{"action":"created","issue":{"url":"https://api.github.com/repos/eclipse/che/issues/9016","repository_url":"https://api.github.com/repos/eclipse/che","labels_url":"https://api.github.com/repos/eclipse/che/issues/9016/labels{/name}","comments_url":"https://api.github.com/repos/eclipse/che/issues/9016/comments","events_url":"https://api.github.com/repos/eclipse/che/issues/9016/events","html_url":"https://github.com/eclipse/che/pull/9016","id":302317350,"number":9016,"title":"Use JWT instead of machine token to be able recover workspaces","user":{"login":"akorneta","id":12269156,"avatar_url":"https://avatars1.githubusercontent.com/u/12269156?v=4","gravatar_id":"","url":"https://api.github.com/users/akorneta","html_url":"https://github.com/akorneta","followers_url":"https://api.github.com/users/akorneta/followers","following_url":"https://api.github.com/users/akorneta/following{/other_user}","gists_url":"https://api.github.com/users/akorneta/gists{/gist_id}","starred_url":"https://api.github.com/users/akorneta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akorneta/subscriptions","organizations_url":"https://api.github.com/users/akorneta/orgs","repos_url":"https://api.github.com/users/akorneta/repos","events_url":"https://api.github.com/users/akorneta/events{/privacy}","received_events_url":"https://api.github.com/users/akorneta/received_events","type":"User","site_admin":false},"labels":[{"id":192367928,"url":"https://api.github.com/repos/eclipse/che/labels/kind/enhancement","name":"kind/enhancement","color":"84b6eb","default":false},{"id":345100523,"url":"https://api.github.com/repos/eclipse/che/labels/status/code-review","name":"status/code-review","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":{"login":"akorneta","id":12269156,"avatar_url":"https://avatars1.githubusercontent.com/u/12269156?v=4","gravatar_id":"","url":"https://api.github.com/users/akorneta","html_url":"https://github.com/akorneta","followers_url":"https://api.github.com/users/akorneta/followers","following_url":"https://api.github.com/users/akorneta/following{/other_user}","gists_url":"https://api.github.com/users/akorneta/gists{/gist_id}","starred_url":"https://api.github.com/users/akorneta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akorneta/subscriptions","organizations_url":"https://api.github.com/users/akorneta/orgs","repos_url":"https://api.github.com/users/akorneta/repos","events_url":"https://api.github.com/users/akorneta/events{/privacy}","received_events_url":"https://api.github.com/users/akorneta/received_events","type":"User","site_admin":false},"assignees":[{"login":"akorneta","id":12269156,"avatar_url":"https://avatars1.githubusercontent.com/u/12269156?v=4","gravatar_id":"","url":"https://api.github.com/users/akorneta","html_url":"https://github.com/akorneta","followers_url":"https://api.github.com/users/akorneta/followers","following_url":"https://api.github.com/users/akorneta/following{/other_user}","gists_url":"https://api.github.com/users/akorneta/gists{/gist_id}","starred_url":"https://api.github.com/users/akorneta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akorneta/subscriptions","organizations_url":"https://api.github.com/users/akorneta/orgs","repos_url":"https://api.github.com/users/akorneta/repos","events_url":"https://api.github.com/users/akorneta/events{/privacy}","received_events_url":"https://api.github.com/users/akorneta/received_events","type":"User","site_admin":false}],"milestone":null,"comments":26,"created_at":"2018-03-05T14:20:31Z","updated_at":"2018-03-19T20:01:33Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/eclipse/che/pulls/9016","html_url":"https://github.com/eclipse/che/pull/9016","diff_url":"https://github.com/eclipse/che/pull/9016.diff","patch_url":"https://github.com/eclipse/che/pull/9016.patch"},"body":"### What does this PR do?\r\nReplaces machine tokens with JWT tokens.\r\nRewrites `MachineLoginFilter` agents/server in accordance to token changes.\r\nRewrite go agents auth mechanism to use JWT.\r\nAdds signature keys manager, dao (generation of signature keys performs once on tomcat startup).\r\nVerification flow for agents changed, so now they do not need to request ws-master to verify tokens.\r\n\r\nSimplified interaction flow described in sequence diagram below:\r\n![machine auth 2](https://user-images.githubusercontent.com/12269156/37208949-01e106b2-23ac-11e8-9a78-5ea9d9c8cab6.png)\r\n\r\nNew tokens will be signed by `RSASSA-PKCS-v1_5` using `SHA-512` and for the initial stage, it won't be configurable. \r\nJWT will contain following data:\r\n```json\r\n#Header\r\n{\r\n  \"alg\": \"RS512\",\r\n  \"kind\": \"machine_token\"\r\n}\r\n# Payload\r\n{\r\n  \"wsid\": \"workspacekrh99xjenek3h571\",\r\n  \"uid\": \"b07e3a58-ed50-4a6e-be17-fcf49ff8b242\",\r\n  \"uname\": \"john\",\r\n  \"jti\": \"06c73349-2242-45f8-a94c-722e081bb6fd\"\r\n}\r\n# Signature\r\n{}\r\n```\r\n\r\n### What issues does this PR fix or reference?\r\n#7785 \r\n#9028\r\n#### Release Notes\r\nn/a"},"comment":{"url":"https://api.github.com/repos/eclipse/che/issues/comments/374351649","html_url":"https://github.com/eclipse/che/pull/9016#issuecomment-374351649","issue_url":"https://api.github.com/repos/eclipse/che/issues/9016","id":374351649,"user":{"login":"codenvy-ci","id":3472912,"avatar_url":"https://avatars2.githubusercontent.com/u/3472912?v=4","gravatar_id":"","url":"https://api.github.com/users/codenvy-ci","html_url":"https://github.com/codenvy-ci","followers_url":"https://api.github.com/users/codenvy-ci/followers","following_url":"https://api.github.com/users/codenvy-ci/following{/other_user}","gists_url":"https://api.github.com/users/codenvy-ci/gists{/gist_id}","starred_url":"https://api.github.com/users/codenvy-ci/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/codenvy-ci/subscriptions","organizations_url":"https://api.github.com/users/codenvy-ci/orgs","repos_url":"https://api.github.com/users/codenvy-ci/repos","events_url":"https://api.github.com/users/codenvy-ci/events{/privacy}","received_events_url":"https://api.github.com/users/codenvy-ci/received_events","type":"User","site_admin":false},"created_at":"2018-03-19T20:01:33Z","updated_at":"2018-03-19T20:01:33Z","author_association":"NONE","body":"ci-test build report:\n[Build details](https://ci.codenvycorp.com/job/che-pullrequests-test-ocp/66/)\n[Test report](https://ci.codenvycorp.com/job/che-pullrequests-test-ocp/66//Selenium_tests_report)\n[selenium tests report data](http://tests.codenvycorp.com/selenium_test_report_data/9016)\ndocker image: eclipseche/che-server:9016\nhttps://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.\n\n"}}
{"actor":{"display_login":"codenvy-ci"}}