© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
1b1ed1a
(Get the code!)
Keystone supports the ability for service users to validate expired user tokens. This solved an issue where a user would initiate a long-running operation (e.g. live migration, instance back-ups, uploading large images to glance), and by the time the operation finished the user's token would be invalid, causing the operation to fail.
The solution to this problem is to use service users and configure them in such a way that they have the ability to validate expired user tokens. This keeps enforcement of the user's authorization valid when they start the operation but allows the operation to finish in the event it takes longer than the configured token expiration time.
We don't supply any documentation for this process or setting it up. If deployers want to use it, they have to dig through code to figure out how it work.
https:/