diff options
| -rw-r--r-- | keystone/identity/controllers.py | 1 | ||||
| -rw-r--r-- | tests/test_keystoneclient.py | 24 |
2 files changed, 25 insertions, 0 deletions
diff --git a/keystone/identity/controllers.py b/keystone/identity/controllers.py index e82b81f4d..520db705b 100644 --- a/keystone/identity/controllers.py +++ b/keystone/identity/controllers.py @@ -223,6 +223,7 @@ class User(controller.V2Controller): def delete_user(self, context, user_id): self.assert_admin(context) self.identity_api.delete_user(context, user_id) + self._delete_tokens_for_user(context, user_id) def set_user_enabled(self, context, user_id, user): return self.update_user(context, user_id, user) diff --git a/tests/test_keystoneclient.py b/tests/test_keystoneclient.py index dd7dc1d7d..f0ca1b314 100644 --- a/tests/test_keystoneclient.py +++ b/tests/test_keystoneclient.py @@ -396,6 +396,30 @@ class KeystoneClientTests(object): self.get_client, self.user_foo) + def test_delete_user_invalidates_token(self): + from keystoneclient import exceptions as client_exceptions + + admin_client = self.get_client(admin=True) + client = self.get_client(admin=False) + + username = uuid.uuid4().hex + password = uuid.uuid4().hex + user_id = admin_client.users.create( + name=username, password=password, email=uuid.uuid4().hex).id + + token_id = client.tokens.authenticate( + username=username, password=password).id + + # token should be usable before the user is deleted + client.tokens.authenticate(token=token_id) + + admin_client.users.delete(user=user_id) + + # authenticate with a token should not work after the user is deleted + self.assertRaises(client_exceptions.Unauthorized, + client.tokens.authenticate, + token=token_id) + def test_token_expiry_maintained(self): foo_client = self.get_client(self.user_foo) |