<div dir="ltr">We had a chance to discuss some of these use cases during our MVP call yesterday. Here is the updated list of uses cases:<br><br><div id="gmail-magicdomid29" class="gmail-"><span class="gmail-author-a-niz90zyz85zz83zz83zz82zz74z8z85z6z90zhz84zf">As an administrator, I can disable JWT token expiration. This configuration is in the settings file and is system-wide.</span></div><div id="gmail-magicdomid30" class="gmail-"></div><div id="gmail-magicdomid31" class="gmail-"><span class="gmail-author-a-niz90zyz85zz83zz83zz82zz74z8z85z6z90zhz84zf">As
an administrator, I can configure the JWT tokens to expire after a
configurable amount of time. This configuration is in the settings file
and is system-wide.</span></div><div id="gmail-magicdomid32" class="gmail-"></div><div id="gmail-magicdomid33" class="gmail-"><span class="gmail-author-a-niz90zyz85zz83zz83zz82zz74z8z85z6z90zhz84zf">The JWT shall have a username identifier</span></div><div id="gmail-magicdomid34" class="gmail-"></div><div id="gmail-magicdomid35" class="gmail-"><span class="gmail-author-a-niz90zyz85zz83zz83zz82zz74z8z85z6z90zhz84zf">As an API user, I can authenticate any API call (except to request a JWT) with a JWT.</span></div><div id="gmail-magicdomid36" class="gmail-"></div><div id="gmail-magicdomid37" class="gmail-"><span class="gmail-author-a-niz90zyz85zz83zz83zz82zz74z8z85z6z90zhz84zf">As an API user, I can invalidate all existing JWT tokens for a given user</span><span class="gmail-author-a-sz78z4z72z8z79zaxnsz66z2z77zz79zz74zn">.</span></div><div id="gmail-magicdomid38" class="gmail-"></div><div id="gmail-magicdomid39" class="gmail-"><span class="gmail-author-a-niz90zyz85zz83zz83zz82zz74z8z85z6z90zhz84zf">As an authenticated user, when deleting a user 'foo', all of user 'foo's</span><span class="gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z"> existing</span><span class="gmail-author-a-niz90zyz85zz83zz83zz82zz74z8z85z6z90zhz84zf"> JWTs are invalidated.</span></div><div id="gmail-magicdomid40" class="gmail-"></div><div id="gmail-magicdomid41" class="gmail-"><span class="gmail-author-a-niz90zyz85zz83zz83zz82zz74z8z85z6z90zhz84zf">As an autheticated use</span><span class="gmail-author-a-sz78z4z72z8z79zaxnsz66z2z77zz79zz74zn">r, I can invalidate a user's JWTs in the same operation as updating the password.</span></div><div id="gmail-magicdomid42" class="gmail-"></div><div id="gmail-magicdomid43" class="gmail-"><span class="gmail-author-a-niz90zyz85zz83zz83zz82zz74z8z85z6z90zhz84zf">As an un-authenticated user, I can obtain a JWT token by using a username and password.</span></div><div id="gmail-magicdomid44" class="gmail-"><br></div><div id="gmail-magicdomid44" class="gmail-">Let's polish them up on this email thread and then update the MVP wiki page. <br><br></div><div id="gmail-magicdomid44" class="gmail-">-Dennis<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, May 29, 2017 at 1:57 PM, Brian Bouterse <span dir="ltr"><<a href="mailto:bbouters@redhat.com" target="_blank">bbouters@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>We had a use case call which produced these use cases [0]. Then @fdobrovo investigated using the django-rest-framework-jwt [1] to fulfil those use cases and there are some small, but to fulfil the use cases written he had to write a good amount of code and maybe only used 50 or 100 lines of code actually from django-rest-framework-jwt.<br><br>Through a lot of back and forth on the issue [2], we did a gap analysis and considered different ways the use cases could be aligned with the functionality provided by the django-rest-framework. We came up with the following revised use cases related to JWT that are effectively the same and would allow the plugin code to be used mostly as-is:<br><br><div id="m_7221017809433058029gmail-magicdomid300" class="m_7221017809433058029gmail-ace-line"><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z">* As an administrator, I can disable JWT token expiration. This configuration is in the settings file and is system-wide.</span></div><div id="m_7221017809433058029gmail-magicdomid273" class="m_7221017809433058029gmail-ace-line"><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z">*
As an administrator, I can configure the JWT tokens to expire after a
configurable amount of time. This configuration is in the settings file
and is system-wide.</span></div><div id="m_7221017809433058029gmail-magicdomid8" class="m_7221017809433058029gmail-"><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z">* The JWT shall have a username identifier</span></div><div id="m_7221017809433058029gmail-magicdomid227" class="m_7221017809433058029gmail-ace-line"><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z">* As an API user, I can authenticate any API call (except to request a JWT) with a JWT.</span></div><div id="m_7221017809433058029gmail-magicdomid10" class="m_7221017809433058029gmail-"><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z">* As an API user, I can invalidate all JWT tokens for a given user</span></div><div id="m_7221017809433058029gmail-magicdomid11" class="m_7221017809433058029gmail-"><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z">* As an authenticated user, when deleting a user 'foo', all of user 'foo's JWTs are invalidated.</span></div><div id="m_7221017809433058029gmail-magicdomid268" class="m_7221017809433058029gmail-ace-line"><span class="m_7221017809433058029gmail-author-a-z71zz70zkz66zki3s0z75zz67z0rlz73zo">* As an </span><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z">un-</span><span class="m_7221017809433058029gmail-author-a-z71zz70zkz66zki3s0z75zz67z0rlz73zo">authenticated user, I can obtain </span><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z">a</span><span class="m_7221017809433058029gmail-author-a-z71zz70zkz66zki3s0z75zz67z0rlz73zo"> JWT token,</span><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z"> by passing a username and password via POST<br><br></span></div><div id="m_7221017809433058029gmail-magicdomid268" class="m_7221017809433058029gmail-ace-line"><span class="m_7221017809433058029gmail-author-a-4z69zz89z5nz73z6jk2g24z89zz85zz66z">Comments and questions are welcome here. I also hope to append this topic onto one of the upcoming, Tuesday use case calls. The next call May 30th is on the Status API and Alternate Content Sources so hopefully there will be enough time to revisit the JWT use cases then too or on a following call.<br></span></div></div><div><br>[0]: <a href="https://pulp.plan.io/projects/pulp/wiki/Pulp_3_Minimum_Viable_Product#Authentication" target="_blank">https://pulp.plan.io/projects/<wbr>pulp/wiki/Pulp_3_Minimum_<wbr>Viable_Product#Authentication</a><br>[1]: <a href="http://getblimp.github.io/django-rest-framework-jwt/" target="_blank">http://getblimp.github.io/<wbr>django-rest-framework-jwt/</a><br>[2]: <a href="https://pulp.plan.io/issues/2359" target="_blank">https://pulp.plan.io/issues/<wbr>2359</a><span class="HOEnZb"><font color="#888888"><br><br></font></span></div><span class="HOEnZb"><font color="#888888">-Brian<br></font></span></div>
<br>______________________________<wbr>_________________<br>
Pulp-dev mailing list<br>
<a href="mailto:Pulp-dev@redhat.com">Pulp-dev@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/pulp-dev" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/pulp-dev</a><br>
<br></blockquote></div><br></div>