Deleting a role should revoke any tokens associated with it

[Henry Nash]

When we delete a role, we delete all the grants associated with it. Since this is a bit like an enforced revoking of user/groups grants, we should invalidate any tokens:

- for users that have had any grant using this role
- for users of any group that has had a grant using this role

[Lawrance (jing)]

mark

[Dolph Mathews (dolph)]

Is this still and issue?

[Henry Nash (henry-nash)]

Yes, the problem still exists - and is that delete_role is expanded out into the various removal of role assignments from the nest of metadata tables at the driver level, while our token deletion for a user is at the controller level...so need to refactor the code.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/46613

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/46613
Committed: http://github.com/openstack/keystone/commit/c80282c3bee1ed1ee2ac5f1a4a9e5b1f56d4e6d2
Submitter: Jenkins
Branch: master

commit c80282c3bee1ed1ee2ac5f1a4a9e5b1f56d4e6d2
Author: Henry Nash <email address hidden>
Date: Tue Sep 17 16:32:35 2013 +0100

    Ensure any relevant tokens are revoked when a role is deleted

    Add a controller class method to delete tokens for a role, along the
    lines of those that exist for deleting tokens for user and project. Ensure
    this is called for both the V2 and V3 delete_role APIs.

    Fixes bug 1153645

    Change-Id: I3c8d70eeb387a18c30df489142ea3aefc2224ae3