Deleting a domain group assignment using a non-domain-aware identity backend (e.g. LDAP) fails

Bug #1373113 reported by Samuel de Medeiros Queiroz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Fix Released
Critical
Henry Nash

Bug Description

When deleting a domain group assignment using a not domain-aware backend, such as LDAP, we should get an exception like: 'NotImplemented: Domain metadata not supported by LDAP', as we have for user assignments.

However, trying to delete an assignment of such type, we get:

Traceback (most recent call last):
  File "keystone/assignment/core.py", line 570, in delete_grant
    domain_id):
  File "keystone/common/manager.py", line 47, in wrapper
    return f(self, *args, **kwargs)
  File "keystone/identity/core.py", line 202, in wrapper
    return f(self, *args, **kwargs)
  File "keystone/identity/core.py", line 213, in wrapper
    return f(self, *args, **kwargs)
  File "keystone/identity/core.py", line 816, in list_users_in_group
    self._mark_domain_id_filter_satisfied(hints)
  File "keystone/identity/core.py", line 526, in _mark_domain_id_filter_satisfied
    for filter in hints.filters:
AttributeError: 'str' object has no attribute 'filters'

Pointers to the code are [1][2][3].
This occurs because we pass the domain_id (of type str) as it was a hint (of type driver_hints.Hints) on [1].

A patch to this bug should create a driver_hints.Hints() object with domain_id as a filter of it and pass it as argument, instead of passing domain_id directly.

[1] https://github.com/openstack/keystone/blob/master/keystone/assignment/core.py#L569-L570
[2] https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L813-L816
[3] https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L526

Changed in keystone:
assignee: nobody → Samuel de Medeiros Queiroz (samuel-z)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.openstack.org/123585

Changed in keystone:
status: New → In Progress
Revision history for this message
Henry Nash (henry-nash) wrote : Re: Wrong exception when deleting a domain group assignment using a not domain-aware backend

We should definitely fix this, since this will cause problems with deleting groups assignments in domain-specific LDAP configurations.

Changed in keystone:
milestone: none → juno-rc1
importance: Undecided → High
Henry Nash (henry-nash)
summary: - Wrong exception when deleting a domain group assignment using a not
- domain-aware backend
+ Deleting a domain group assignment using a non-domain-aware identity
+ backend (e.g. LDAP) fails
Henry Nash (henry-nash)
Changed in keystone:
importance: High → Critical
Changed in keystone:
assignee: Samuel de Medeiros Queiroz (samuel-z) → Henry Nash (henry-nash)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (master)

Reviewed: https://review.openstack.org/123585
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=5b331f469dcf8062f5172209bc75f21a8ab8c290
Submitter: Jenkins
Branch: master

commit 5b331f469dcf8062f5172209bc75f21a8ab8c290
Author: Henry Nash <email address hidden>
Date: Tue Sep 23 17:49:15 2014 -0300

    Fix failure of delete domain group grant when identity is LDAP.

    When deleting a domain group assignment while using a non
    domain-aware backend, such as LDAP, an AttributeError was being
    raised when trying to find all the relevent tokens. This was due
    to a hang over from when you had to pass domain scope to
    list_user_in_group(). This only affected domain group grants,
    by luck we got away with it for group project grants.

    Change-Id: I47b61886698232a7d3dfb4b502d61723cb0eb786
    Closes-Bug: 1373113

Changed in keystone:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in keystone:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in keystone:
milestone: juno-rc1 → 2014.2
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.