yahoo-eng-team team mailing list archive

[Lance Bragstad <lbragstad@xxxxxxxxx>]

I've attempted to recreate this locally after we merged a fix [0] for a
similar bug [1]. I was not able to recreate this with the latest code in
master (eed29f236e251007093ae1fe29185eddbef8497d).

I'm going to close this, but feel free to continue using this report for
discussion as necessary.


[0] https://github.com/openstack/keystone/commit/a103486efeefca821ac722cbad6fc31b2e3f133b
[1] https://bugs.launchpad.net/keystone/+bug/1662514

** Changed in: keystone
       Status: In Progress => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1511775

Title:
  Revoking a role revokes the unscoped token for a user

Status in OpenStack Identity (keystone):
  Invalid

Bug description:
  In Juno and Kilo, when a role is revoked from a user on a project, a
  callback is triggered that invalidates all of that user's tokens.  I
  can see why we'd want to do that for scoped tokens. But by revoking
  the unscoped token as well, the user is forced to log out and log back
  in.  It seems like the unscoped token should be left alone, since
  revoking a role is an authorization change, and the unscoped token is
  an authentication issue.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1511775/+subscriptions