Comment 2 for bug 1748970

I was able to recreate this locally with tempest and keystone. It appears that the token used to delete users or list domain is considered invalid during the token validation process, resulting in a 401 [0]. Keystone compares the token being sent with the request against all matched revocation events it knows about, and it does determine a match. The 401 always pops up during tearDown or when clearing credentials in tempest.

I ran a subset of the tests with and without the patch in question [1] and I did notice that more revocation events were generated *with* the patch than without, which doesn't really make sense.

Still digging into this, but wanted to document my findings.

[0] https://github.com/openstack/keystone/blob/602a2b30a3c9cb250d06b2e5b70f961cb5e2cecc/keystone/revoke/core.py#L139-L141
[1] https://review.openstack.org/#/c/530410/