DefaultCLI plugin doesn't invalidate stored tokens

[Jacek Tomasiak]

Keystone Session's "reauth" feature relies on proper implementation of invalidate() in auth plugins.
DefaultCLI aims to handle typical cases found in CLI client implementations.
As such it is a "combo" plugin which can handle both username/password and token.
If client is called with both of the above, token has higher priority but if it expires, username/password should be used to generate new token for subsequent requests.
The problem is that DefaultCLI doesn't provide custom invalidate() function which would invalidate internally stored token value and enable fallback to username/password.

[Steve Martinelli (stevemar)]

please ensure that this is also the case for 'python-openstackclient' (which is a new unified CLI) as the CLI that is bundled with 'python-keystoneclient' is deprecated and will be removed in the N release.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/286236

[Jacek Tomasiak (skazi)]

I checked briefly in python-openstackclient and it seems that it's not directly related to this bug as python-openstackclient doesn't use DefaultCLI plugin from python-keystoneclient.

This bug itself is not limited to keystone CLI as it was discovered while working on Murano client re-auth fix (https://bugs.launchpad.net/python-muranoclient/+bug/1499329).

[Morgan Fainberg (mdrnstm)]

Please confirm this is still a valid bug against the code in keystoneauth library not keystoneclient. Keystoneclient session, and cli are deprecated in favor of keystoneauth and openstackclient (CLI) respectively.

If this is valid against openstackclient and/or keystoneauth please add those projects to this bug.

[Jacek Tomasiak (skazi)]

As far as I can see from keystoneauth code, this bug doesn't affect it as the functionality which contains this bug doesn't exist in keystoneauth at all.
DefaultCLI plugin in keystoneclient seems to be the only one able to handle both token and username/password auth at the same time. Comparing keystoneclient to keystoneauth, I would consider this to be a kind of "functional regression" as with keystoneauth clients need to add their own code to implement "fallback to username/password in case of invalid/expired token" functionality.
It seems that neither keystoneauth nor openstackclient provide any support for this kind of behavior.

As for not fixing this bug, I'm not sure how many projects are using keystoneclient but for sure there is muranoclient which still does. Without this fix the "fallback" functionality mentioned above will not work or will require more code on client side to implement something which could easily be fixed in keystoneclient.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Jacek Tomasiak (<email address hidden>) on branch: master
Review: https://review.openstack.org/286236
Reason: Problem worked around on client side.