Horizon revokes admin role from user if cannot get user_list

[Paul Karikh]

1) Deploy Horizon with users storing in LDAP
2) Create a lot of users in LDAP so Keystone couldn't return user_list
3) Go to identity/projects and try to update quotas for project where you have admin role

Sometimes you get message 'You cannot revoke your administrative privileges from the project you are currently logged into.' and sometimes you will lose your admin role.

MOS 7.0

[Boris Bobrov (bbobrov)]

This is not directly keystone's issue. Yes, keystone should not fail to return a list with many users, but Horizon should not drop roles if the list could not be retrieved. If you try to fetch a long list of users via cli, no roles are revoked.

[Paul Karikh (pkarikh)]

Upstream patch is here: https://review.openstack.org/#/c/237615/

[Paul Karikh (pkarikh)]

Also here is Keystone patch which should help us to fix (or workaround, at least) this problem:
https://review.openstack.org/#/c/234849/

[Paul Karikh (pkarikh)]

Horizon patch is on hold since we are wating for Keystone filtering/limiting patch. After it we are going to update Horizon patch in accordance with Keystone patch.

[Paul Karikh (pkarikh)]

We decided to use another approach. Now we want to use Keystone truncated functionality and api filtering to solve this problem. I belive this bug will be mostly covered with the patches for this bug: https://bugs.launchpad.net/mos/+bug/1494806

[Paul Karikh (pkarikh)]

Fix for this issue requires another patch for python-keystone client and according to Boris Bobrov who is author of this patch, there is no chances to get this fix for 9.0.
So we should to move this bug to 10.0.

[Dina Belova (dbelova)]

Added move-to-10.0 tag to show this was moved to 10.0 from 9.0

[Timur Sufiev (tsufiev-x)]

Added 10.0-reviewed tag since the bugfix relies on keystoneclient feature that will be implemented no earlier than in Newton.

[Timur Sufiev (tsufiev-x)]

Horizon fix/feature is still waiting for the required changes in python-keystoneclient. Reassigning to Boris Bobrov, as he has more context to track the progress of Keystone-side changes.

[Alexey Stupnikov (astupnikov)]

We no longer support MOS5.1, MOS6.0, MOS6.1
We deliver only Critical/Security fixes to MOS7.0, MOS8.0.
We deliver only High/Critical/Security fixes to MOS9.2.