Horizon overwrites existing roles when saving project membership

[Adam Greene]

Using the keystone CLI, add a user to 2 roles in a given Project/Tenant. MySQL backend will show both roles:
{"roles": ["70b6103d95e949b0a9ee37470b0b289b", "6475d8bf8ac74d2f851d23bc20c912bc"]}

Using the Modify Users interface under Projects, you will only see one of the two roles. If you select Save, only one role is saved to the database.
 {"roles": ["70b6103d95e949b0a9ee37470b0b289b"]}

This applies no matter which user you are modifying. i.e., if you change the role on a second user, any users with multiple roles will end up with a single role.

[Gabriel Hurley (gabriel-hurley)]

There are two distinct problems here:

  1. Horizon doesn't support assigning multiple roles to a user on a project. That should probably be a blueprint since that's feature territory, not a bug.

  2. The current implementation of the project membership interface (where roles are controlled) re-saves *all* the users in the project even if they're not modified, and that's not a good behavior. I'll take that as a bug.

[Adam Greene (adam-s-greene)]

The Compute documentation (http://www.openstack.org/software/openstack-compute/) clearly states "Dashboard with fully integrated support for self-service provisioning".

It also states that multiple roles are allowed per project. "A user can be assigned different roles in different tenants: for example, Alice may also have the "admin" role in the "Cyberdyne" tenant. A user can also be assigned multiple roles in the same tenant. " (http://docs.openstack.org/folsom/openstack-compute/admin/content/keystone-concepts.html#keystone-user-management).

How is it that blueprint is needed to capture the idea that the dashboard should be able to manage multiple roles per project?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/23363

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/23363
Committed: http://github.com/openstack/horizon/commit/4c34f5f1e8c66e4a865cf7996b283509feb91b71
Submitter: Jenkins
Branch: master

commit 4c34f5f1e8c66e4a865cf7996b283509feb91b71
Author: Kieran Spear <email address hidden>
Date: Tue Feb 26 10:26:22 2013 +1100

    Support multiple role selection in projects

    Horizon currently overwrites existing roles when saving project
    membership. The backend was only initialising the form with the
    first role of each user, so when the form was submitted any other
    roles on *all* users were removed.

    Changes:
    - Fix backend to pass through all roles
    - Keep role dropdown open on click, clicks add a tick to a role
    - Show the first two roles on the dropdown label, add a "..." for
       three or more.

    Fixes bug #1081374.

    Change-Id: Iaf64afc4c50d4d24d6acb529a6e810a0ba154505