{"action":"created","issue":{"url":"https://api.github.com/repos/rcbops/rpc-openstack/issues/873","repository_url":"https://api.github.com/repos/rcbops/rpc-openstack","labels_url":"https://api.github.com/repos/rcbops/rpc-openstack/issues/873/labels{/name}","comments_url":"https://api.github.com/repos/rcbops/rpc-openstack/issues/873/comments","events_url":"https://api.github.com/repos/rcbops/rpc-openstack/issues/873/events","html_url":"https://github.com/rcbops/rpc-openstack/issues/873","id":137526132,"number":873,"title":"change default token provider to fernet","user":{"login":"mancdaz","id":562262,"avatar_url":"https://avatars.githubusercontent.com/u/562262?v=3","gravatar_id":"","url":"https://api.github.com/users/mancdaz","html_url":"https://github.com/mancdaz","followers_url":"https://api.github.com/users/mancdaz/followers","following_url":"https://api.github.com/users/mancdaz/following{/other_user}","gists_url":"https://api.github.com/users/mancdaz/gists{/gist_id}","starred_url":"https://api.github.com/users/mancdaz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mancdaz/subscriptions","organizations_url":"https://api.github.com/users/mancdaz/orgs","repos_url":"https://api.github.com/users/mancdaz/repos","events_url":"https://api.github.com/users/mancdaz/events{/privacy}","received_events_url":"https://api.github.com/users/mancdaz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rcbops/rpc-openstack/labels/impacts-doc","name":"impacts-doc","color":"d4c5f9"},{"url":"https://api.github.com/repos/rcbops/rpc-openstack/labels/type-enhancement","name":"type-enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-03-01T09:57:27Z","updated_at":"2016-03-01T16:24:05Z","closed_at":null,"body":"In kilo we overrode the default token provider in rpc-o to uuid (the default in osa was set to fernet). This proved to be a decent approach as there were subsequent problems with fernet.\r\n\r\nFor liberty, most of the problems have been addressed. Comments from the 2 keystone developers (dolph and lbragstad) regarding the current state of fernet:\r\n\r\n\r\n**dolph**: *\"I don't think we have any reasoning to recommend deployers use anything but Fernet today.\"*\r\n\r\n\r\n\r\n**lbragstad**: *\"The most recent “oddities” that have been circulating upstream are related to trusts + Fernet + the usage of v2.0. If a deployment issues Fernet tokens and a user obtains a trust scoped token using v3 can/should they be using that token to make v2.0 calls. This use case isn’t documented upstream but it is what we are trying to solve for since it wasn’t forbidden in the past with UUID tokens.*\r\n*The unofficial decision to push making Fernet [in upstream kilo] the default was made this morning. Adam, Dolph and I are going continue fixing oddities through-out the Mitaka release so that we should be good to make that switch first thing in Newton.*\r\n\r\n*If you see any oddities on your end, please let us know.\"*\r\n\r\nWe probably want to remove the override and test with fernet."},"comment":{"url":"https://api.github.com/repos/rcbops/rpc-openstack/issues/comments/190794090","html_url":"https://github.com/rcbops/rpc-openstack/issues/873#issuecomment-190794090","issue_url":"https://api.github.com/repos/rcbops/rpc-openstack/issues/873","id":190794090,"user":{"login":"git-harry","id":687171,"avatar_url":"https://avatars.githubusercontent.com/u/687171?v=3","gravatar_id":"","url":"https://api.github.com/users/git-harry","html_url":"https://github.com/git-harry","followers_url":"https://api.github.com/users/git-harry/followers","following_url":"https://api.github.com/users/git-harry/following{/other_user}","gists_url":"https://api.github.com/users/git-harry/gists{/gist_id}","starred_url":"https://api.github.com/users/git-harry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/git-harry/subscriptions","organizations_url":"https://api.github.com/users/git-harry/orgs","repos_url":"https://api.github.com/users/git-harry/repos","events_url":"https://api.github.com/users/git-harry/events{/privacy}","received_events_url":"https://api.github.com/users/git-harry/received_events","type":"User","site_admin":false},"created_at":"2016-03-01T16:24:05Z","updated_at":"2016-03-01T16:24:05Z","body":"The agreement for 12 is that there will be no new features beyond what is naturally gained by moving to the new release. Making this change is effectively introducing something new that possibly has the potential to impact QE, docs, support etc.\r\n\r\nThat said the change is simple enough to implement, is using something that is the default for OSA and is something that can be set by support currently. I have created a patch in case this does become a last minute addition."}}