Keystone PKI token length hits cookie size limit

[Gabriel Hurley]

When Keystone's PKI tokens are enabled the length of the token itself is 3.95kb, nearly exceeding the cookie size limit without any additional data. This makes PKI tokens incompatible with the cookie session backend in Horizon. We need a way to detect/configure support for this so it doesn't bite users in unexpected ways.

[Gabriel Hurley (gabriel-hurley)]

I'm adding Keystone to this just to make sure that the impact of the change from UUID to PKI tokens by default in Keystone gets tracked.

Thus far, the discussion on resolving this is tending towards enabling token handling via the hash of the token rather than/in addition to the full PKI-signed token ID.

[Gabriel Hurley (gabriel-hurley)]

It turns out that Keystone already supports handling PKI-signed tokens via the MD5 hash but only for the SQL token backend. The work to add it to the KVS token backend will be tracked here: https://bugs.launchpad.net/keystone/+bug/1073272

Once that's in there, then Horizon can switch to using the MD5 of the token instead of the full token.

[Adam Young (ayoung)]

Work is being done in https://review.openstack.org/#/c/15116/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/15316

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/15316
Committed: http://github.com/openstack/horizon/commit/c61c5e28cc629c65166bcff2d974a622310f32b5
Submitter: Jenkins
Branch: master

commit c61c5e28cc629c65166bcff2d974a622310f32b5
Author: Gabriel Hurley <email address hidden>
Date: Fri Nov 2 15:10:43 2012 -0700

    Enforce use of latest django_openstack_auth for PKI compat.

    The latest django_openstack_auth supports PKI-signed tokens by
    using Keystone's "is_ans1_token" function to determine if PKI
    tokens are in use and react approriately if so.

    Fixes bug 1071865

    Change-Id: I62ba6370de829345d3214d80011a58e4ac6cd218