bp split-identity left unfinished

Relevant blueprint: https://blueprints.launchpad.net/keystone/+spec/split-identity
Relevant change: https://review.openstack.org/#/c/33745/

Setting as "wishlist" because AFAIK this is only an inconvenience to keystone developers.

The scope of work for this bug is quite extensive, so it likely needs to be completed in pieces.

All of the following methods are "proxy" methods in the identity manager:

  https://github.com/openstack/keystone/blob/c80282c3bee1ed1ee2ac5f1a4a9e5b1f56d4e6d2/keystone/identity/core.py#L455-L556

Each of these methods needs to be removed. Removing any of them will result in test failures, etc. Callers simply need to be revised from calling identity_api.method() to call assignment_api.method() directly (bypassing the proxy method being removed).

There is also an extensive amount of driver cross-reference causing a circular dependency between identity and assignment. All of these cross references to assignment_api should be removed:

  https://github.com/openstack/keystone/blob/c80282c3bee1ed1ee2ac5f1a4a9e5b1f56d4e6d2/keystone/identity/core.py#L62-L182

Even worse, assignment and identity drivers are interdependent and these dependencies need to be removed, for example:

  https://github.com/openstack/keystone/blob/c80282c3bee1ed1ee2ac5f1a4a9e5b1f56d4e6d2/keystone/assignment/backends/sql.py#L29

Reviewed: https://review.openstack.org/51688
Committed: http://github.com/openstack/keystone/commit/bb1ac459a46a5e7829cd4c14e43291ac68c32a52
Submitter: Jenkins
Branch: master

commit bb1ac459a46a5e7829cd4c14e43291ac68c32a52
Author: Telles Nobrega <email address hidden>
Date: Mon Oct 14 15:48:31 2013 -0300

    proxy removed from identity and changed to assignment

    The identity_api served as a proxy for calling the assignment_api
    but it was suggested that this proxy should be removed and the calls
    should be made directly to the assignment_api.

    bug: #1220913

    Change-Id: I20c461c06db22c03eb6d16399d1ca50999d053d5

Fix proposed to branch: master
Review: https://review.openstack.org/54844

While I acknowledge that the removal of the functionality from the assignment driver breaks people's custom drivers, I don't think this will do anything to help them. The Token API calls the assignment back end directly. Adding in API functions will not work for a customer driver as it will still be out of sync with Assignments backend.

The only people that this would help would be people that built custom front end logic. Most likely these calls are going to need to be updated anyway. I'd hold off on reimplementing the deprecated subs until someone actually complained. Otherwise, you are just adding in functions to remove them later, and that is busy work.

 Do we have any reports of this breaking things in the field?

Why would this not help custom drivers? If we make sure (via tests... yes i'll get those added in as well) that the proxy is the same argspec as the assignment driver, it makes little difference.

I somehow doubt we'll see any complaints until RC of icehouse, which case it'll likely be too late (I had a couple of complaints surface around RC3 of Havana that we moved a ton of stuff around and their custom plugins were broken). I really would rather not rip the rug out from under people this time around (especially late in the game). This was specifically discussed as the 1-off change needed from the Internal API deprecation summit session.

Reviewed: https://review.openstack.org/54844
Committed: http://github.com/openstack/keystone/commit/0116044118409d882ed596c3e7cc63bf3ec74776
Submitter: Jenkins
Branch: master

commit 0116044118409d882ed596c3e7cc63bf3ec74776
Author: Morgan Fainberg <email address hidden>
Date: Thu Oct 31 16:48:45 2013 -0700

    Proxy Assignment from Identity Deprecated

    The identity_api served as a proxy for calling the assignment_api
    and a majority of this proxy mechanism was removed. This is the
    second pass on the proxy cleanup fixing up the lingering domain
    calls from the identity core api.

    All proxy calls removed in the Icehouse development cycle (so far)
    have been re-added and now have the @deprecated mechanism used to
    indicate the support will be removed once development for J release
    has been opened as discussed at the Icehouse design summit. See
    https://etherpad.openstack.org/p/icehouse-keystone-internal-apis
    for information on why these were added back in.

    closes-bug: #1220913
    Change-Id: If28b6d9189fa5879c8dbe131174b8cb8f84d9668