From 479a2a0afaeb505c371ee97a1f2fbc1b11e3cef1 Mon Sep 17 00:00:00 2001 From: Jose Castro Leon Date: Wed, 13 Feb 2019 15:54:39 +0100 Subject: [PATCH] Adds caching of credentials Allows to cache the credentials as they are currently fetched directly from the database Change-Id: I9a706ac506b0f65402f2433e6fd56097e0830657 Closes-Bug: #1815771 --- keystone/conf/credential.py | 19 ++++- keystone/credential/core.py | 75 ++++++++++++++++++- .../notes/bug-1815771-ae0e4118c552f01e.yaml | 7 ++ 3 files changed, 97 insertions(+), 4 deletions(-) create mode 100644 releasenotes/notes/bug-1815771-ae0e4118c552f01e.yaml diff --git a/keystone/conf/credential.py b/keystone/conf/credential.py index b7877a8165..3ccf6e633c 100644 --- a/keystone/conf/credential.py +++ b/keystone/conf/credential.py @@ -46,12 +46,29 @@ share this repository with the repository used to manage keys for Fernet tokens. """)) +caching = cfg.BoolOpt( + 'caching', + default=True, + help=utils.fmt(""" +Toggle for caching only on retrieval of user credentials. This has no effect +unless global caching is enabled. +""")) + +cache_time = cfg.IntOpt( + 'cache_time', + help=utils.fmt(""" +Time to cache credential data in seconds. This has no effect unless global +caching is enabled. +""")) + GROUP_NAME = __name__.split('.')[-1] ALL_OPTS = [ driver, provider, - key_repository + key_repository, + caching, + cache_time ] diff --git a/keystone/credential/core.py b/keystone/credential/core.py index cb28b314e0..900a45e164 100644 --- a/keystone/credential/core.py +++ b/keystone/credential/core.py @@ -16,6 +16,7 @@ import json +from keystone.common import cache from keystone.common import driver_hints from keystone.common import manager from keystone.common import provider_api @@ -24,6 +25,7 @@ from keystone import exception CONF = keystone.conf.CONF +MEMOIZE = cache.get_memoization_decorator(group='credential') PROVIDERS = provider_api.ProviderAPIs @@ -91,21 +93,39 @@ class Manager(manager.Manager): return credentials def list_credentials_for_user(self, user_id, type=None): - """List credentials for a specific user.""" - credentials = self.driver.list_credentials_for_user(user_id, type=type) + credentials = self._list_credentials_for_user(user_id, type) for credential in credentials: credential = self._decrypt_credential(credential) return credentials + @MEMOIZE + def _list_credentials_for_user(self, user_id, type): + """List credentials for a specific user.""" + return self.driver.list_credentials_for_user(user_id, type) + def get_credential(self, credential_id): """Return a credential reference.""" - credential = self.driver.get_credential(credential_id) + credential = self._get_credential(credential_id) return self._decrypt_credential(credential) + @MEMOIZE + def _get_credential(self, credential_id): + return self.driver.get_credential(credential_id) + def create_credential(self, credential_id, credential): """Create a credential.""" credential_copy = self._encrypt_credential(credential) ref = self.driver.create_credential(credential_id, credential_copy) + if MEMOIZE.should_cache(ref): + self._get_credential.set(ref, + credential_copy, + credential_id) + self._list_credentials_for_user.invalidate(self, + ref['user_id'], + ref['type']) + self._list_credentials_for_user.invalidate(self, + ref['user_id'], + None) ref.pop('key_hash', None) ref.pop('encrypted_blob', None) ref['blob'] = credential['blob'] @@ -133,6 +153,14 @@ class Manager(manager.Manager): existing_credential = self.get_credential(credential_id) existing_blob = existing_credential['blob'] ref = self.driver.update_credential(credential_id, credential_copy) + if MEMOIZE.should_cache(ref): + self._get_credential.set(ref, self, credential_id) + self._list_credentials_for_user.invalidate(self, + ref['user_id'], + ref['type']) + self._list_credentials_for_user.invalidate(self, + ref['user_id'], + None) ref.pop('key_hash', None) ref.pop('encrypted_blob', None) # If the update request contains a `blob` attribute - we should return @@ -143,3 +171,44 @@ class Manager(manager.Manager): else: ref['blob'] = existing_blob return ref + + def delete_credential(self, credential_id): + """Delete a credential.""" + cred = self.get_credential(credential_id) + self.driver.delete_credential(credential_id) + self._get_credential.invalidate(self, credential_id) + self._list_credentials_for_user.invalidate(self, + cred['user_id'], + cred['type']) + self._list_credentials_for_user.invalidate(self, + cred['user_id'], + None) + + def delete_credentials_for_project(self, project_id): + """Delete all credentials for a project.""" + hints = driver_hints.Hints() + hints.add_filter('project_id', project_id) + creds = self.driver.list_credentials(hints) + + self.driver.delete_credentials_for_project(project_id) + for cred in creds: + self._get_credential.invalidate(self, cred['id']) + self._list_credentials_for_user.invalidate(self, + cred['user_id'], + cred['type']) + self._list_credentials_for_user.invalidate(self, + cred['user_id'], + None) + + def delete_credentials_for_user(self, user_id): + """Delete all credentials for a user.""" + creds = self.driver.list_credentials_for_user(user_id) + self.driver.delete_credentials_for_user(user_id) + for cred in creds: + self._get_credential.invalidate(self, cred['id']) + self._list_credentials_for_user.invalidate(self, + user_id, + cred['type']) + self._list_credentials_for_user.invalidate(self, + cred['user_id'], + None) diff --git a/releasenotes/notes/bug-1815771-ae0e4118c552f01e.yaml b/releasenotes/notes/bug-1815771-ae0e4118c552f01e.yaml new file mode 100644 index 0000000000..058754b75d --- /dev/null +++ b/releasenotes/notes/bug-1815771-ae0e4118c552f01e.yaml @@ -0,0 +1,7 @@ +--- +fixes: + - | + [`bug 1815771 `_] + Allows operators to cache credentials to avoid lookups on the database. + This operation can be turned on/off through the configuration parameter of + keystone.conf [credential] caching.