yahoo-eng-team team mailing list archive
-
yahoo-eng-team team
-
Mailing list archive
-
Message #40394
[Bug 1464377] Re: Keystone v2.0 api accepts tokens deleted with v3 api
[Expired for Keystone because there has been no activity for 60 days.]
** Changed in: keystone
Status: Incomplete => Expired
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1464377
Title:
Keystone v2.0 api accepts tokens deleted with v3 api
Status in Keystone:
Expired
Bug description:
Keystone tokens that are deleted using the v3 api are still accepted by
the v2 api. Steps to reproduce:
1. Request a scoped token as a member of a tenant.
2. Delete it using DELETE /v3/auth/tokens
3. Request the tenants you can access with GET v2.0/tenants
4. The token is accepted and keystone returns the list of tenants
The token was a PKI token. Admin tokens appear to be deleted correctly.
This could be a problem if a user's access needs to be revoked but they
are still able to access v2 functions.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1464377/+subscriptions