Role conflict when importing nova auth

[Mark McLoughlin]

To migrate from Nova's deprecated auth to keystone, I did:

 $> sudo ADMIN_PASSWORD=$OS_PASSWORD SERVICE_PASSWORD=servicepass openstack-keystone-sample-data
 $> sudo nova-manage export auth > auth-export.json
 $> sudo keystone-manage import_nova_auth auth-export.json
   File "/usr/lib/python2.7/site-packages/keystone/identity/backends/sql.py", line 48, in wrapper
     raise exception.Conflict(type=type, details=str(e))
 keystone.exception.Conflict: Conflict occurred attempting to store role. (IntegrityError) (1062, "Duplicate entry 'sysadmin' for key 'name\
 '") 'INSERT INTO role (id, name) VALUES (%s, %s)' ('b8a2ed868ea2440291f612d2bae252e6', 'sysadmin')

This sample data script is included in the Fedora packages and based on devstack's similar script. Perhaps it shouldn't be adding the sysadmin role. Perhaps the script is just a bad idea. Whatever.

It seems to me, though, that there's no particular need for import_nova_auth to barf if a role already exists. If the role exists, we can happily use it and there's no worry that the existing role doesn't match the desired role since a role is just a name.

Proposing a patch to make import_nova_auth only create roles if they don't already exist.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/5993

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/5993
Committed: http://github.com/openstack/keystone/commit/875a67aa69e17d49e2cca40857b76b46dc639657
Submitter: Jenkins
Branch: master

commit 875a67aa69e17d49e2cca40857b76b46dc639657
Author: Mark McLoughlin <email address hidden>
Date: Fri Mar 30 12:17:48 2012 +0100

    Make import_nova_auth only create roles which don't already exist

    Fixes bug #969088

    If a role already exists, there's no particular need for import_nova_auth
    to barf. Instead, we should just use the existing role.

    Change-Id: I18ae38af62b4c2b2423e20e436611fc30f844ae1

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/essex
Review: https://review.openstack.org/7385

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/7385
Committed: http://github.com/openstack/keystone/commit/aff45d69a73033241531f5e3542a8d1782ddd859
Submitter: Jenkins
Branch: stable/essex

commit aff45d69a73033241531f5e3542a8d1782ddd859
Author: Mark McLoughlin <email address hidden>
Date: Fri Mar 30 12:17:48 2012 +0100

    Make import_nova_auth only create roles which don't already exist

    Fixes bug #969088

    If a role already exists, there's no particular need for import_nova_auth
    to barf. Instead, we should just use the existing role.

    Change-Id: I18ae38af62b4c2b2423e20e436611fc30f844ae1

[Chuck Short (zulcss)]

Should already be in the cloud archive.