LDAP list group users should not fail if user entry deleted
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| OpenStack Identity (keystone) |
Fix Released
|
Medium
|
Brant Knudson | ||
| Grizzly |
Fix Released
|
Medium
|
Brant Knudson | ||
Bug Description
Using the LDAP identity backend,
if a group member entry doesn't exist in the LDAP server anymore
and the group's members are listed using GET /v3/groups/
Keystone returns 404 Not Found.
First, it's incorrect to return 404 Not Found when the group resource exists.
Second, Keystone should be more robust. A user entry may not exist
because the LDAP administrator deleted the entry but forgot to update the group.
The server should return all the group members that do exist
and ignore the missing members,
and probably log a warning message about the missing user.
This can be recreated by:
1) start with devstack configured to use LDAP
# set LDAP options in localrc
./stack.sh ...
2) add the default domain since it doesn't exist by default for some reason.
$ ldapadd -x -D dc=Manager,
dn: cn=default,
objectclass: groupOfNames
member: cn=dummy
3) Create a couple users
$ keystone user-create --name user1 --pass user1pwd
(example id is e1b7df356f004b7
$ keystone user-create --name user2 --pass user2pwd
(example id is bc8031d87e4c41d
4) Create a group with both users:
$ ldapadd -x -D dc=Manager,
dn: ou=UserGroups,
objectclass: organizationalUnit
dn: cn=group1,
objectclass: groupOfNames
member: cn=e1b7df356f00
member: cn=bc8031d87e4c
5) List group members, the user's in there.
curl -H "X-Auth-Token: admintoken" http://
...
6) Delete the user from LDAP directly.
ldapdelete -x -D dc=Manager,
7) List group members again, it fails.
$ curl -H "X-Auth-Token: adminpwd" http://
{
"error": {
"code": 404,
"message": "Could not find user: bc8031d87e4c41d
"title": "Not Found"
}
}
The last list group members should have worked, just returned the e1b7df356f004b7
| Changed in keystone: | |
| assignee: | nobody → Brant Knudson (blk-u) |
| Changed in keystone: | |
| status: | New → In Progress |
| OpenStack Infra (hudson-openstack) wrote Fix merged to keystone (master) | #1 |
| Changed in keystone: | |
| status: | In Progress → Fix Committed |
| tags: | added: grizzly-backport-potential |
| OpenStack Infra (hudson-openstack) wrote Fix proposed to keystone (stable/grizzly) | #2 |
| Changed in keystone: | |
| importance: | Undecided → Medium |
| tags: | removed: grizzly-backport-potential |
| OpenStack Infra (hudson-openstack) wrote Fix merged to keystone (stable/grizzly) | #3 |
| Changed in keystone: | |
| milestone: | none → havana-1 |
| status: | Fix Committed → Fix Released |
| Brant Knudson (blk-u) wrote | #4 |
| Changed in keystone: | |
| status: | Fix Released → New |
| OpenStack Infra (hudson-openstack) wrote Fix proposed to keystone (master) | #5 |
| Changed in keystone: | |
| status: | New → In Progress |
| OpenStack Infra (hudson-openstack) wrote Fix merged to keystone (master) | #6 |
| Changed in keystone: | |
| status: | In Progress → Fix Committed |
| Changed in keystone: | |
| status: | Fix Committed → Fix Released |
| Changed in keystone: | |
| milestone: | havana-1 → 2013.2 |
Reviewed: https:/
Committed: http://
Submitter: Jenkins
Branch: master
commit 4eb8233d9c6b73c
Author: Brant Knudson <email address hidden>
Date: Mon Apr 29 19:19:27 2013 -0500
LDAP list groups with missing member entry
Using the LDAP identity backend,
if a group member entry doesn't exist in the LDAP server anymore
and the group's members are listed using GET /v3/groups/
Keystone returns 404 Not Found.
The server should return all the group members that do exist
and ignore the missing members,
and probably log a warning message about the missing user.
Fixes bug 1174585
Change-Id: Idf7c8c7f87affc