<div dir="ltr">This is a known limitation of the token backend and the token revocation list: we don't index tokens in the backend by roles (and we don't want to iterate the token table to find matching tokens).<div>
<br></div><div>However, if we land support for token revocation events [1] in the auth_token [2] middleware, we'll be able to deny tokens with invalid roles as they are presented to other services.</div><div><br></div>
<div>[1] <a href="https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-revoke-ext.md">https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-revoke-ext.md</a></div>
<div>[2] <a href="https://launchpad.net/keystonemiddleware">https://launchpad.net/keystonemiddleware</a></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jun 25, 2014 at 1:19 AM, Takashi Natsume <span dir="ltr"><<a href="mailto:natsume.takashi@lab.ntt.co.jp" target="_blank">natsume.takashi@lab.ntt.co.jp</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi all,<br>
<br>
When deleting role assignments, not only tokens that are related with<br>
deleted role assignments but also other tokens that the(same) user has are<br>
invalidated in stable/icehouse(2014.1.1).<br>
<br>
For example,<br>
A) Role assignment between domain and user by OS-INHERIT(*1)<br>
1. Assign a role(For example,'Member') between 'Domain1' and 'user' by<br>
OS-INHERIT<br>
2. Assign the role('Member') between 'Domain2' and 'user' by OS-INHERIT<br>
3. Get a token with specifying 'user' and 'Project1'(in 'Domain1')<br>
4. Get a token with specifying 'user' and 'Project2'(in 'Domain2')<br>
5. Create reources(For example, cinder volumes) in 'Project1' with the token<br>
that was gotten in "3."<br>
it is possible to create them.<br>
6. Create reources in 'Project2' with the token that was gotten in "4."<br>
it is possible to create them.<br>
7. Delete the role assignment between 'Domain1' and 'user' (that was added<br>
in "1.")<br>
<br>
(After validated token cache is expired in cinder, etc.)<br>
8. Create reources in 'Project1' with the token that was gotten in "3."<br>
it is not possible to create them. "401 Unauthorized."<br>
9. Create reources in 'Project2' with the token that was gotten in "4."<br>
it is not possible to create them. "401 Unauthorized."<br>
<br>
In "9.", my expectation is that it is possible to create resources with the<br>
token that was gotten in "4.".<br>
<br>
*1:<br>
v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_<br>
to_projects<br>
<br>
B) Role assignment between project and user<br>
1. Assign a role(For example,'Member') between 'Project1' and 'user'<br>
2. Assign the role('Member') between 'Project2' and 'user'<br>
3. Get a token with specifying 'user' and 'Project1'<br>
4. Get a token with specifying 'user' and 'Project2'<br>
5. Create reources(For example, cinder volumes) in 'Project1' with the token<br>
that was gotten in "3."<br>
it is possible to create them.<br>
6. Create reources in 'Project2' with the token that was gotten in "4."<br>
it is possible to create them.<br>
7. Delete the role assignment between 'Project1' and 'user' (that was added<br>
in "1.")<br>
<br>
(After validated token cache is expired in cinder, etc.)<br>
8. Create reources in 'Project1' with the token that was gotten in "3."<br>
it is not possible to create them. "401 Unauthorized."<br>
9. Create reources in 'Project2' with the token that was gotten in "4."<br>
it is not possible to create them. "401 Unauthorized."<br>
<br>
In "9.", my expectation is that it is possible to create resources with the<br>
token that was gotten in "4.".<br>
<br>
<br>
Are these bugs?<br>
Or are there any reasons to implement these ways?<br>
<br>
Regards,<br>
Takashi Natsume<br>
NTT Software Innovation Center<br>
Tel: +81-422-59-4399<br>
E-mail: <a href="mailto:natsume.takashi@lab.ntt.co.jp">natsume.takashi@lab.ntt.co.jp</a><br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote></div><br></div>