Openstack service client caching breaks security and backward compatibility

Fix proposed to branch: master
Review: https://review.openstack.org/377420

I have proposed a patch that should solve the cache key problem - it adds the user_id to the key. As far as I know a users ID will never change and this should be safe to use.

I do not yet have a solution for the expired token problem. The openstack clients are not consistent with their naming of the token on the client itself, so this could be trickier. Although, I think the same token is used for all clients, so there is probably a way we can check this, I will look into it.

"Backward compatibility is also broken as the original operation involved always using the credentials provided by the client." - Andras, I don't fully understand this issue, can you explain it further?

The original behavior was that the server side used whatever token the client provided to it. This has changed with caching and the same token will be used for every subsequent call. Implementing caching this way can cause unexpected errors on the client side.

IMHO, the client should explicitly signal to the server side that it is Ok with caching. Otherwise, the caching needs to handle every case to ensure that the original behavior does not change.

Change abandoned by Dougal Matthews (<email address hidden>) on branch: master
Review: https://review.openstack.org/377420

Fix proposed to branch: master
Review: https://review.openstack.org/377700

Thanks for the feedback Andras, we are going to follow your recommendation. See the latest proposed patch.

We will revisit this in Ocata, once that change has landed we can re-target this bug for Ocata-1.

Reviewed: https://review.openstack.org/377700
Committed: https://git.openstack.org/cgit/openstack/mistral/commit/?id=ff4f95f643169dee6a3a863e0bd5bec557c05c08
Submitter: Jenkins
Branch: master

commit ff4f95f643169dee6a3a863e0bd5bec557c05c08
Author: Dougal Matthews <email address hidden>
Date: Tue Sep 27 14:35:53 2016 +0100

    Disable Client Caching

    Caching has caused some regressions and security problems. It will be
    revisited in Ocata.

    Partial-Bug: #1627689
    Change-Id: I86fa58de00d01c89e4bbc21dbe128f1306e2a1bf

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/379012

Reviewed: https://review.openstack.org/379012
Committed: https://git.openstack.org/cgit/openstack/mistral/commit/?id=2d44cb06e53d09e0c7e8b7ee01499bc035450060
Submitter: Jenkins
Branch: stable/newton

commit 2d44cb06e53d09e0c7e8b7ee01499bc035450060
Author: Dougal Matthews <email address hidden>
Date: Tue Sep 27 14:35:53 2016 +0100

    Disable Client Caching

    Caching has caused some regressions and security problems. It will be
    revisited in Ocata.

    Partial-Bug: #1627689
    Change-Id: I86fa58de00d01c89e4bbc21dbe128f1306e2a1bf
    (cherry picked from commit ff4f95f643169dee6a3a863e0bd5bec557c05c08)

Caching has now been disabled in Newton. I have lowered the priority for this and targeted it for Ocata 1 as a result.