I couldn't reproduce Shota's procedure... the token revocation seems pretty right from here. As Dolph noted in comment #4, the Disabled attribute should not cascade, but its effect. In fact, users in a disabled domain are blocked to get a token in token issuance time (thanks Samuel for clarification!).
So I'm marking this as Invalid. The token revocation can be treated in another topic. ** Changed in: keystone Status: Triaged => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1294735 Title: Disable domain doesn't disable users in the domain Status in OpenStack Identity (keystone): Invalid Bug description: If you disable a domain, the users in the domain are not disabled. To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1294735/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp