horizon errors out when adding myself to a group

[Ami Jeain]

Horizon throws a "something went wrong" when adding myself to a group:
steps to reproduce:
1. login as admin
2. create a group
3. go to add users and add myself (admin) to this group
=> you will get a "something went wrong" message instead of giving a friendlier message

What I see, is that when doing this action, keystone invalidates the user, as if I 'back' to another page, I get "unathorized" on every step I do.

from /var/log/horizon/horizon.log:

2014-02-04 17:40:13,673 4747 INFO horizon.tables.actions Added User: "admin"
2014-02-04 17:40:13,699 4747 DEBUG openstack_dashboard.api.keystone Creating a new keystoneclient connection to http://10.35.64.158:35357/v3.
2014-02-04 17:40:13,703 4747 DEBUG keystoneclient.httpclient Request returned failure status: 401
2014-02-04 17:40:13,704 4747 ERROR horizon.exceptions Unauthorized: The request you have made requires authentication. (HTTP 401)
Traceback (most recent call last):
  File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/dashboards/admin/groups/views.py", line 123, in get_data
    group_members = self._get_group_members()
  File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/dashboards/admin/groups/views.py", line 96, in _get_group_members
    group=group_id)
  File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/api/keystone.py", line 293, in user_list
    users = keystoneclient(request, admin=True).users.list(**kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/v3/users.py", line 102, in list
    **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 70, in func
    return f(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 340, in list
    self.collection_key)
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 110, in _list
    resp, body = self.client.get(url)
  File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 655, in get
    return self._cs_request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 651, in _cs_request
    **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 610, in request
    **request_kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 124, in request
    raise exceptions.from_response(resp, method, url)
Unauthorized: The request you have made requires authentication. (HTTP 401)
2014-02-04 17:40:13,704 4747 DEBUG openstack_dashboard.api.keystone Using cached client for token: f332099fe46f81951d7b9bdf8f4eb5a3
2014-02-04 17:40:13,708 4747 DEBUG keystoneclient.httpclient Request returned failure status: 401
2014-02-04 17:40:13,708 4747 ERROR django.request Internal Server Error: /dashboard/admin/groups/cc0aafc591e54f25a501fae651ee5b61/manage_members/
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/django/core/handlers/base.py", line 115, in get_response
    response = callback(request, *callback_args, **callback_kwargs)
  File "/usr/lib/python2.7/site-packages/horizon/decorators.py", line 38, in dec
    return view_func(request, *args, **kwargs)
  File "/usr/lib/python2.7/site-packages/horizon/decorators.py", line 86, in dec
    return view_func(request, *args, **kwargs)
  File "/usr/lib/python2.7/site-packages/horizon/decorators.py", line 54, in dec
    return view_func(request, *args, **kwargs)
  File "/usr/lib/python2.7/site-packages/horizon/decorators.py", line 38, in dec
    return view_func(request, *args, **kwargs)
  File "/usr/lib/python2.7/site-packages/django/views/generic/base.py", line 68, in view
    return self.dispatch(request, *args, **kwargs)
  File "/usr/lib/python2.7/site-packages/django/views/generic/base.py", line 86, in dispatch
    return handler(request, *args, **kwargs)
  File "/usr/lib/python2.7/site-packages/horizon/tables/views.py", line 157, in get
    context = self.get_context_data(**kwargs)
  File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/dashboards/admin/groups/views.py", line 117, in get_context_data
    context['group'] = self._get_group()
  File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/dashboards/admin/groups/views.py", line 89, in _get_group
    self._group = api.keystone.group_get(self.request, group_id)
  File "/usr/share/openstack-dashboard/openstack_dashboard/wsgi/../../openstack_dashboard/api/keystone.py", line 422, in group_get
    return manager.get(group_id)
  File "/usr/lib/python2.7/site-packages/keystoneclient/v3/groups.py", line 78, in get
    group_id=base.getid(group))
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 70, in func
    return f(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 325, in get
    self.key)
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 132, in _get
    resp, body = self.client.get(url)
  File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 655, in get
    return self._cs_request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 651, in _cs_request
    **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 610, in request
    **request_kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 124, in request
    raise exceptions.from_response(resp, method, url)

[David Lapsley (dlapsley)]

Hi Ami: which version/branch of Horizon are you using?

Working with master, creating a Project and then adding myself (admin user) appears to work correctly (is that what you are doing?).

Cheers, David.

[Julie Pichon (jpichon)]

David: This is about adding yourself to a group, for which you need to have Keystone v3 enabled.

Marking the bug as confirmed since it was reported again in a separate bug (bug 1279749).

[Julie Pichon (jpichon)]

There're similarities between this bug and bug 1170186, which was about revocation in the context of adding roles.

[David Lapsley (dlapsley)]

Thanks Julie: I'll take a look.

[David Lapsley (dlapsley)]

Hi Julie: thanks for the tip. Yes, the revocation of tokens is the issue. Lin-Hua Cheng left the following comments in the code for Add and Remove members:

        # TODO(lin-hua-cheng): Fix the bug when removing current user
        # Keystone revokes the token of the user removed from the group.
        # If the logon user was removed, redirect the user to logout.

I've implemented this behavior with as small a foot print as possible. Patchset to follow shortly.

I've tested this on my devstack and it works fine for the various use cases. Please let me know what you think.

Cheers, David.

[Durgadas Kamath (kamathd)]

Do we have any progress on this issue ?

[Julie Pichon (jpichon)]

Durgadas, there has been no activity on this since August, if you're interested in picking it up feel free to.

The current patch is at https://review.openstack.org/#/c/75662/ .

[OpenStack Infra (hudson-openstack)]

Change abandoned by David Lyle (<email address hidden>) on branch: master
Review: https://review.openstack.org/75662
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Timur Sufiev (tsufiev-x)]

Tested on mitaka/master Horizon and liberty Keystone, bug doesn't seem to reproduce.