keystone

Commit Graph

Author	SHA1	Message	Date
Brant Knudson	3e035ebb72	Fix revoking domain-scoped tokens A token scoped to a domain wouldn't be revoked for a domain-wide revocation event. This is because the code to convert a token to a dict for revocation event processing didn't handle domain-scoped tokens. Partial-Bug: #1349597 Change-Id: Ib2c58f3fc8790dbe7f8b073d18d3fa9b0dff608d	9 years ago
Yuriy Taraday	a96d87200d	is_revoked check all viable subtrees An indentation error coupled with an early return lead to cases where a subtree containing a pertinent revocation event was not searched, and a revoked token would report as unrevoked. Closes-bug: #1294292 Change-Id: If56ae64d8a30b461563ee8be002544117fb14215	9 years ago
Adam Young	2e51473138	Token Revocation Extension Base API for reporting revocation events. The KVS Backend uses the Dogpile backed KVS stores. Modifies the places that were directly deleting tokens to also generate revocation events. Where possible the revocations are triggered by listening to the notifications. Some places, the callers have been modified instead. This is usually due to the need to iterate through a collection, such as users in a group. Adds a config file option to disable the existing mechanisms that support revoking a token by that token's id: revoke_by_id. This flag is necessary to test that the revocation mechanism is working as defined, but will also be part of the phased removal of the older mechanisms. TokenRevoke tests have been extended to test both with and without revoke-by-id enabled. Note: The links aren't populated in the list_events response. SQL Backend for Revocation Events Initializes the SQL Database for the revocation backend. This patch refactors the sql migration call from the CLI so that the test framework can use it as well. The sql backend for revcations is exercized by test_notifications and must be properly initialized. Revoke By Search Tree Co-Authored-By: Yuriy Taraday (Yoriksar) create a set of nested maps for the events. Look up revocation by traversing down the tree. Blueprint: revocation-events Change-Id: If76c8cd5d01a5b991c58a4d1a9d534b2a3da875a	9 years ago

Author

SHA1

Message

Date

Brant Knudson

3e035ebb72

Fix revoking domain-scoped tokens

A token scoped to a domain wouldn't be revoked for a domain-wide
revocation event. This is because the code to convert a token to a
dict for revocation event processing didn't handle domain-scoped
tokens.

Partial-Bug: #1349597

Change-Id: Ib2c58f3fc8790dbe7f8b073d18d3fa9b0dff608d

Yuriy Taraday

a96d87200d

is_revoked check all viable subtrees

An indentation error coupled with an early return lead to cases
where a subtree containing a pertinent revocation event was not
searched, and a revoked token would report as unrevoked.

Closes-bug: #1294292
Change-Id: If56ae64d8a30b461563ee8be002544117fb14215

Adam Young

2e51473138

Token Revocation Extension

Base API for reporting revocation events.

The KVS Backend uses the Dogpile backed KVS stores.

Modifies the places that were directly deleting tokens to also generate
revocation events.

Where possible the revocations are triggered by listening to the notifications.
Some places, the callers have been modified instead.  This is usually due to
the need to iterate through a collection, such as users in a group.

Adds a config file option to disable the existing mechanisms that support
revoking a token by that token's id: revoke_by_id. This flag is necessary
to test that the revocation mechanism is working as defined, but will also
be part of the phased removal of the older mechanisms. TokenRevoke tests
have been extended to test both with and without revoke-by-id enabled.

Note: The links aren't populated in the list_events response.

SQL Backend for Revocation Events

Initializes the SQL Database for the revocation backend.
This patch refactors the sql migration call from the CLI
so that the test framework can use it as well. The sql
backend for revcations is exercized by test_notifications
and must be properly initialized.

Revoke By Search Tree

Co-Authored-By: Yuriy Taraday (Yoriksar)

create a set of nested maps for the events. Look up revocation by
traversing down the tree.

Blueprint: revocation-events

Change-Id: If76c8cd5d01a5b991c58a4d1a9d534b2a3da875a

3 Commits (3e035ebb726167aef43c4a865c7e7f7d3b0978fb)