CRUD grant don't check user_id and group_id

[Marcos Lobo]

In Icehouse release, CRUD grant functions[1] don't check if user_id and group_id exists.

role_id, domain_id and project_id are checked and I don't see any reason to not check if the user_id and group_ids are valid. I think we should change these functions to check if the user and/or group exists before creating/updating the grant.

[1] https://github.com/openstack/keystone/blob/stable/icehouse/keystone/assignment/backends/ldap.py#L347

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/107973

[Lance Bragstad (lbragstad)]

Is this causing a misbehavior in a specific use case?

[Lance Bragstad (lbragstad)]

In the description it says this effects stable/icehouse, but the code review changes current master code. One should be updated to reflect the other.

[Dolph Mathews (dolph)]

Lance: if the issue exists in master, we need to fix it there first, and then backport the change to icehouse.

[Morgan Fainberg (mdrnstm)]

I just want to comment on this bug and I agree with Henry Nash's assessment of the fix proposed:

 <Henry's comment>
Patch Set 4: Code-Review-2
So this issue has been discussed many times. In fact our code USED to do this. We removed these checks, since we do not want the assignment backend calling the identity backend. In some cases, the user/groups IDs might not even permenently exist in identity (e.g. Federation).
<end comment>

This is, based upon the many conversations we've had on this topic, working as intended. We should not be checking the user exists / group exists (we've talked this to death at the summits as well).

While the current federation does make use of groups in identity, I don't think there is general consensus that we should be checking validity of user/group when assigning grants.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Marcos Fermín Lobo (<email address hidden>) on branch: master
Review: https://review.openstack.org/107973
Reason: Thanks to Henry Nash for the information.

[Launchpad Janitor (janitor)]

[Expired for Keystone because there has been no activity for 60 days.]