Bug 908355 - Keystone SQL Backend does not remove expired tokens
Summary: Keystone SQL Backend does not remove expired tokens
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-keystone
Version: 2.0 (Folsom)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: Upstream M3
: 5.0 (RHEL 7)
Assignee: Adam Young
QA Contact: Udi Kalifon
URL:
Whiteboard:
: 926921 1011091 1011093 (view as bug list)
Depends On: 990584
Blocks: RHOS50RFE 1011091 1011093 1029671
TreeView+ depends on / blocked
 
Reported: 2013-02-06 13:51 UTC by Pavel Sedlák
Modified: 2016-04-26 17:16 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Known Issue
Doc Text:
The SQL backend for Identity records tokens. It does not have a timeout, and it does not automatically remove tokens once they are recorded. As a consequence, the SQL database can run out of storage space. As a workaround, Identity now includes a command to remove tokens, namely 'keystone-manage token_flush'. This process should be scheduled to run regularly via cron. It is recommended that this command be run approximately once per minute.
Clone Of:
: 1011091 1011093 1029671 (view as bug list)
Environment:
Last Closed: 2014-07-08 15:23:30 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1032633 0 None None None Never
OpenStack gerrit 28133 0 None None None Never
Red Hat Product Errata RHEA-2014:0854 0 normal SHIPPED_LIVE Red Hat Enterprise Linux OpenStack Platform Enhancement - Identity 2014-07-08 19:22:33 UTC

Description Pavel Sedlák 2013-02-06 13:51:14 UTC 
Description of problem:
Keystone (at least with MySQL backend) keeps already issued tokens in 'token' table, with 'expires' collumn.
But expired tokens are never removed.

See upstream bug https://bugs.launchpad.net/keystone/+bug/1008587
Comment 2 Adam Young 2013-04-10 18:49:47 UTC 
*** Bug 926921 has been marked as a duplicate of this bug. ***
Comment 3 Alan Pevec 2013-05-30 15:23:12 UTC 
keystone-manage token-flush was merged in Havana
Comment 4 Adam Young 2013-07-31 16:05:59 UTC 
I just submitted this patch upstream, which builds on previous solutions, and provides a means to automate the token removal.

https://review.openstack.org/#/c/39507/
Comment 11 Scott Lewis 2013-11-05 15:41:46 UTC 
*** Bug 1011091 has been marked as a duplicate of this bug. ***
Comment 12 Scott Lewis 2013-11-05 15:44:24 UTC 
*** Bug 1011093 has been marked as a duplicate of this bug. ***
Comment 13 Adam Young 2013-11-25 21:03:35 UTC 
Solution should be to schedule the  command 

keystone-manage token-_flush

via cron to run on the keystone server.  The interval for the command really depends on the load.  With MySQL, there is some issue with Database locking, and some people have reported that going to long between flushes have caused Keystone to be unresponsive when running the command.  Once a minute is probably a safe value.
Comment 14 Adam Young 2013-11-25 21:04:16 UTC 
Solution should be to schedule the  command 

keystone-manage token_flush

via cron to run on the keystone server.  The interval for the command really depends on the load.  With MySQL, there is some issue with Database locking, and some people have reported that going to long between flushes have caused Keystone to be unresponsive when running the command.  Once a minute is probably a safe value.
Comment 15 Udi Kalifon 2014-02-20 14:53:44 UTC 
Adam, can you review the TCMS test case? Please see if there is anything to add to it.
Comment 16 Adam Young 2014-02-21 21:24:59 UTC 
Test plan looks good. +2
Comment 19 Udi Kalifon 2014-04-13 12:00:40 UTC 
Verified in M3:
openstack-packstack-2014.1.1-0.7.dev1018.el7.noarch
openstack-keystone-2014.1-0.4.b3.el7.noarch
Comment 21 Udi Kalifon 2014-04-23 07:58:43 UTC 
This is also verified in 4.0
Comment 24 errata-xmlrpc 2014-07-08 15:23:30 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHEA-2014-0854.html
Note You need to log in before you can comment on or make changes to this bug.