Deleting a shadow user doesn't invalidate the cache

[Kristi Nikolla]

When you delete a shadow user and the user tries to log in again through federation, they'll get a can't find user error. Retrying after 10 (or so) minutes works.

My Setup
--------
1. devstack-idp is the identity provider for service provider devstack-sp1, using Keystone to Keystone (SAML) with Shibboleth
2. user-idp gets a SAML assertion from devstack-idp keystone and uses that to authenticate with devstack-sp1 keystone.
3. devstack-sp1 create shadow user user-sp1.
4. admin deletes user-sp1 in devstack-sp1.
5. Step two is performed again
6. user-idp gets a 'Could not find user <user-sp1_id>' from devstack-sp1.
7. After 10 (or so) minutes user tries again, this time it works and he is able to authenticate to <user-sp1> (id of this user-sp1 is different than the prior one).

Expected: After deleting a shadow user, the user should be able to re-authenticate immediately and have a new shadow user created.

Actual: After deleting a shadow user, the user can't log back into keystone if keystone is caching identity information (which is does by default). The user can re-authenticate only if the cache is disabled or the entry TTL has expired.

[Kristi Nikolla (knikolla)]

Logs from command line when attempting to authenticate http://paste.openstack.org/show/718036/
Logs from sp keystone http://paste.openstack.org/show/718037/

[Lance Bragstad (lbragstad)]

This might be related to caching. The default cache_time for the identity system (and most other systems in keystone) is 10 minutes [0].

If you disable caching, can the user log in right away in steps 5 and 6?

[0] https://github.com/openstack/keystone/blob/0c5242b6184aa37968266a2fbb1d490208d6a580/keystone/conf/identity.py#L88-L94

[Kristi Nikolla (knikolla)]

Disabling caching solved the issue, so somewhere along the way the cache isn't being invalidated.

[Lance Bragstad (lbragstad)]

Setting this to medium, but I wouldn't be opposed to bumping it to high since it would be annoying to not be able to log in for 10 minutes for no apparent reason.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/561908

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/561908
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=3b701cdf70d7331c781a6b1a46dd8247906b9b63
Submitter: Zuul
Branch: master

commit 3b701cdf70d7331c781a6b1a46dd8247906b9b63
Author: wangxiyuan <email address hidden>
Date: Tue Apr 17 19:21:43 2018 +0800

    Invalidate the shadow user cache when deleting a user

    When deleting a user, the cache for the related shadow user should
    be invalidated as well. Otherwise the federation authentication
    will not work well and will raise 404 UserNotFound error.

    This patch fixes the bug and adds a new function for shadow backend
    to get the shadow user information.

    Change-Id: I3882f0dc6e8f8f618bb89ebd699736bc4b352261
    Closes-bug: #1760205

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 14.0.0.0b2 development milestone.