yahoo-eng-team team mailing list archive
-
yahoo-eng-team team
-
Mailing list archive
-
Message #11665
[Bug 1292283] Re: revocation events: deleting a token revokes all tokens with same expiration
Added Horizon project to this bug as the solution should include both
keystone and horizon teams to determine the expected (and correct)
behavior going forward.
** Also affects: horizon
Importance: Undecided
Status: New
** Changed in: horizon
Status: New => Confirmed
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1292283
Title:
revocation events: deleting a token revokes all tokens with same
expiration
Status in OpenStack Dashboard (Horizon):
Confirmed
Status in OpenStack Identity (Keystone):
Triaged
Bug description:
As part of the design process for revocation events it was determined
that a mechanism to revoke all dependent tokens was needed. This
covers the case of revoking a token and ensuring all tokens that were
created from that token are also revoked.
To accomplish this, the revocation of a specific token is done by
expiration_time. The expiration_time attribute is never changed on
subsequent tokens. This means it is easy to ensure revocation of an
entire chain of tokens.
This poses an issue if any specific token (or all tokens that are a
child of a specific token) should be revoked, but the parent tokens
should not be revoked.
Use case:
Get Unscoped token
Get Scoped Token from Unscoped token
Get New Scoped Token
Revoke first unscoped token
Now all tokens (including the Unscoped token) are revoked because they share an expiration_time.
Likely there needs to be a solution that allows for revoking based
upon expiration_time and issued_at and one that revokes on
expiration_time alone. Revoking by expiration_time alone is API
incompatible with previous API mechanisms (both V2 and V3).
This is the reason bug https://bugs.launchpad.net/horizon/+bug/1291099
was identified.
To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1292283/+subscriptions
References