OpenStack Identity (keystone)

Wrong return from list role assignments on KVS

Bug #1360406 reported by Samuel de Medeiros Queiroz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Won't Fix
Low
Samuel de Medeiros Queiroz

Bug Description

List role assignments calls should return 'inherited_to_projects': 'projects' for an inherited assignment, as done by the SQL backend [1]. The KVS backend just ignore this information from the retrieved assignments.

[1] https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/sql.py#L432
[2] https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/kvs.py#L279-L283

Revision history for this message
Lance Bragstad (lbragstad) wrote :

Samuel,

Can you provide a trace of each call with the different backends?

Revision history for this message
Samuel de Medeiros Queiroz (samueldmq) wrote :

When I add an inherited grant to a user on a domain and then I try to retrieve role assignments, I get:

With SQL backend:
{'inherited_to_projects': 'projects', 'user_id': 'b7a4063ad6044d27b9b3da0702ad702c', 'domain_id': 'bc5100f10f214e15b424d2cf6d889315', 'role_id': 'member'}

With KVS backend:
{'user_id': 'b7a4063ad6044d27b9b3da0702ad702c', 'domain_id': 'bc5100f10f214e15b424d2cf6d889315', 'role_id': 'member'}

Raildo Mascena de Sousa Filho (raildo)
Changed in keystone:
status: New → Confirmed
Samuel de Medeiros Queiroz (samueldmq)
Changed in keystone:
assignee: nobody → Samuel de Medeiros Queiroz (samuel-z)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.openstack.org/118482

Changed in keystone:
status: Confirmed → In Progress
Dolph Mathews (dolph)
Changed in keystone:
importance: Undecided → Low
Revision history for this message
David Stanek (dstanek) wrote :

How much work do we want to put into this now that we have deprecated the KVS drivers?

Revision history for this message
Samuel de Medeiros Queiroz (samueldmq) wrote :

David, I think it's an easy and low-hanging-fruit bug just to make things consistent.

For instance, when implementing inherited roles with hierarchical projects, we have a set of skipped tests. [1]

[1] https://review.openstack.org/#/c/117787/9/keystone/tests/test_backend_kvs.py

Lance Bragstad (lbragstad)
tags: added: low-hanging-fruit
Revision history for this message
David Stanek (dstanek) wrote :

Marked as WONT FIX since this isn't going to be in Juno and the KVS backends go away in Kilo[1].

1. https://review.openstack.org/#/c/123122/

Changed in keystone:
status: In Progress → Won't Fix
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on keystone (master)

Change abandoned by Samuel de Medeiros Queiroz (<email address hidden>) on branch: master
Review: https://review.openstack.org/118482
Reason: The bug is marked as won't fix.

David Stanek (dstanek) comment:

"Marked as WONT FIX since this isn't going to be in Juno and the KVS backends go away in Kilo[1].

1. https://review.openstack.org/#/c/123122/"

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.