Unable to add roles to admin user

[Bryan Jones]

When using devstack, several keystone users are created by default, but I am unable to manipulate these users with a template.
The use case I have is trying to add a role to the admin user in a newly created tenant/project.
The keystone CLI provides the user-role-add command that handles this functionality, but it cannot currently be templated.

I see 2 possible solutions for this:
1) Enhance the OS::Keystone::User resource to accept names of preexisting users. In the event that the engine sees a preexisting username, it adds the functionality provided in the template to the user. Otherwise, a new user is created.
2) Implement a new resource, OS::Keystone::UserRoleAdd, which behaves similar to the CLI command. The resource would have 3 required fields, a user, a role, and a project.

My preference is for solution 2, but please comment with your preference or additional solutions that may be better.

[Kairat Kushaev (kkushaev)]

I am not sure that the good solution feasible with the current implementation. By default heat should manage all resources starting from resource creation, so the first approach is not in accordance with current architecture. The second approach may work but please be aware that we need to deprecate roles attribute of the OS::Keystone::User because we need only 1 way to define relationship between users and roles. I am not sure the users will be happy with that.
We would help you if you describe in details the case you trying to test. F.e. why can't you create your own user in template?

[Steve Baker (steve-stevebaker)]

If there is a dedicated REST API for role assignment then we can create a heat resource for that.

And there is http://developer.openstack.org/api-ref-identity-v3-ext.html

"Assign role to user" and "Revoke role from user" allows heat to implement an OS::Keystone::RoleAssignment resource

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/207117

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/207118

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/207117
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=b3be2f46d16f6451bf7f13a11185e873ab4a5095
Submitter: Jenkins
Branch: master

commit b3be2f46d16f6451bf7f13a11185e873ab4a5095
Author: Bryan Jones <email address hidden>
Date: Thu Jul 23 19:46:43 2015 +0000

    Add keystone.user custom constraint

    This the first patch of two to allow roles to be added to existing
    users. This patch implements the keystone.user custom constraint,
    allowing users to specify the names of existing keystone users in
    their templates.

    Change-Id: I9041f907a7bb227ba5c31353f431426c82c3ae47
    Partial-Bug: #1477218

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/207118
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=b418669ce0b812e74c3cc7543882f1ea2d83cbeb
Submitter: Jenkins
Branch: master

commit b418669ce0b812e74c3cc7543882f1ea2d83cbeb
Author: Bryan Jones <email address hidden>
Date: Thu Jul 23 21:13:13 2015 +0000

    Add Keystone User/Group RoleAssignment resources

    This is the second patch of two to allow roles to be added to existing
    users. This patch adds two new resources:

      OS::Keystone::UserRoleAssignment
      OS::Keystone::GroupRoleAssignment

    These resources will grant a user or group role(s) within the given
    project or domain.

    Change-Id: I4002fc245b1b21d99d95740b7d15642fd8f9e26d
    Closes-Bug: #1477218