Use Keyring to store Tokens

[Adam Young]

Tokens can be used more than juswt once, but right now, each CLI call fetches a new one. We can use Keyring to securely hold the token for a span of time and reduce the number of network round trips.

[Joseph Heck (heckj)]

tagged as blueprint, as this is more of a feature request and probably ought to be tracked by a blueprint

[Bhuvan Arumugam (bhuvan)]

Joe, Adam: Can you please let me know,
  a) a sample call to create token?
  b) a sample call to use/query for a token? I could retrieve token for a given user/tenant/service through curl. I'm looking for ways to retrieve the token, using a call. Looks like "token-get" call is broken due to bug 1002917.

I installed devstack and enabled keystone and nova services. I presume, i didn't execute any calls that would create a token. I could create user, tenant, service, etc.

bhuvan@ip-10-242-117-54:~/devstack$ keystone service-list
+----------------------------------+------+---------+-----------------------+
| id | name | type | description |
+----------------------------------+------+---------+-----------------------+
| b146be8e5e444baba5b6d7104202dc6a | nova | compute | nova compute --bhuvan |
+----------------------------------+------+---------+-----------------------+
bhuvan@ip-10-242-117-54:~/devstack$ keystone tenant-list
+----------------------------------+--------------------+---------+
| id | name | enabled |
+----------------------------------+--------------------+---------+
| 02567ee94440476c8a174d91dfab8ae4 | admin | True |
| 1aeadd69de0b4207abc6ea2a3b3c4add | demo | True |
| 2c87f15de45c43a59fa2fac677fe8927 | bhuvan | True |
| 7afb8ec155d64c79912ece6ca1933fea | service | True |
| e1ab0261462d4d0183d1c431d9222dde | invisible_to_admin | True |
+----------------------------------+--------------------+---------+

The "token" table doesn't have any records yet:

mysql> \r keystone
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Connection id: 83
Current database: keystone

mysql> desc token;
+---------+-------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+---------+-------------+------+-----+---------+-------+
| id | varchar(64) | NO | PRI | NULL | |
| expires | datetime | YES | | NULL | |
| extra | text | YES | | NULL | |
+---------+-------------+------+-----+---------+-------+
3 rows in set (0.00 sec)

mysql> select count(*) from token;
+----------+
| count(*) |
+----------+
| 0 |
+----------+
1 row in set (0.04 sec)

mysql>

[Guang Yee (guang-yee)]

https://review.openstack.org/#/c/15691/

I've added two more command line options

--no-keyring: do not use keyring
--force-new-token: request a new token and replace the one stored in keyring. This option is useful because Keystone stores token in KVS by default and it goes away when we bounce Keystone. This option will invalidate the one stored in keyring and replace it with the new one.