Open Stack

I agree, precedent is for this to be documented as current behavior with
known workarounds.

-- 
You received this bug notification because you are a member of OpenStack
Security, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1434034

Title:
  Disabling users & groups may not invalidate previously-issued tokens

Status in OpenStack Identity (Keystone):
  In Progress
Status in Keystone juno series:
  In Progress
Status in OpenStack Security Advisories:
  Won't Fix
Status in OpenStack Security Notes:
  Confirmed

Bug description:
  Even if the user is disabled, can use the last token is validated.

  0. user foo is enable
  1. get token (a)
  2. user foo  is disabled
  3. foo can still use any APIs by token(a)

  that's all.
  This issue is not cache process.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1434034/+subscriptions