Token is not revoked after logout in Fuel UI

[Łukasz Oleś]

In 5.1 release access control was introduced for Fuel master node. Keystone is used for authentication. When user is using Fuel UI, he need to provide user name and password and he gets authorization token which allows him to use Fuel UI.
When user presses logout link his token is cleared from cache, but is not deleted.
Is token somehow was stolen it can be used until it's not expired.

Proposed solution:
When user logout his token should be revoked. If for some reason keystone is not accessible at this moment, there shouldn't be an any error.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/125933

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/125933
Committed: https://git.openstack.org/cgit/stackforge/fuel-web/commit/?id=1b8b0f92448c7d630eed0ff69146e7befc772fc2
Submitter: Jenkins
Branch: master

commit 1b8b0f92448c7d630eed0ff69146e7befc772fc2
Author: Przemyslaw Kaminski <email address hidden>
Date: Fri Oct 3 13:22:35 2014 +0200

    Revoke token from keystone after user logout

    Also, add test_login_logout.js

    Change-Id: Ibf1660624d3441c249b319fa69eb3775c9716b9c
    Closes-Bug: #1375622

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/5.1
Review: https://review.openstack.org/127234

[OpenStack Infra (hudson-openstack)]

Change abandoned by Przemyslaw Kaminski (<email address hidden>) on branch: stable/5.1
Review: https://review.openstack.org/127234

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/5.1
Review: https://review.openstack.org/127497

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/127497
Committed: https://git.openstack.org/cgit/stackforge/fuel-web/commit/?id=486b94c62792173ced2ade19b8d80c7903dcfceb
Submitter: Jenkins
Branch: stable/5.1

commit 486b94c62792173ced2ade19b8d80c7903dcfceb
Author: Przemyslaw Kaminski <email address hidden>
Date: Fri Oct 3 13:22:35 2014 +0200

    Revoke token from keystone after user logout

    Also, add test_login_logout.js

    Change-Id: Ibf1660624d3441c249b319fa69eb3775c9716b9c
    Closes-Bug: #1375622
    (cherry picked from commit 1b8b0f92448c7d630eed0ff69146e7befc772fc2)

[Atze de Vries (atze-devries)]

Is there i work arround for this? I can't login to the fuel-web.

[Przemyslaw Kaminski (pkaminski)]

Could you provide more information on how you can't login to fuel-web?

[Atze de Vries (atze-devries)]

Sorry, neglect my question.. It seemed like the same issue but the issue was a full drive..

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/131079
Committed: https://git.openstack.org/cgit/stackforge/fuel-web/commit/?id=d8d9d96608f759d765ec0b1016e7363229ffc35a
Submitter: Jenkins
Branch: master

commit d8d9d96608f759d765ec0b1016e7363229ffc35a
Author: Przemyslaw Kaminski <email address hidden>
Date: Tue Oct 28 10:12:37 2014 +0100

    Fix KeystoneClient issue when token was expired

    KeystoneClient should always first try to use username/password and only if
    they are not provided, do a fallback to this.token. Otherwise for expired
    tokens login is not possible.

    Related-Bug: #1375622
    Change-Id: Ia85278402799d7d19e0c0aee975cc986de5879f9

[Vitaly Kramskikh (vkramskikh)]

Reduced priority as partial fix was merged. Now UI is not blocked, but it only shows login page after first page change.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/131522

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/5.1
Review: https://review.openstack.org/132221

[OpenStack Infra (hudson-openstack)]

Change abandoned by Przemyslaw Kaminski (<email address hidden>) on branch: stable/5.1
Review: https://review.openstack.org/132221
Reason: Wrong Change-Id, created new review

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/5.1
Review: https://review.openstack.org/132285

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/132285
Committed: https://git.openstack.org/cgit/stackforge/fuel-web/commit/?id=175bc01373d4ebb9bf88cfb775d0a8230964ec47
Submitter: Jenkins
Branch: stable/5.1

commit 175bc01373d4ebb9bf88cfb775d0a8230964ec47
Author: Przemyslaw Kaminski <email address hidden>
Date: Tue Oct 28 10:12:37 2014 +0100

    Fix KeystoneClient issue when token was expired

    KeystoneClient should always first try to use username/password and only if
    they are not provided, do a fallback to this.token. Otherwise for expired
    tokens login is not possible.

    Related-Bug: #1375622
    (cherry picked from commit d8d9d96608f759d765ec0b1016e7363229ffc35a)

    Change-Id: Ia85278402799d7d19e0c0aee975cc986de5879f9