revocation list should not be a protected resource

[Morgan Fainberg]

The Revocation List resources should not be protected. The Revocation list is akin to a CRL and likely should be available for public consumption as a CRL would be.

Resources are:
v3: /auth/tokens/OS-PKI/revoked
v2: /tokens/revoked

[Adam Young (ayoung)]

Yes, but to expose it in its current form, it will leak tokens that, while revoked, might not yet be identified as such by a service. There will be a window in which a revoked token will be usable, and this open a security vulnerability.

We are goint to redo the revocation in Icehouse timeframe.

[Dolph Mathews (dolph)]

I agree with Adam - we could freely publish a revocation list of access tokens, but not bearer tokens. Revocation events (user_id + tenant_id + timestamp) or something similar *could* also be published for unauthenticated users.

[Dolph Mathews (dolph)]

Unassigning due to inactivity.