Implement Token Flush via keystone-manage.

Creates a cli entry 'token_flush' which removes all expired tokens.

Fixes: bug 1032633
Implements: blueprint keystone-manage-token-flush
Change-Id: I47eab99b577ff9e9ee74fee08e18fd07c4af5aad

doc/source/configuration.rst

@@ -975,6 +975,19 @@ example::
     $ keystone service-delete 08741d8ed88242ca88d1f61484a0fe3b
 
 
+
+Removing Expired Tokens
+===========================================================
+
+In the SQL and KVS token stores expired tokens are not automatically
+removed. These tokens can be removed with::
+
+    $ keystone-manage token_flush
+
+The memcache backend automatically discards expired tokens and so flushing
+is unnecessary and if attempted will fail with a NotImplemented error.
+
+
 Configuring the LDAP Identity Provider
 ===========================================================
 

doc/source/man/keystone-manage.rst

@@ -49,6 +49,7 @@ Available commands:
 * ``import_nova_auth``: Import a dump of nova auth data into keystone.
 * ``pki_setup``: Initialize the certificates used to sign tokens.
 * ``ssl_setup``: Generate certificates for SSL.
+* ``token_flush``: Purge expired tokens.
 
 
 OPTIONS

keystone/cli.py

@@ -26,6 +26,7 @@
 from keystone.openstack.common import importutils
 from keystone.openstack.common import jsonutils
 from keystone.openstack.common import version
+from keystone import token
 
 CONF = config.CONF
 
@@ -111,6 +112,17 @@ def main(cls):
         conf_ssl.run()
 
 
+class TokenFlush(BaseApp):
+    """Flush expired tokens from the backend."""
+
+    name = 'token_flush'
+
+    @classmethod
+    def main(cls):
+        token_manager = token.Manager()
+        token_manager.driver.flush_expired_tokens()
+
+
 class ImportLegacy(BaseApp):
     """Import a legacy database."""
 
@@ -173,6 +185,7 @@ def main():
     ImportNovaAuth,
     PKISetup,
     SSLSetup,
+    TokenFlush,
 ]
 
 

keystone/token/backends/kvs.py

@@ -116,3 +116,9 @@ def list_revoked_tokens(self):
             record['expires'] = token_ref['expires']
             tokens.append(record)
         return tokens
+
+    def flush_expired_tokens(self):
+        now = timeutils.utcnow()
+        for token, token_ref in self.db.items():
+            if self.is_expired(now, token_ref):
+                self.db.delete(token)

keystone/token/backends/sql.py

@@ -131,3 +131,12 @@ def list_revoked_tokens(self):
             }
             tokens.append(record)
         return tokens
+
+    def flush_expired_tokens(self):
+        session = self.get_session()
+
+        query = session.query(TokenModel)
+        query = query.filter(TokenModel.expires < timeutils.utcnow())
+        query.delete(synchronize_session=False)
+
+        session.flush()

keystone/token/core.py

@@ -187,3 +187,8 @@ def list_revoked_tokens(self):
 
         """
         raise exception.NotImplemented()
+
+    def flush_expired_tokens(self):
+        """Archive or delete tokens that have expired.
+        """
+        raise exception.NotImplemented()

tests/test_backend.py

@@ -2188,6 +2188,32 @@ def test_list_revoked_tokens_for_multiple_tokens(self):
         self.check_list_revoked_tokens([self.delete_token()
                                         for x in xrange(2)])
 
+    def test_flush_expired_token(self):
+        token_id = uuid.uuid4().hex
+        expire_time = timeutils.utcnow() - datetime.timedelta(minutes=1)
+        data = {'id_hash': token_id, 'id': token_id, 'a': 'b',
+                'expires': expire_time,
+                'trust_id': None,
+                'user': {'id': 'testuserid'}}
+        data_ref = self.token_api.create_token(token_id, data)
+        data_ref.pop('user_id')
+        self.assertDictEqual(data_ref, data)
+
+        token_id = uuid.uuid4().hex
+        expire_time = timeutils.utcnow() + datetime.timedelta(minutes=1)
+        data = {'id_hash': token_id, 'id': token_id, 'a': 'b',
+                'expires': expire_time,
+                'trust_id': None,
+                'user': {'id': 'testuserid'}}
+        data_ref = self.token_api.create_token(token_id, data)
+        data_ref.pop('user_id')
+        self.assertDictEqual(data_ref, data)
+
+        self.token_api.flush_expired_tokens()
+        tokens = self.token_api.list_tokens('testuserid')
+        self.assertEqual(len(tokens), 1)
+        self.assertIn(token_id, tokens)
+
 
 class TrustTests(object):
     def create_sample_trust(self, new_id):

tests/test_backend_memcache.py

@@ -19,6 +19,7 @@
 import memcache
 
 from keystone.common import utils
+from keystone import exception
 from keystone.openstack.common import timeutils
 from keystone import test
 from keystone.token.backends import memcache as token_memcache
@@ -96,3 +97,7 @@ def test_create_unicode_user_id(self):
     def test_list_tokens_unicode_user_id(self):
         user_id = unicode(uuid.uuid4().hex)
         self.token_api.list_tokens(user_id)
+
+    def test_flush_expired_token(self):
+        with self.assertRaises(exception.NotImplemented):
+            self.token_api.flush_expired_tokens()