auth: a new option for configuring TTL of jwt tokens

[mitake]

This commit adds a new option of --auth-token, ttl, for configuring
TTL of jwt tokens. It can be specified like this:

--auth-token jwt,pub-key=<pub key path>,priv-key=<priv key path>,sign-method=<sign method>,ttl=5m

In the above case, TTL will be 5 minutes.

/cc @fanminshi

[mitake]

/cc @vedant15 this PR adds the functionality for configuring TTL of jwt tokens. Unlike simple tokens, jwt tokens' TTL won't be extended by RPCs so clients need to retry after the expiration.

[heyitsanthony]

@mitake will the client automatically acquire a new JWT token if the current one expires?

Also, this probably needs a test case; I can't find where exp is being checked against the current time (jwt-go seems to be capable of verifying exp conforms with the RFC, but it doesn't check the time)...

[mitake]

@heyitsanthony yes, clientv3.newAuthRetryWrapper() does the retry. And sure I'll add a test case.

jwt-go checks the expiration with this flow Parser.Parse() -> Parser.ParseWithClaims() -> Claims.Valid() (in the case of etcd, MapClaims.Valid()) -> MapClaims.VerifyExpireAt() with a return value of TimeFunc(). The TimeFunc() is time.Now() in default.

[gyuho]

@mitake Do we want to include this in 3.3? Otherwise, we can move this to 3.4. Thanks.

[mitake]

@gyuho I think it is not an emergent stuff so moving to 3.4 is ok.

[mitake]

@gyuho updated for an e2e test case, could you take a look?

[mitake]

rebased on the latest master

[gyuho]

So, if no TTL given, does this defaults to 5-min? Is there any specific reason?

[mitake]

No specific reason for now. If you think we should change, please let me know.

[gyuho]

Would it be breaking change, if previous behavior is auth token never expires? I am ok with either way.

Maybe highlight this change more loud around configuration.md and etcdmain/help.go?

[mitake]

It isn't a breaking change. clientv3 automatically refresh the expired token so existing etcd users won't be aware about this change. It is ensured in the test https://github.com/coreos/etcd/pull/8302/files#diff-4e20b6b68ada25d636aa265f49dcfa19

[gyuho]

Oh, it will be just assigned a new token. Makes sense.

[gyuho]

lgtm on test passes.