Comment 2 for bug 1193221

Apologies, I did mean to respond earlier. It looks like you're using PKI tokens, which can be validated offline on the nova side. I'm not clear on whether the token was still valid or not, but the token revocation list would have been cached by nova before the token was revoked/expired, so I don't see any unexpected behavior here. Both the token's expiration, the frequency of calls to get token revocation lists can both be configured if the default values aren't suitable for your deployment.