{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/etcd/issues/6082","repository_url":"https://api.github.com/repos/coreos/etcd","labels_url":"https://api.github.com/repos/coreos/etcd/issues/6082/labels{/name}","comments_url":"https://api.github.com/repos/coreos/etcd/issues/6082/comments","events_url":"https://api.github.com/repos/coreos/etcd/issues/6082/events","html_url":"https://github.com/coreos/etcd/pull/6082","id":168825222,"number":6082,"title":"*: support jwt token in v3 auth API","user":{"login":"mitake","id":1173955,"avatar_url":"https://avatars.githubusercontent.com/u/1173955?v=3","gravatar_id":"","url":"https://api.github.com/users/mitake","html_url":"https://github.com/mitake","followers_url":"https://api.github.com/users/mitake/followers","following_url":"https://api.github.com/users/mitake/following{/other_user}","gists_url":"https://api.github.com/users/mitake/gists{/gist_id}","starred_url":"https://api.github.com/users/mitake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitake/subscriptions","organizations_url":"https://api.github.com/users/mitake/orgs","repos_url":"https://api.github.com/users/mitake/repos","events_url":"https://api.github.com/users/mitake/events{/privacy}","received_events_url":"https://api.github.com/users/mitake/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/etcd/labels/kind/release-note","name":"kind/release-note","color":"c5def5"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":23,"created_at":"2016-08-02T08:15:15Z","updated_at":"2016-09-09T02:49:48Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/coreos/etcd/pulls/6082","html_url":"https://github.com/coreos/etcd/pull/6082","diff_url":"https://github.com/coreos/etcd/pull/6082.diff","patch_url":"https://github.com/coreos/etcd/pull/6082.patch"},"body":"This PR adds jwt token support in v3 auth API.\r\n\r\nRemaining major ToDos:\r\n- Currently token type isn't hidden from etcdserver. In the near\r\n  future the information should be completely invisible from\r\n  etcdserver package.\r\n- Configurable expiration of token. Currently tokens can be valid\r\n  until keys are changed.\r\n\r\nHow to use:\r\n1. generate keys for signing and verfying jwt tokens:\r\n $ openssl genrsa -out app.rsa 1024\r\n $ openssl rsa -in app.rsa -pubout > app.rsa.pub\r\n\r\n2.  add command line options to etcd like below:\r\n--v3-auth-token-type jwt \\\r\n--v3-auth-jwt-pub-key app.rsa.pub --v3-auth-jwt-priv-key app.rsa \\\r\n--v3-auth-jwt-sign-method RS512\r\n\r\n3. launch etcd cluster\r\n\r\nBelow is a performance comparison of serializable read w/ and w/o jwt\r\ntoken. Every (3) etcd node is executed on a single machine. Signing\r\nmethod is RS512 and key length is 1024 bit. As the results show, jwt\r\nbased token introduces a performance overhead but it would be\r\nacceptable for a case that requires authentication.\r\n\r\n### w/o jwt token auth (no auth):\r\n\r\n```\r\nSummary:\r\n  Total:        1.6172 secs.\r\n  Slowest:      0.0125 secs.\r\n  Fastest:      0.0001 secs.\r\n  Average:      0.0002 secs.\r\n  Stddev:       0.0004 secs.\r\n  Requests/sec: 6183.5877\r\n\r\nResponse time histogram:\r\n  0.000 [1]     |\r\n  0.001 [9982]  |∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎\r\n  0.003 [1]     |\r\n  0.004 [1]     |\r\n  0.005 [0]     |\r\n  0.006 [0]     |\r\n  0.008 [6]     |\r\n  0.009 [0]     |\r\n  0.010 [1]     |\r\n  0.011 [5]     |\r\n  0.013 [3]     |\r\n\r\nLatency distribution:\r\n  10% in 0.0001 secs.\r\n  25% in 0.0001 secs.\r\n  50% in 0.0001 secs.\r\n  75% in 0.0001 secs.\r\n  90% in 0.0002 secs.\r\n  95% in 0.0002 secs.\r\n  99% in 0.0003 secs.\r\n```\r\n\r\n### w/ jwt token auth:\r\n\r\n```\r\nSummary:\r\n  Total:        2.5364 secs.\r\n  Slowest:      0.0182 secs.\r\n  Fastest:      0.0002 secs.\r\n  Average:      0.0003 secs.\r\n  Stddev:       0.0005 secs.\r\n  Requests/sec: 3942.5185\r\n\r\nResponse time histogram:\r\n  0.000 [1]     |\r\n  0.002 [9975]  |∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎∎\r\n  0.004 [0]     |\r\n  0.006 [1]     |\r\n  0.007 [11]    |\r\n  0.009 [2]     |\r\n  0.011 [4]     |\r\n  0.013 [5]     |\r\n  0.015 [0]     |\r\n  0.016 [0]     |\r\n  0.018 [1]     |\r\n\r\nLatency distribution:\r\n  10% in 0.0002 secs.\r\n  25% in 0.0002 secs.\r\n  50% in 0.0002 secs.\r\n  75% in 0.0002 secs.\r\n  90% in 0.0003 secs.\r\n  95% in 0.0003 secs.\r\n  99% in 0.0004 secs.\r\n```"},"comment":{"url":"https://api.github.com/repos/coreos/etcd/issues/comments/245804046","html_url":"https://github.com/coreos/etcd/pull/6082#issuecomment-245804046","issue_url":"https://api.github.com/repos/coreos/etcd/issues/6082","id":245804046,"user":{"login":"mitake","id":1173955,"avatar_url":"https://avatars.githubusercontent.com/u/1173955?v=3","gravatar_id":"","url":"https://api.github.com/users/mitake","html_url":"https://github.com/mitake","followers_url":"https://api.github.com/users/mitake/followers","following_url":"https://api.github.com/users/mitake/following{/other_user}","gists_url":"https://api.github.com/users/mitake/gists{/gist_id}","starred_url":"https://api.github.com/users/mitake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitake/subscriptions","organizations_url":"https://api.github.com/users/mitake/orgs","repos_url":"https://api.github.com/users/mitake/repos","events_url":"https://api.github.com/users/mitake/events{/privacy}","received_events_url":"https://api.github.com/users/mitake/received_events","type":"User","site_admin":false},"created_at":"2016-09-09T02:49:47Z","updated_at":"2016-09-09T02:49:47Z","body":"@xiang90 @heyitsanthony I don't disagree with adding the caching mechanism but I'm not fully sure that the overhead is really dominated by the decoding process. Before adding it I'd like to do some profiling and let you know the result."}}
{"actor":{"display_login":"mitake"}}