Marking as WONTFIX since there isn't any work to be done on Keystone. ** Changed in: keystone Status: Triaged => Won't Fix
-- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1462152 Title: python-memcache (and therefore) token memcache persistence driver does not support ipv6 Status in Keystone: Won't Fix Status in openstack-manuals: Confirmed Bug description: (morganfainberg): OpenStack Manuals (for both Master and Kilo) need to be updated to eliminate the recommendation to use the memcache token persistence backend. The memcache token persistence backend is a poor choice due to performance concerns of the code itself, the fact that it is assumed that the token backend is stable storage (memcached is not) and can expose security concerns if restarted in some scenarios (PKI tokens and revoked tokens becoming valid again), and finally that the python-memcache library is all around poor (it will not work with IPv6 and is not Python3 compatible, among other poor design choices). ======================================================================== The memcache backend driver that utilizes "python-memcache" does not support IPv6. I have included three scenarios (A, B and C) that will reproduce the bug and a control test that succeeds with same configuration using IPv4-resolving hostname. To reproduce scenario A: Bare IPv6 address in config 1) Configure keystone according to http://docs.openstack.org/kilo/install-guide/install/apt/content/keystone-install.html 2) In section [memcache] in /etc/keystone/keystone.conf change servers = line: servers = 2001:db8:1000:1:f816:3eff:fe2a:f9c7:11211,2001:db8:1000:1:f816:3eff:fee9:9ce3:11211,2001:db8:1000:1:f816:3eff:fead:8f7f:11211 3) Restart keystone/apache 4) Attempt to issue token: openstack --os-auth-url http://192.168.0.15:35357 --os-project-name admin --os-username admin --os-auth-type password token issue ERROR: openstack An unexpected error prevented the server from fulfilling your request: Unable to parse connection string: "2001:db8:1000:1:f816:3eff:fe2a:f9c7:11211" (Disable debug mode to suppress these details.) (HTTP 500) (Request-ID: req-7c2bfd39-4b83 -462b-92c6-f75f7677c8e5) To reproduce scenario B: IPv6 address enclosed in brackets 1) Configure keystone according to http://docs.openstack.org/kilo/install-guide/install/apt/content/keystone-install.html 2) In section [memcache] in /etc/keystone/keystone.conf change servers = line: servers = [2001:db8:1000:1:f816:3eff:fe2a:f9c7]:11211,[2001:db8:1000:1:f816:3eff:fee9:9ce3]:11211,[2001:db8:1000:1:f816:3eff:fead:8f7f]:11211 3) Restart keystone/apache 4) Attempt to issue token: openstack --os-auth-url http://192.168.0.15:35357 --os-project-name admin --os-username admin --os-auth-type password token issue ERROR: openstack An unexpected error prevented the server from fulfilling your request: Unable to parse connection string: "[2001:db8:1000:1:f816:3eff:fe2a:f9c7]:11211" (Disable debug mode to suppress these details.) (HTTP 500) (Request-ID: req- 869eb953-74af-4336-b3e1-dc3a417180f9) To reproduce scenario C: hostname that resolves to IPv6-only address 1) Configure keystone according to http://docs.openstack.org/kilo/install-guide/install/apt/content/keystone-install.html 2) In section [memcache] in /etc/keystone/keystone.conf change servers = line: servers = keystone-1:11211,keystone-2:11211,keystone-3:11211 3) Edit /etc/hosts: 2001:db8:1000:1:f816:3eff:fe2a:f9c7 keystone-1 2001:db8:1000:1:f816:3eff:fee9:9ce3 keystone-2 2001:db8:1000:1:f816:3eff:fead:8f7f keystone-3 3) Restart keystone/apache 4) Attempt to issue token: openstack --os-auth-url http://192.168.0.15:35357 --os-project-name admin --os-username admin --os-auth-type password token issue Password: ERROR: openstack Maximum lock attempts on _lockusertokens-30dbbe8174b24174a3a24d1ae554ab17 occurred. (Disable debug mode to suppress these details.) (HTTP 500) (Request-ID: req-efd53eae-4bcf-4fd9-bab2-dd4c86fb9798) Control test: 1) Configure keystone according to http://docs.openstack.org/kilo/install-guide/install/apt/content/keystone-install.html 2) In section [memcache] in /etc/keystone/keystone.conf change servers = line: servers = keystone-1:11211,keystone-2:11211,keystone-3:11211 3) Edit /etc/hosts: 192.168.0.15 keystone-1 192.168.0.14 keystone-2 192.168.0.16 keystone-3 3) Restart keystone/apache 4) Attempt to issue token: openstack --os-auth-url http://192.168.0.15:35357 --os-project-name admin --os-username admin --os-auth-type password token issue Password: +------------+----------------------------------+ | Field | Value | +------------+----------------------------------+ | expires | 2015-06-05T00:31:30Z | | id | 2a188e9950f44decb78f196b5a3c3f78 | | project_id | 91bb6f536fca40a68fb5d4cf72527388 | | user_id | 30dbbe8174b24174a3a24d1ae554ab17 | +------------+----------------------------------+ To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1462152/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp