Role revocation invalidates tokens on all user projects

[Alexander Makarov]

Keystone invalidates every token for a user after changing its roles within one project.
This was reported by Horizon team, here are related bugs:
- https://bugs.launchpad.net/mos/+bug/1393732
- https://bugs.launchpad.net/horizon/+bug/1252341

After some debugging I discovered, that it looks like revocation extension bug:

I added this test case to tests.test_v3_auth.TestTokenRevokeById

http://paste.openstack.org/show/149939/

It assigns role to user on 2 different project, authorizes user on those projects, revokes the role from one of the projects.
Token to the other, "intact" project, seizes to validate.

Further investigation gave me that token is not deleted, but a revocation event created matching both tokens.

[Alexander Makarov (amakarov)]

Just after deleting assignment 3 events are created (why not 1?):

Other project: 2bfd2684ec6f4c9abe0625c46ae66e13
Project: ba60d9c3c10c41e3a19c6ee8dcce4096
{'access_token_id': None,
 'audit_chain_id': None,
 'audit_id': None,
 'consumer_id': None,
 'domain_id': None,
 'domain_scope_id': None,
 'expires_at': None,
 'issued_before': datetime.datetime(2014, 12, 12, 15, 36, 41, 275441),
 'project_id': 'ba60d9c3c10c41e3a19c6ee8dcce4096',
 'revoked_at': datetime.datetime(2014, 12, 12, 15, 36, 41, 275441),
 'role_id': '9edfd58adf244f1c8bbba89f477aea4f',
 'trust_id': None,
 'user_id': '0d361672da5547c89aee38035a2875ff'}
{'access_token_id': None,
 'audit_chain_id': None,
 'audit_id': None,
 'consumer_id': None,
 'domain_id': None,
 'domain_scope_id': None,
 'expires_at': None,
 'issued_before': datetime.datetime(2014, 12, 12, 15, 36, 41, 278620),
 'project_id': None,
 'revoked_at': datetime.datetime(2014, 12, 12, 15, 36, 41, 278620),
 'role_id': None,
 'trust_id': None,
 'user_id': '0d361672da5547c89aee38035a2875ff'}
{'access_token_id': None,
 'audit_chain_id': None,
 'audit_id': None,
 'consumer_id': None,
 'domain_id': None,
 'domain_scope_id': None,
 'expires_at': None,
 'issued_before': datetime.datetime(2014, 12, 12, 15, 36, 41, 279114),
 'project_id': None,
 'revoked_at': datetime.datetime(2014, 12, 12, 15, 36, 41, 279114),
 'role_id': None,
 'trust_id': None,
 'user_id': '0d361672da5547c89aee38035a2875ff'}

[Alexander Makarov (amakarov)]

Moreover, if the user belongs to the group which role to any project is removed, then all user's tokens, created before are considered revoked.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/142099

[Lance Bragstad (lbragstad)]

Proposed the test case that was provided to review. Depending on the fix, the test should be refactored. I was able to recreate this.

[Alexander Makarov (amakarov)]

@Lance, looks like I wrote incorrect commit message here: https://review.openstack.org/#/c/141397/
It contains quick&dirty solution, so WIP for now :)

[Lance Bragstad (lbragstad)]

Ah, I didn't see that. Not sure why that didn't get picked up in the bug report?

[Lance Bragstad (lbragstad)]

Either patch works for me. I at least wanted to get something pushed up that exposed the bug initially.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Lance Bragstad (<email address hidden>) on branch: master
Review: https://review.openstack.org/142099
Reason: This review https://review.openstack.org/#/c/141854/ has made some progress and it was agreed that the fix would be continued there.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Alexander Makarov (<email address hidden>) on branch: master
Review: https://review.openstack.org/141397
Reason: Patch solving revocation problem: https://review.openstack.org/#/c/141854/

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-6.1/2014.2
Change author: Alexander Makarov <email address hidden>
Review: https://review.fuel-infra.org/5776

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-6.1/2014.2
Change author: Alexander Makarov <email address hidden>
Review: https://review.fuel-infra.org/5777

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Alexander Makarov <email address hidden> on branch: openstack-ci/fuel-6.1/2014.2
Review: https://review.fuel-infra.org/5776
Reason: In favor of 5776 which has the same ChangeId as the upstream patch

[Dolph Mathews (dolph)]

I was hoping a fix for this could be backported, but it doesn't look like the final solution is backportable:

  https://review.openstack.org/#/c/141854/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/216354

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/216354
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=369d08d1c6f1c30abb09440b3ed06e7e5266b1ec
Submitter: Jenkins
Branch: stable/kilo

commit 369d08d1c6f1c30abb09440b3ed06e7e5266b1ec
Author: Alexander Makarov <email address hidden>
Date: Mon Dec 15 20:25:01 2014 +0300

    Group role revocation invalidates all user tokens

    Keystone invalidates every token for a user after revoking one group role
    within one project.

    This patch replaces 'invalidate user's everything' logic with revocation by
    grant via notifications for delete_grant assignment operation.

    Closes-Bug: #1402760
    Closes-Bug: #1401926
    (cherry picked from commit 2cf743d6de3afcb1a0aa3d4c219b3c4bcea29008)

    There was one conflict fixed by hand in core.py. The test case had to be
    adjusted as driver='kvs' and driver='uuid' (test_v3_auth.py)
    will not work in the stable/kilo release.

    # Conflicts:
    #>------keystone/assignment/core.py

    Change-Id: If9d0fefe43da96ba5e6b6ffc809b9f15e8d732f7