PKI has been the default token provider since Grizzly. Early in the Grizzly development cycle, PKI was established as the default, primarily to expose the implementation to a broad developer audience to work out any issues. Issues were immediately discovered that prevented PKI from becoming the default in production deployments, and that has been an ongoing theme ever since. As of the Juno development cycle, there are still unresolved issues that prevent PKI from being a reasonable production choice. The following etherpad summarizes the Keystone community's perspective on each technology:
https://etherpad.openstack.org/p/pki-vs-uuid
This was also discussed in the July 29th keystone meeting:
http://eavesdrop.openstack.org/meetings/keystone/2014/keystone.2014-07-29-18.01.log.html
It therefore follows that UUID, or a variant thereof, should become the default token provider for Juno.
Fix proposed to branch: master
Review: https:/