fmorg-git commented on PR #10742: URL: https://github.com/apache/ozone/pull/10742#issuecomment-5186601903
hi @fapifta - I have one main question and will repeat it: It appears that this design `borrows heavily` from the upcoming STS feature (using symmetric ManagedSecretKey for verification, verifying the token then checking ACL calls, including the signature and signingKeyId in the token itself, instead of STSTokenVerifier there is CustosTokenVerifier, have session-scoped tokens with expiration, etc). Would it be more reasonable to leverage the upcoming STS work and extend it for OIDC/JWT instead of implementing something else that is substantially similar? If the answer from the Ozone community is no, then that's the decision of the community. Other than that, I don't really have anything else to add here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
