<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 05/21/2014 10:48 AM, Michael Hearn
wrote:<br>
</div>
<blockquote
cite="mid:CAO1MeZhyW1+z0YMJVy=rVcCrKKd65KpU9TrKDA0WNFQV2cB1Dg@mail.gmail.com"
type="cite">
<div dir="ltr">Keystone gurus,<br>
<div>Can you help put me straight on expected Authentication
behaviour when using an LDAP identity backend.<br>
</div>
<div>In the scenario where a user is granted a token (<font
size="1">keystone token-get</font>) should they not be able
to make repeated API calls, e.g <font size="1"><i>glance
--os-auth-token xxxxxxx image-list </i></font> until the
token expires?<br>
<br>
</div>
<div>I ask as using <i>tcpdump</i> I am seeing AuthN traffic
between keystone and LDAP each time I execute an API call - a
call that includes an unexpired token. <br>
</div>
<div>I was assuming that by using an unexpired token a user
avoids having to make an AuthN call. Is that not the case? <br>
</div>
</div>
</blockquote>
<br>
The glance CLI does not cache the token. There was code in the
Keystone client to cache the token in python-keyring. If glance is
not honoring the --os-auth-token value then it might be going back
to keystone.<br>
<br>
However, if the token is a UUID token, then here is what happens:
user goes to Keystone, gets a token (uuid) , and passes that to
glance. Glance passes that back to Keystone and says "is this
valid" and keystone responds "yep, and here is the service
catalog." Glance now has the option of caching this response in
memcached. If it does not, it needs to go back to Keystone every
time.<br>
<br>
<br>
But...now I see below that you are using pki and memcached. Which
means something is not behaving. If glance honors the --debug flag,
you can see if the CLI is going to Keystone, or if it is the server.<br>
<br>
Curious.<br>
<br>
<blockquote
cite="mid:CAO1MeZhyW1+z0YMJVy=rVcCrKKd65KpU9TrKDA0WNFQV2cB1Dg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
</div>
<div>Cheers<br>
</div>
Mike.<br>
<br>
Am using icehouse with token format set to PKI , caching enabled
(memcached )</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Mailing list: <a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
Post to : <a class="moz-txt-link-abbreviated" href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a>
Unsubscribe : <a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
</pre>
</blockquote>
<br>
</body>
</html>