,<br>
<br>
I read the following and want to register a disagreement:<br>
<br>
"With token revocation events in place, we no longer have a need to
store a token revocation list. The token revocation list is the
primary reason why keystone bothers to persist PKI tokens, so
without it, PKI tokens can become completely ephemeral."<br>
<br>
One idea behind PKI tokens is to enable services to parse the token
to retrieve role/project/domain data for a particular user without
having to validate the token with Keystone each and every time. In
order to make sure that the token has not been revoked, services
need to check the expiration date and "check the token revocation
list" to make sure that the token is still valid. That said, how
will non-OpenStack services obtain token revocation information if
the revocation list is removed?<br></blockquote>
<br></div>
Going to be replcaed with an API for listing revocation
events.<br>
<br>
<a href="https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-revoke-ext.md" target="_blank">https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-revoke-ext.md</a>
<div class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I
thought maybe the new "Callbacks on internal events" might be
something external services could use like listening in onto a
Keystone message queue, but it apparently only applies to
extensions.<br></blockquote>
<br></div>
Actually, it is just the opposite: internal events are
callbacks that are not shipped outside of Keystone, but rather from
one infrastructure piece to another. In this case, things
that can trigger revoaction events, like disable a domain.
This event is published externally as an update event, but
the focused disable is internal only.
<div class="HOEnZb">
<div class="h5"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
This is one time I will be glad to be wrong.<br>
<br>
Regards,<br>
<br>
Mark<br>
<br>
_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
</blockquote>
<br>
<br>
_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
</div>
</div>
</blockquote>
</div>
<br></div>
_______________________________________________
<br>Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
<br>Post to : openstack@lists.openstack.org
<br>Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
<br></div></div></span></blockquote></body></html>