Cloned from launchpad blueprint https://blueprints.launchpad.net/keystone/+spec/reduce-default-token-duration. Description: The default token duration of 24 hours (86400 seconds) is long enough such that we must deal with issues such as premature token revocation and large numbers of simultaneously valid persisted tokens. Reducing the default token lifespan to something that more closely resembles real-world long running processes (1 hour, for example) would reduce the overall overhead associated with tokens. Specification URL (additional information): None
Moving to POST based on upstream status (Implemented).
The default token duration was reduced to 1 hour. You should be able to verify by checking the token expiration timestamp when getting a new token via curl. An example of using curl to get a token with the v2 is here: http://docs.openstack.org/developer/keystone/api_curl_examples.html#id3 There is a v3 example here: http://adam.younglogic.com/2013/09/keystone-v3-api-examples/
*** Bug 1066391 has been marked as a duplicate of this bug. ***
(In reply to Nathan Kinder from comment #3) > The default token duration was reduced to 1 hour. NB puppet-keystone still has 24h default https://github.com/stackforge/puppet-keystone/blob/master/manifests/init.pp#L154
(In reply to Alan Pevec from comment #5) > (In reply to Nathan Kinder from comment #3) > > The default token duration was reduced to 1 hour. > > NB puppet-keystone still has 24h default > https://github.com/stackforge/puppet-keystone/blob/master/manifests/init. > pp#L154 Good catch. This was addressed in Keystone by changing the setting in the keystone.conf.sample file: https://review.openstack.org/#/c/66449/ I have filed an upstream puppet-keystone bug and submitted a patch/review: https://bugs.launchpad.net/puppet-keystone/+bug/1299334 https://review.openstack.org/#/c/83948/
The upstream change for puppet-keystone has been merged: https://git.openstack.org/cgit/stackforge/puppet-keystone/commit/?id=af070094bf6d240e71e035666a124b40ea18dc2c
This bug fails QA because, although the defaults in the code have been changed as requested, we are still setting expiration = 86400 in the keystone.conf file. This looks like a packstack/puppet bug and not a keystone one, but until we stop changing the conf file this bug will never be closed... Please leave the expiration parameter commented out by default and set to 3600, same as it is in upstream.
(In reply to Udi from comment #13) > This bug fails QA because, although the defaults in the code have been > changed as requested, we are still setting expiration = 86400 in the > keystone.conf file. This looks like a packstack/puppet bug and not a > keystone one, but until we stop changing the conf file this bug will never > be closed... > > Please leave the expiration parameter commented out by default and set to > 3600, same as it is in upstream. This is a OSP 5.0 bug, and it was not in MODIFIED yet. You are correct that there is a puppet-keystone fix required, which is mentioned in comment#6. This has been fixed upstream, but needs to be backported internally, which is why it was in POST. Please don't try to verify it until it is in the MODIFIED state.
Keystone part is done, bug 1095520 is clonned for puppet change.
failedQA: from /etc/keystone/keystone.conf, using packstack installation: # Amount of time a token should remain valid (in seconds). # (integer value) #expiration=3600 expiration=86400 # rpm -qa |grep openstack-keystone openstack-keystone-2014.1-3.el7ost.noarch
(In reply to Ami Jeain from comment #16) > failedQA: > > from /etc/keystone/keystone.conf, using packstack installation: > > # Amount of time a token should remain valid (in seconds). > # (integer value) > #expiration=3600 > expiration=86400 > > # rpm -qa |grep openstack-keystone > openstack-keystone-2014.1-3.el7ost.noarch I expect that puppet is changing it (which is being handled in bug 1095520). If you install openstack-keystone directly via yum (without running packstack), is the expiration set to 3600 in /etc/keystone/keystone.conf? If so, the bug in openstack-keystone is fixed. We need the openstack-puppet-modules fix to resolve this completely.
verified that the keystone.conf in openstack-keystone-2014.1-3.el7ost.noarch.rpm has the #expiration=3600. Will wait for the other puppet-module fix to make sure that packstack doesn't change the value to 86400
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHEA-2014-0854.html