With fernet tokens, the expires ms value is 0 when the token is validated. So the 'expires' on the post token and the get token are different; this is not the case with uuid tokens.
$ curl -s \
-H "Content-Type: application/json" \
-d '{ "auth":{ "tenantName":"testTenantName", "passwordCredentials":{ "username":"testUserName", "password":"password" }}}' \
-X POST $KEYSTONE_ENDPOINT:5000/v2.0/tokens | python -mjson.tool
post token portion of the response contains 'expires' with a ms value :
"token": {
"audit_ids": [
"eZtfF60tR7y5oAuL4LSr4w"
],
"expires": "2015-05-28T20:50:56.015102Z",
"id": "gAAAAABVZ2OQu3OunvR6FKklDdNWj95Aq-ju_sIhB9o0KRin2SpLRUa0C3H_XiV_RWN409Ma-Q7lIkA_S6mY3bnxgboJZ_qxUiTdzUscG5y_fSCUW5sQqmB2AI1rlmMetvTl6AnnRKzVHVlJlDKQNHuk0MzHM3IVr4-ysJ2AHBtmDfkdpRZCrFo%3D",
"issued_at": "2015-05-28T18:50:56.015211Z",
"tenant": {
"description": "Test tenant ...",
"enabled": true,
"id": "1c6e0d2ac4bf4cd5bc7666d86b28aee0",
"name": "testTenantName",
"parent_id": null
}
},
If this token is validated, the expires ms now show as 000000Z
$ curl -s \
-H "Content-Type: application/json" \
-H "X-Auth-Token: $ADMIN_TOKEN" \
-X GET $KEYSTONE_ENDPOINT:35357/v2.0/tokens/$USER_TOKEN | python -mjson.tool
get token portion of the response contains 'expires' with ms = 000000Z
],
"token": {
"audit_ids": [
"lZwaM7oaShCZGQt0A9FaKA"
],
"expires": "2015-05-28T20:27:24.000000Z",
"id": "gAAAAABVZ14MKoaOBq4WBHaF1fqEKrN_nTrYYhwi8xrAisWmyJ52DJOrVlyxAoUuL_tfrGhslYVffRTosF5FqQVYlNq6hqU-qGzhueC4xVJZL8oitv0PfOdGfLgAWM1pciuiIdDLnWb-6oNrgZ9l1lHqn1kyuO0JVmS_YJfYI4YOt0o7ZfJhzFQ=",
"issued_at": "2015-05-28T18:27:24.000000Z",
"tenant": {
"description": "Test tenant ...",
"enabled": true,
"id": "1c6e0d2ac4bf4cd5bc7666d86b28aee0",
"name": "testTenantName",
"parent_id": null
}
},
The report is accurate, but the assertion about which timestamp is "correct" is actually backward from what was intended.
The value returned on validation is correct, whereas the value returned during token creation mistakenly includes a decimal. The decimal portion of the expiration is never actually stored as a float in the token, so it should not be rendered during token creation with a zero decimal either.