openstack team mailing list archive
Mailing list archive
Re: [keystone] Why are we returing such a big payload in validate token?
On 01/31/2013 07:44 PM, Ali, Haneef wrote:
As of now v3 validateToken response has "tokens, service catalog,
users, project , roles and domains. (i.e) Except for groups we are
returning everything. We also discussed about the possibility of 100s
of endpoints. ValidateToken is supposed to be a high frequency call .
Validate token should not going be a high frequency call. The
information is encapsulated inside the signed token for just that reason.
I would agree with the sentiment, however, that we are cramming a lot of
info into the token. TOkens should be scoped much, much more finely: by
default one service or endpoint, and one tenant.
The only thing that should require the full service catalog is the
initial request of an unsigned token, and that should merely go back to
going to be a huge performance impact . What is the use case for such
a big payload when compared with v2?
If a service needs catalog , then the service can always ask for the
Mailing list: https://launchpad.net/~openstack
Post to : openstack@xxxxxxxxxxxxxxxxxxx
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp