Deleting a domain group assignment using a non-domain-aware identity backend (e.g. LDAP) fails

[Samuel de Medeiros Queiroz]

When deleting a domain group assignment using a not domain-aware backend, such as LDAP, we should get an exception like: 'NotImplemented: Domain metadata not supported by LDAP', as we have for user assignments.

However, trying to delete an assignment of such type, we get:

Traceback (most recent call last):
  File "keystone/assignment/core.py", line 570, in delete_grant
    domain_id):
  File "keystone/common/manager.py", line 47, in wrapper
    return f(self, *args, **kwargs)
  File "keystone/identity/core.py", line 202, in wrapper
    return f(self, *args, **kwargs)
  File "keystone/identity/core.py", line 213, in wrapper
    return f(self, *args, **kwargs)
  File "keystone/identity/core.py", line 816, in list_users_in_group
    self._mark_domain_id_filter_satisfied(hints)
  File "keystone/identity/core.py", line 526, in _mark_domain_id_filter_satisfied
    for filter in hints.filters:
AttributeError: 'str' object has no attribute 'filters'

Pointers to the code are [1][2][3].
This occurs because we pass the domain_id (of type str) as it was a hint (of type driver_hints.Hints) on [1].

A patch to this bug should create a driver_hints.Hints() object with domain_id as a filter of it and pass it as argument, instead of passing domain_id directly.

[1] https://github.com/openstack/keystone/blob/master/keystone/assignment/core.py#L569-L570
[2] https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L813-L816
[3] https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L526

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/123585

[Henry Nash (henry-nash)]

We should definitely fix this, since this will cause problems with deleting groups assignments in domain-specific LDAP configurations.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/123585
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=5b331f469dcf8062f5172209bc75f21a8ab8c290
Submitter: Jenkins
Branch: master

commit 5b331f469dcf8062f5172209bc75f21a8ab8c290
Author: Henry Nash <email address hidden>
Date: Tue Sep 23 17:49:15 2014 -0300

    Fix failure of delete domain group grant when identity is LDAP.

    When deleting a domain group assignment while using a non
    domain-aware backend, such as LDAP, an AttributeError was being
    raised when trying to find all the relevent tokens. This was due
    to a hang over from when you had to pass domain scope to
    list_user_in_group(). This only affected domain group grants,
    by luck we got away with it for group project grants.

    Change-Id: I47b61886698232a7d3dfb4b502d61723cb0eb786
    Closes-Bug: 1373113