958462 - Add tokenserver support for BrowserID "generation numbers"

Status: VERIFIED FIXED

(Cloud Services Graveyard :: Server: Token, defect)

Description

[Ryan Kelly [:rfkelly]]

The speed up the propagation of password changes, the FxA server will include a "generation number" in all identity certificates that it issues.  This is an integer that will increase monotonically with each change of the user's password.

Tokenserver needs to remember a high-water-mark for this value, and reject assertions with lower generation numbers.  Docs update forthcoming, implementation next week.

Comment 1

[Ryan Kelly [:rfkelly]]

Attachment: tokenserver-generations.diff

This adds a description of generation-number-checking to the tokenserver flow document, and a dedicated error status so that clients can detect it easily.  It's using the generalized cornice error format discussed in Bug 792674.

I also went ahead and added a dedicated status for "bad timestamp" per https://github.com/mozilla-services/tokenserver/issues/17

Comment 2

[Toby Elliott [:telliott]]

Comment on attachment 8358335 [details] [diff] [review]
tokenserver-generations.diff

Review of attachment 8358335 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good. My only suggestion would be to remove the 'monotonically' from the generation number. It's not really meaningful there. The number is guaranteed to be greater than the previous number, but it doesn't have to be one greater (even if it likely is).

Comment 3

[Ryan Kelly [:rfkelly]]

Docs change committed in https://github.com/mozilla-services/docs/commit/ad2f3e5f9affc08ee78752665151e3b3885cccbd

Implementation forthcoming.

Comment 4

[Ryan Kelly [:rfkelly]]

This has landed in tokenserver master.  It will be transparent to client code, as generation numbers are produced automatically by the FxA server.

Comment 5

[James Bonacci [:jbonacci]]

OK.

Comment 6

[Ryan Kelly [:rfkelly]]

Comment on attachment 8358335 [details] [diff] [review]
tokenserver-generations.diff

clearing stale review, this is already landed