Spamming keystone server with 'revocation list'

[Alexander Chudnovets]

With PKI token user can reduce number of requests to keystone server. But if there are a lot of processes running auth middleware, time to time those processes begin to spam keystone with revocation list request. Can it be avoided? (using lock files for example)

[Morgan Fainberg (mdrnstm)]

Unfortunately, we need to get the revocation list from Keystone for PKI tokens.

For UUID tokens we shouldn't be requesting the revocation list.

You can also set revocation_cache_time to a higher value to limit the frequency of these requests, however, it will also limit your endpoints ability to identify revoked PKI tokens.

Overall this is a general performance improvement we can work on, but it will never really go away. It might be possible to use some cross-greenthread / cross-worker locking to help limit the number of requests.

[Lance Bragstad (lbragstad)]

Even though we removed support for PKI tokens, we should limit the requests to fetch revocation lists when we're not using PKI. This would be a pretty easy thing to do if we can determine which token type we're dealing with in keystonemiddleware, which there are utility methods for.

[Morgan Fainberg (mdrnstm)]

This bug should simply be to remove the bit rotting bits from KSM such as PKI.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/613651
Committed: https://git.openstack.org/cgit/openstack/keystonemiddleware/commit/?id=7e1b53625990bb08425645cb92f36e16bd67db7f
Submitter: Zuul
Branch: master

commit 7e1b53625990bb08425645cb92f36e16bd67db7f
Author: Morgan Fainberg <email address hidden>
Date: Fri Oct 26 10:32:28 2018 -0700

    Stop supporting revocation list

    With keystone's move to eliminating pki, pkiz, and uuid tokens the
    revocation list is no longer generated. Keystonemiddleware no longer
    needs to attempt to retrieve it and reference it.

    Change-Id: Ief3bf1941e62f9136dbed11877bca81c4102041b
    closes-bug: #1361743
    partial-bug: #1649735
    partial-bug: #1736985

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystonemiddleware 6.0.0 release.