Add audit ids to tokens

[OpenStack Infra]

https://review.openstack.org/114306
commit 56527ee6575455ab664c3b7b247ef3db62cc2719
Author: Morgan Fainberg <email address hidden>
Date: Thu Aug 14 11:00:36 2014 -0700

    Add audit ids to tokens

    Add audit identifiers to each token. If the token is a rescoped token
    the audit identifier will be a list where index 0 being the token's
    audit id and index 1 is the initial token in the chain's audit_id.

    If the token is not rescoped, the token's audit_ids will only contain
    the audit_id of the token itself (at index 0).

    This change is to resolve a method of performing token revocations
    on individual tokens without needing to rely on the low
    resolution of token expires time.

    DocImpact

    Change-Id: If5fdf187bd525f273281f9fdf53bdc8865164289
    bp: non-persistent-tokens

[Joseph Robinson (joseph-r-email)]

Review at https://review.openstack.org/#/c/114306/ has closed the Audit Identifiers bug reported here.

[Andreas Jaeger (jaegerandi)]

Joseph, 114306 is the bug that opened this, so let me reopen...

[Tom Fifield (fifieldt)]

To fix this, we need to write something more generally about auditing. Tagging sec-guide,.

[Lana (loquacity)]

Looking through the original patch (https://review.openstack.org/#/c/114306/ See Anne's question and Morgan's reply on patchset 3), and the current documentation for keystone tokens (http://docs.openstack.org/admin-guide/identity-tokens.html and http://docs.openstack.org/security-guide/identity/tokens.html) I can't see a good place to add a line about auditing, or even determine what that information should be. I'm happy to have this bug reopened with more information, but for now I think the documentation is as complete as it can be on this topic at this time.