<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hello,<div><br></div><div>[moving on the public mailing list since this bug is anyway public]</div><div><br></div><div><div><div>On 3 Jun 2013, at 17:25, Dolph Mathews <<a href="mailto:dolph.mathews@gmail.com">dolph.mathews@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">Apologies for the delayed response on this. We have several related open bugs and I wanted to investigate them all at once, and perhaps fix them all in one pass.<div style="">Disabling a tenant/project should result in existing tokens scoped to that tenant/project being immediately invalidated, so I think Chmouel's analysis is absolutely valid.</div><div style="">Regarding "list_users_in_project" -- as Guang suggested, the semantics of that call are inherently complicated, </div></div></blockquote><div><br></div><div><br></div><div><div>looking into this it seems that we have already such function :</div><div><br></div><div><a href="https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql.py#L608">https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql.py#L608</a></div><div><br></div><div>Should it get fixed?</div></div><br><blockquote type="cite"><div dir="ltr"><div style="">so ideally we can just ask the token driver to revoke tokens with some context (a user OR a tenant OR a user+tenant combination). We've been going down that direction, but have been incredibly inconsistent in how it's utilized. I'd like to have a framework to consistently apply the consequences of disabling/deleting any entity in the system.</div>
</div><div class="gmail_extra"><br clear="all"></div></blockquote><div><br></div><div>agreed, I think this should be doable if we can modify :</div><div><br></div><div><a href="https://github.com/openstack/keystone/blob/master/keystone/token/core.py#L169">https://github.com/openstack/keystone/blob/master/keystone/token/core.py#L169</a></div><div><br></div><div>changing the default user_id to None</div><div><br></div><div>as for the getting the tokens for a specify project/tenant if we are not using a list_users_in_project would that mean we need to parse all the tokens to get the metadatas/extras tenant_id or there is some more efficient ways?</div><div><br></div><div>Chmouel.</div><br><blockquote type="cite"><div class="gmail_extra"><div><div><br></div>-Dolph</div>
<br><br><div class="gmail_quote">On Wed, May 29, 2013 at 9:59 AM, Yee, Guang <span dir="ltr"><<a href="mailto:guang.yee@hp.com" target="_blank">guang.yee@hp.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Users does not really belong to a project. They have access to, or associated with, a project via role grant(s). Therefore, when disabling a project, we should only invalidate the tokens scoped to that project. But yes, you should be able to use the same code to invalidate the tokens when disabling a project.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><a href="https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L164" target="_blank">https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L164</a><u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">We have to be careful with list_users_in_project as user can associate with project with either direct role grant, or indirectly via group membership and group grant. This is going to get complicated with the addition of inherited role grants.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Guang<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Chmouel Boudjnah [mailto:<a href="mailto:chmouel@enovance.com" target="_blank">chmouel@enovance.com</a>] <br>
<b>Sent:</b> Wednesday, May 29, 2013 2:23 AM<br><b>To:</b> Adam Young; Dolph Mathews; Henry Nash; Joseph Heck; Yee, Guang; <a href="mailto:dev@enovance.com" target="_blank">dev@enovance.com</a><br><b>Subject:</b> disabling a tenant still allow user token<u></u><u></u></span></p>
</div><div><div class="h5"><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Hi,<br><br>Apologies for the direct email but I will be happy to move this on openstack-dev@ before to make sure it's not security involved.<br>
<br>I'd like to bring you this bug :<br><br><a href="https://bugs.launchpad.net/keystone/+bug/1179955" target="_blank">https://bugs.launchpad.net/keystone/+bug/1179955</a><br><br>to your attention.<br><br>Basically for the TL;DR when disabling a tenant don't disable the tokens of the user attached to it. <br>
<br>We could probably do that :<br><br><a href="https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L164" target="_blank">https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L164</a><br>
<br>when updating a tenant. but I need to find a way to list users attached to a tenant (without having to list all the users).<br><br>not being able to list_users_in_project() is it something intended by keystone?<br><br>
Do you see a workaround for how to delete tokens of all users belonging to a tenants?<br><br>Let me know what do you think.<br><br>Cheers,<br>Chmouel.<u></u><u></u></p></div></div></div></blockquote></div><br></div>
</blockquote></div><br></div></body></html>