Revoking large token fails with "Request-URI Too Long (HTTP 414)"

[Ralf Haferkamp]

When running keystone in a eventlet based configuration in a setup with a lot of (long) endpoints defined I ran into tempest failures.

It turns out that when it tries to revoke some keystone tokens in e.g. the api/identity/admin/v2/test_roles_negative.py tests the resulting request URI for the v2 API (DELETE /v2.0/tokens/<pki-token>) was too long for eventlet's defaults and there is currently no way to change that limit in keystone.conf.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/220116

[Dolph Mathews (dolph)]

According to Morgan, we're 40 days from dropping support for eventlet completely, so adding a new configuration option wouldn't provide much benefit.

In addition, the length of PKI tokens is a widely known issue that has gone largely unaddressed (besides the introduction of PKIZ as a compressed alternative). Switching to either UUID or Fernet is the recommended workaround.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ralf Haferkamp (<email address hidden>) on branch: master
Review: https://review.openstack.org/220116