keystone.cmd.doctor.tokens_fernet module

keystone.cmd.doctor.tokens_fernet.symptom_keys_in_Fernet_key_repository()

Fernet key repository is empty.

After configuring keystone to use the Fernet token provider, you should use keystone-manage fernet_setup to initially populate your key repository with keys, and periodically rotate your keys with keystone-manage fernet_rotate.

keystone.cmd.doctor.tokens_fernet.symptom_usability_of_Fernet_key_repository()

Fernet key repository is not setup correctly.

The Fernet key repository is expected to be readable by the user running keystone, but not world-readable, because it contains security-sensitive secrets.