PKI support breaks memcache token backend

[Devin Carlen]

When using PKI support, the memcache backend breaks. It appears to be attempting to place the entire token as the key?

(root): 2013-02-08 01:14:03,404 ERROR wsgi __call__ Key length is > 250
Traceback (most recent call last):
  File "/opt/stack/keystone/keystone/common/wsgi.py", line 228, in __call__
    result = method(context, **params)
  File "/opt/stack/keystone/keystone/token/controllers.py", line 470, in validate_token
    token_ref = self._get_token_ref(context, token_id, belongs_to)
  File "/opt/stack/keystone/keystone/token/controllers.py", line 432, in _get_token_ref
    self.assert_admin(context)
  File "/opt/stack/keystone/keystone/common/wsgi.py", line 261, in assert_admin
    context=context, token_id=context['token_id'])
  File "/opt/stack/keystone/keystone/common/manager.py", line 47, in _wrapper
    return f(*args, **kw)
  File "/opt/stack/keystone/keystone/token/backends/memcache.py", line 58, in get_token
    token = self.client.get(ptk)
  File "/usr/lib/python2.7/dist-packages/memcache.py", line 862, in get
    return self._get('get', key)
  File "/usr/lib/python2.7/dist-packages/memcache.py", line 813, in _get
    self.check_key(key)
  File "/usr/lib/python2.7/dist-packages/memcache.py", line 1023, in check_key
    % self.server_max_key_length)
MemcachedKeyLengthError: Key length is > 250

[Davanum Srinivas (DIMS) (dims-v)]

Looks like we need something similar to this here as well - https://review.openstack.org/#/c/15116/

[Mehdi Abaakouk (sileht)]

I'm using keystone 2013.1~rc1 and I have the same king of backtrace:

Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/keystone/common/wsgi.py", line 236, in __call__
    result = method(context, **params)
  File "/usr/lib/python2.7/dist-packages/keystone/token/controllers.py", line 142, in authenticate
    token_id=token_id)
  File "/usr/lib/python2.7/dist-packages/keystone/common/manager.py", line 47, in _wrapper
    return f(*args, **kw)
  File "/usr/lib/python2.7/dist-packages/keystone/token/backends/memcache.py", line 58, in get_token
    token = self.client.get(ptk)
  File "/usr/lib/python2.7/dist-packages/memcache.py", line 862, in get
    return self._get('get', key)
  File "/usr/lib/python2.7/dist-packages/memcache.py", line 813, in _get
    self.check_key(key)
  File "/usr/lib/python2.7/dist-packages/memcache.py", line 1023, in check_key
    % self.server_max_key_length)
MemcachedKeyLengthError: Key length is > 250

[Adam Young (ayoung)]

The logic from https://review.openstack.org/#/c/15116/ is already performed in the memcached backend.

In line
https://github.com/openstack/keystone/blob/master/keystone/token/backends/memcache.py#L66

the call to token.unique_id(token_id) performs the hash function. but looks like it was missed on the get function.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/25537

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/25537
Committed: http://github.com/openstack/keystone/commit/a62d3afae43ebe191fe86f8d1ebed3e8bfaeba17
Submitter: Jenkins
Branch: master

commit a62d3afae43ebe191fe86f8d1ebed3e8bfaeba17
Author: Adam Young <email address hidden>
Date: Wed Mar 27 12:10:08 2013 -0400

    Fix token ids for memcached

    Bug 1119641

    Change-Id: Ia22764acc69a272b37364193d10c553a48679b9a

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/grizzly
Review: https://review.openstack.org/27979

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/27979
Committed: http://github.com/openstack/keystone/commit/2b5b24ed833ad32e78a72ebd421ec2607a0d375b
Submitter: Jenkins
Branch: stable/grizzly

commit 2b5b24ed833ad32e78a72ebd421ec2607a0d375b
Author: Adam Young <email address hidden>
Date: Wed Mar 27 12:10:08 2013 -0400

    Fix token ids for memcached

    Bug 1119641

    Change-Id: Ia22764acc69a272b37364193d10c553a48679b9a
    (cherry picked from commit a62d3afae43ebe191fe86f8d1ebed3e8bfaeba17)

[Sam Morrison (sorrison)]

This also affects the auth_token middleware in keystoneclient

[Adam Young (ayoung)]

If it does it is a different problem. This was an error storing tokens and was specific to the memcached backend.