{"action":"closed","issue":{"url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/306","repository_url":"https://api.github.com/repos/GluuFederation/oxAuth","labels_url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/306/labels{/name}","comments_url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/306/comments","events_url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/306/events","html_url":"https://github.com/GluuFederation/oxAuth/issues/306","id":174108716,"number":306,"title":"Hash Token Values for Refresh Tokens","user":{"login":"nynymike","id":3717101,"avatar_url":"https://avatars.githubusercontent.com/u/3717101?v=3","gravatar_id":"","url":"https://api.github.com/users/nynymike","html_url":"https://github.com/nynymike","followers_url":"https://api.github.com/users/nynymike/followers","following_url":"https://api.github.com/users/nynymike/following{/other_user}","gists_url":"https://api.github.com/users/nynymike/gists{/gist_id}","starred_url":"https://api.github.com/users/nynymike/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nynymike/subscriptions","organizations_url":"https://api.github.com/users/nynymike/orgs","repos_url":"https://api.github.com/users/nynymike/repos","events_url":"https://api.github.com/users/nynymike/events{/privacy}","received_events_url":"https://api.github.com/users/nynymike/received_events","type":"User","site_admin":false},"labels":[{"id":88491466,"url":"https://api.github.com/repos/GluuFederation/oxAuth/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/GluuFederation/oxAuth/milestones/5","html_url":"https://github.com/GluuFederation/oxAuth/milestones/CE%203.0.0","labels_url":"https://api.github.com/repos/GluuFederation/oxAuth/milestones/5/labels","id":1505667,"number":5,"title":"CE 3.0.0","description":"","creator":{"login":"willow9886","id":5271048,"avatar_url":"https://avatars.githubusercontent.com/u/5271048?v=3","gravatar_id":"","url":"https://api.github.com/users/willow9886","html_url":"https://github.com/willow9886","followers_url":"https://api.github.com/users/willow9886/followers","following_url":"https://api.github.com/users/willow9886/following{/other_user}","gists_url":"https://api.github.com/users/willow9886/gists{/gist_id}","starred_url":"https://api.github.com/users/willow9886/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/willow9886/subscriptions","organizations_url":"https://api.github.com/users/willow9886/orgs","repos_url":"https://api.github.com/users/willow9886/repos","events_url":"https://api.github.com/users/willow9886/events{/privacy}","received_events_url":"https://api.github.com/users/willow9886/received_events","type":"User","site_admin":false},"open_issues":56,"closed_issues":30,"state":"open","created_at":"2016-01-13T20:38:21Z","updated_at":"2016-11-11T05:15:15Z","due_on":"2016-12-15T00:00:00Z","closed_at":null},"comments":3,"created_at":"2016-08-30T19:50:40Z","updated_at":"2016-11-11T05:15:15Z","closed_at":"2016-11-11T05:15:15Z","body":"We should create an oxAuth configuration option to store hashes of tokens rather then plain text tokens in ldap. No need for salt. In this way, if the LDAP server is hacked, the attacker would not have the tokens, just the hash values. Simlilar to the requirement not to store passwords. Also, you could search for the hash value just as easily as you could search for the access token value. The best hash algorithm to use is bcrypt, which is available as via an LDAP operation.\n"}}
{"actor":{"display_login":"qbert2k"}}