Admin credentials are setup on both controllers after swact

[Jose Perez Carranza]

Title
-----
Controller remains with admin credentials after swact

Brief Description
-----------------
When establishing a SSH connection to an active controller and load the admin credentials (source /etc/nova/openrc) the controller remain with the admin credentials after a swact when is in StandBy and not in Active.

Severity
--------
Provide the severity of the defect.
Major

Steps to Reproduce
------------------
1. Login SSH to Active Controller (controller-x)
2. Load admin credentials
  source /etc/nova/openrc
3. Perform a swact
  system host-swact controller-x
4. Verify that swact is OK
5. Login SSH to Active Controller (controller-y)
6. Load admin credentials
  source /etc/nova/openrc
7 Verify that controller-x is StandBy
  system host-show controller-x |grep capabilities
8. On Controller-x session verify that admin rights commands cannot be executed
  system show

Expected Behavior
------------------
Controller in StandBy cannot run admin commands

Actual Behavior
----------------
Admin commands can be executed on StandBy controller and also in Active controller, both controllers have the admin credentials loaded.

Reproducibility
---------------
Reproducible
100%

System Configuration
--------------------
Duplex Bare-Metal --> Two node system

Branch/Pull Time/Commit
-----------------------
r-2018.10

Timestamp/Logs
--------------

[Elio Martinez (elio1979)]

The same issue is observed on multinode configuration, the only way to complete the "full swacting" operation is to log off from the previous active controller, and log in again, causing that the keystone admin credentials pass 100% to the new active controller.

[Brent Rowsell (brent-rowsell)]

There is no bug here.
On the initial controller you get a token. That token is still valid until it expires.

[Jose Perez Carranza (jgperezc)]

Ok got it.... but this behavior does not represent a security issue, having a controller that can perform admin actions even when is not active?