Sign out break long-runing Cinder backup (token revoked) (Glance snapshot also)

[Donagh McCabe]

If you initiate a long-running operation (such as a Cinder volume backup) and then sign out, the operation will fail. The reason it fails is that Cinder is using the token to authenticate it's requests with Swift. When you sign out, Horizon revokes the token. The next time Cinder attempts to PUT an object, it gets 401.

There may be better ways for Cinder/Glance to handle bearer tokens (e..g, trusts). Note, Cinder's behavior is similar to Glance (when used in multi-tenant backing store mode). IHowever, Cinder/Glance's behavior with long-running actions (or more specifically when they make multiple requests to Swift) pre-dates Horizon.

It would also break Swift static large object (SLO) downloads...though that will soon be fixed by a re-org of the pipeline.

(BTE: I fudged "the next time Cinder attempts o PUT" a bit; Swift caches the token for 10 minutes, so if all PUTs complete within 10 minutes, then you are ok)

[Matthias Runge (mrunge)]

I agree, this is an issue; sadly, Horizon can't do anything about it. The same situation happens, if the keystone token is revoked on the console.
And not revoking the token on log-out is not an option as well.

[Duncan Thomas (duncan-thomas)]

Why is not revoking the token not an option? Even if services move to bearer tokens, revoking the token can still race with the last few operations run before logging out if people click fast enough, so it seems like a quite fundamental bug?

[Gloria Gu (gloria-gu)]

I am still investigating the issue. Haven't thought through yet. But I think this bug is still valid.

if there is a long lasting task outstanding and user decides to logout...horizon should remind user that there is an task that is still running and takes some time to finish, it could give some options like

ask user to wait until the job is done
logout without revoking the token (if it is possible, how to revoke the token later?)
logout and abandon the task which could cause an error.

[Donagh McCabe (donagh-mccabe)]

What's the origin of the token revoke in Horizon? Was this done based on security review, or some other reason? Is there history (BP, bug, spec, etc) to explain the background? This would help our understanding.