Re: [Architecture] [APIM] [3.0] JWT revocation for synapse gateway

2019-10-04 Thread Fazlan Nazeem
Hi Harsha, On Fri, Oct 4, 2019 at 12:45 PM Harsha Kumara wrote: > + I hope we only fetch tokens which aren't expired but revoked. > We will be fetching all tokens in the revoked table. Some can be expired when the fetching happens. We are planning to clean the expired revoked tokens from the

Re: [Architecture] [APIM] [3.0] JWT revocation for synapse gateway

2019-10-04 Thread Fazlan Nazeem
Hi Chamila, On Fri, Oct 4, 2019 at 12:28 PM Chamila Adhikarinayake wrote: > Hi > > I have a question regarding how this works on a distributed setup (say > Al-in-on Active-Active setup). If a revoke call is handled by one node, how > the other node's gateway gets this message? Does the

Re: [Architecture] [APIM] [3.0] JWT revocation for synapse gateway

2019-10-04 Thread Harsha Kumara
+ I hope we only fetch tokens which aren't expired but revoked. On Fri, Oct 4, 2019 at 12:41 PM Harsha Kumara wrote: > Will revoke endpoint called with same token trigger a revocation event? > This is because sometimes JMS subscription can be dropped. In case when > it's back we can try revoke

Re: [Architecture] [APIM] [3.0] JWT revocation for synapse gateway

2019-10-04 Thread Harsha Kumara
Will revoke endpoint called with same token trigger a revocation event? This is because sometimes JMS subscription can be dropped. In case when it's back we can try revoke with same token so it will reach the gateway. During implementation we can test this behavior. On Fri, Oct 4, 2019 at

Re: [Architecture] [APIM] [3.0] JWT revocation for synapse gateway

2019-10-04 Thread Chamila Adhikarinayake
Hi I have a question regarding how this works on a distributed setup (say Al-in-on Active-Active setup). If a revoke call is handled by one node, how the other node's gateway gets this message? Does the keymanager node has to publish the message to other node's topic when a revocation happens or

Re: [Architecture] [APIM] [3.0] JWT revocation for synapse gateway

2019-10-04 Thread Bhathiya Jayasekara
Looks* good. On Fri, Oct 4, 2019 at 11:25 AM Fazlan Nazeem wrote: > Hi all, > > We are working on supporting JWT revocation for synapse gateway. Please > note that the default token format for 3.0 synapse gateway is JWT. > > Please find the discussed design for this feature. > > [image:

[Architecture] [APIM] [3.0] JWT revocation for synapse gateway

2019-10-03 Thread Fazlan Nazeem
Hi all, We are working on supporting JWT revocation for synapse gateway. Please note that the default token format for 3.0 synapse gateway is JWT. Please find the discussed design for this feature. [image: JWT.jpg] In summary, we will be storing the revoked token signatures against the expiry