revocation process is done thrice while checking token(V3)

Bug #1532164 reported by rohita joshi
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
New
Undecided
rohita joshi

Bug Description

While executing 'Check Token' use case for version v3, same SQL queries are executed three times for fetching and deleting invalid revocation events. Out of them one query is executed for Auth-Token validation while other two are executed during Subject-Token validation.
The queries are,

SELECT revocation_event.id AS revocation_event_id, revocation_event.domain_id AS revocation_event_domain_id, revocation_event.project_id AS revocation_event_project_id, revocation_event.user_id AS revocation_event_user_id, revocation_event.role_id AS revocation_event_role_id, revocation_event.trust_id AS revocation_event_trust_id, revocation_event.consumer_id AS revocation_event_consumer_id, revocation_event.access_token_id AS revocation_event_access_token_id, revocation_event.issued_before AS revocation_event_issued_before, revocation_event.expires_at AS revocation_event_expires_at, revocation_event.revoked_at AS revocation_event_revoked_at, revocation_event.audit_id AS revocation_event_audit_id, revocation_event.audit_chain_id AS revocation_event_audit_chain_id
FROM revocation_event ORDER BY revocation_event.revoked_at

DELETE FROM revocation_event WHERE revocation_event.revoked_at < '2015-12-11 20:50:20'

In DELETE query, the timestamp will remain same for all DELETE request as the execution time of the use case is approximately 0.160 seconds.
Token can also be validated by executing queries only once(at starting of the process). Multiple request for revocation can be considered as performance overhead as, to execute 3 queries, keystone need to connect with MySQL 3 times.

Execution step:

curl -i -X GET -H "X-Auth-Token:<Auth_Token>" -H "X-Subject-Token:<Sub_Token>" http://10.0.32.73:5000/v3/auth/tokens

Revision history for this message
rohita joshi (rjoshi16) wrote :

We have also executed for version v2, for that revocation process is done only twice one for Auth-Token and one for Subject-Token.
Related Bug is reported with bug id #1518902(https://bugs.launchpad.net/keystone/+bug/1518902 )
If that bug is fixed, this will also get resolved.

Changed in keystone:
assignee: nobody → rohita joshi (rjoshi16)
Revision history for this message
Steve Martinelli (stevemar) wrote :

marking this as a duplicate of 1518902

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.