AppRole Tidy with many dangling accessors blocks secret creation

[chrishoffman]

When the tidy operation in AppRole is running with many dangling accessors, it locks all the secret ID locks which prevents secret ids from being created. Depending on how long the tidy operation takes, this can cause an outage.

The locks in question can be found here:
https://github.com/hashicorp/vault/blob/master/builtin/credential/approle/path_tidy_user_id.go#L168-L171

We should look at a way to either only lock when making modifications or possibly remove the locks in a safe way to allow for secret creation without potentially deleting the accessor.

[catsby]

Could this lock phase be moved down to line ~205 where we know the actual secretIDHMAC values, and only grab the lock(s) needed?

vault/builtin/credential/approle/path_tidy_user_id.go

Lines 199 to 219 in 1ff4605

	searchloop:
	for _, roleNameHMAC := range roleNameHMACs {
	secretIDHMACs, err := s.List(ctx, fmt.Sprintf("%s%s", secretIDPrefixToUse, roleNameHMAC))
	if err != nil {
	return err
	}
	for _, v := range secretIDHMACs {
	if v == entry.SecretIDHMAC {
	found = true
	logger.Trace("accessor verified, not removing")
	break searchloop
	}
	}
	}
	if !found {
	logger.Trace("could not verify dangling accessor, removing")
	err = s.Delete(ctx, entryIndex)
	if err != nil {
	return err
	}
	}