<div dir="ltr"><div><div><br></div>The auth_token middleware changed recently[1] to check if tokens retrieved from the cache are expired based on the expiration time in the token. The unit tests for Blazar, Ceilometer, and Ironic are all using a copy-pasted fake memcache implementation that's supposed to simulate what auth_token stores in the cache, but the tokens that it had stored weren't valid. Tokens have an expiration time in them and these ones didn't. I don't think that it's safe for test code to make assumptions about how the auth_token middleware is going to store data in its cache. The format of the cached data isn't part of the public interface. It's changed before, when expiration times changed from *nix timestamps to iso 8601 formatted dates.<br>
<br></div>After looking at this, I proposed a couple of changes to the auth_token middleware. One is to have auth_token use the expiration time it has cached and fail the auth request if the token is expired according to the cache. It doesn't have to check the token's expiration time because it was stored as part of the cache data. The other is to make cached token handling more efficient by not checking the token expiration time if the token was cached.<br>
<div><br>[1] <a href="http://git.openstack.org/cgit/openstack/python-keystoneclient/commit/keystoneclient/middleware/auth_token.py?id=8574256f9342faeba2ce64080ab5190023524e0a">http://git.openstack.org/cgit/openstack/python-keystoneclient/commit/keystoneclient/middleware/auth_token.py?id=8574256f9342faeba2ce64080ab5190023524e0a</a><br>
<div>[2] <a href="https://review.openstack.org/#/c/96786/">https://review.openstack.org/#/c/96786/</a><br><br></div><div>- Brant<br></div><div><br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Fri, May 30, 2014 at 7:11 AM, Sylvain Bauza <span dir="ltr"><<a href="mailto:sbauza@redhat.com" target="_blank">sbauza@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div>Le 30/05/2014 14:07, Dina Belova a
écrit :<br>
</div><div class="">
<blockquote type="cite">
<div dir="ltr">I did not look close to this concrete issue, but in
the ceilometer there is almost the same thing: <a href="https://bugs.launchpad.net/ceilometer/+bug/1324885" target="_blank">https://bugs.launchpad.net/ceilometer/+bug/1324885</a>
and fixes were already provided.
<div>
<br>
</div>
<div>Will this help Blazar?</div>
<div><br>
</div>
</div>
</blockquote>
<br></div>
Got the Ironic patch as well : <br>
<br>
<a href="https://review.openstack.org/#/c/96576/1/ironic/tests/api/utils.py" target="_blank">https://review.openstack.org/#/c/96576/1/ironic/tests/api/utils.py</a><br>
<br>
Will provide a patch against Blazar.<br>
<br>
Btw, I'll close the bug.<div class=""><br>
<br>
<blockquote type="cite">
<div dir="ltr">
<div>-- Dina</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Fri, May 30, 2014 at 4:00 PM,
Sylvain Bauza <span dir="ltr"><<a href="mailto:sbauza@redhat.com" target="_blank">sbauza@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi
Keystone developers,<br>
<br>
I just opened a bug [1] because Ironic and Blazar (ex.
Climate) patches<br>
are failing due to a new release in Keystone client which
seems to<br>
regress on midleware auth.<br>
<br>
Do you have any ideas on if it's quick to fix, or shall I
provide a<br>
patch to openstack/global-requirements.txt to only accept
keystoneclient<br>
< 0.9.0 ?<br>
<br>
Thanks,<br>
-Sylvain<br>
<br>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<p style="font-size:small;margin:0px;font-family:Helvetica">
Best regards,</p>
<p style="font-size:small;margin:0px;font-family:Helvetica">Dina
Belova</p>
<p style="font-size:small;margin:0px;font-family:Helvetica">Software
Engineer</p>
<p style="font-size:small;margin:0px;font-family:Helvetica">
Mirantis Inc.</p>
</div>
</div>
</div>
</blockquote>
<br>
</div></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>