error message for field name exceeded max allowed is less than helpful

[Guang Yee]

When creating a project with name which exceeds the maximum length (of 64 chars), we get a very generic error message.

openstack --os-identity-api-version 3 --os-auth-url https://localhost:5000/v3 --os-username admin --os-user-domain-id default --os-project-name admin --os-project-domain-id default --os-password secrete project create --domain default this-is-a-very-very-very-very-very-very-very-very-very-very-very-very-very-long-project-name
Invalid input for field 'name'. The value is 'this-is-a-very-very-very-very-very-very-very-very-very-very-very-very-very-long-project-name'. (HTTP 400) (Request-ID: req-d8d7d046-2c68-4c41-ba8c-d3165d86ae50)

The error message is less than helpful for ordinary users. It needs to be more specific, perhaps something like "Invalid project name. It must be no more than 64 characters in length."?

[Marcellin Fom Tchassem (mf6510)]

Guang- I couldn't confirm this bug. What are the steps to reproduce to get this bug?

[Guang Yee (guang-yee)]

You can use openstack CLI to try to create a project with a name longer than 64 characters. For example,

openstack --os-identity-api-version 3 --os-auth-url https://localhost:5000/v3 --os-username admin --os-user-domain-id default --os-project-name admin --os-project-domain-id default --os-password secrete project create --domain default this-is-a-very-very-very-very-very-very-very-very-very-very-very-very-very-long-project-name
 Invalid input for field 'name'. The value is 'this-is-a-very-very-very-very-very-very-very-very-very-very-very-very-very-long-project-name'. (HTTP 400) (Request-ID: req-d8d7d046-2c68-4c41-ba8c-d3165d86ae50)

Just point --os-auth-url to any recent Keystone instance.

[Kristi Nikolla (knikolla)]

Wasn't able to reproduce through openstackclient.

ubuntu@keystone-idp:~$ openstack --version
openstack 2.2.1
ubuntu@keystone-idp:~$ openstack project create akldjflkajdsfkljalskdfjalksdjflkajsdflkjalksdjflkajsdlfkjalkdsjflkajdfklajsdlkfjlakdjsfklajdslkfjalkdsjfklajdsflkjalksdjflkajdsflkjasldkfjalkjdflkajdslkfjalksdjflkajsdfasdklfjalksjdflkajsdlkfjalkjdflkajskdjfkajdsklfjalkdsjflkajdslkfjalksdjflkajlkfsjdkljfalkdsjflkajdflkjalkdsfjlkasdjfkjadsklfjlakdjsflkajsdlfkjalkfjlakdjflkajsdflkjadsf
Project name should not be greater than 64 characters. (HTTP 400) (Request-ID: req-c7722197-f340-4c0d-96c3-a8342426abf2)

[Jaime Guerrero (jg3755)]

Also cannot recreate through openstack client. However, creation from Horizon truncates the provided name.

[devbox][~/devstack] (master)
-> source openrc admin admin
WARNING: setting legacy OS_TENANT_NAME to support cli tools.

[devbox][~/devstack] (master)
-> env | grep OS_
OS_REGION_NAME=RegionOne
OS_PROJECT_NAME=admin
OS_IDENTITY_API_VERSION=2.0
OS_PASSWORD=admin
OS_AUTH_URL=http://10.27.123.8:5000/v2.0
OS_USERNAME=admin
OS_TENANT_NAME=admin
OS_VOLUME_API_VERSION=2
OS_NO_CACHE=1

[devbox][~/devstack] (master)
-> openstack --version
openstack 2.2.0

[devbox][~/devstack] (master)
-> openstack project create this-is-a-very-very-very-very-very-very-very-very-very-very-very-very-very-long-project-name
Project name should not be greater than 64 characters. (HTTP 400) (Request-ID: req-7d496950-4249-4993-9e6a-c016cfefb053)

[Morgan Fainberg (mdrnstm)]

Marked as incomplete until we have clear reproduction on current code.

[Colleen Murphy (krinkle)]

I think the difference reproduceability comes down to v2.0 vs v3:

$ OS_USERNAME=admin OS_PASSWORD=secrete OS_TENANT_NAME=demo OS_AUTH_URL=http://localhost:5000/v2.0 openstack project create this-is-a-very-very-very-very-very-very-very-very-very-very-very-very-very-long-project-name
Project name should not be greater than 64 characters. (HTTP 400) (Request-ID: req-9e6ec1ac-70b7-4007-b87d-7f05c4c5c720)
 $ OS_USERNAME=admin OS_PASSWORD=secrete OS_PROJECT_NAME=demo OS_AUTH_URL=http://localhost:5000/v3 OS_USER_DOMAIN_ID=default OS_PROJECT_DOMAIN_ID=default OS_IDENTITY_API_VERSION=3 openstack project create this-is-a-very-very-very-very-very-very-very-very-very-very-very-very-very-long-project-name
Invalid input for field 'name'. The value is 'this-is-a-very-very-very-very-very-very-very-very-very-very-very-very-very-long-project-name'. (HTTP 400) (Request-ID: req-1da277a7-4bfc-45be-967e-cabce654c172)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/299036

[Steve Martinelli (stevemar)]

Colleen is correct, the JSON schema's for API requests are only done in v3 calls.

[Steve Martinelli (stevemar)]

For implementing consistent schema validation for v2 calls refer to https://blueprints.launchpad.net/keystone/+spec/schema-validation-extent

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/299036
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=815a9247758a79551cb106b09e2f5a7c1bd61cfc
Submitter: Jenkins
Branch: master

commit 815a9247758a79551cb106b09e2f5a7c1bd61cfc
Author: Colleen Murphy <email address hidden>
Date: Tue Mar 29 16:31:50 2016 -0700

    Improve error message for schema validation

    Without this patch, users who enter long project names that fail the
    jsonschema validation are faced with the message:

      Invalid input for field 'name'. The value is '<very long name>'.

    which simply echoes back the input value and does not provide
    information about what was wrong with the input. This is less than
    helpful. This patch modifies the validator error message to, in
    addition to supplying the name of the failed resource, also provide the
    error message directly from the jsonschema exception. In apparently all
    cases this message includes the value the user entered, so we can omit
    echoing the value back. An example of the new message is:

     Invalid input for field 'name': u'<very long name>' is too long

    An alternative to this patch would be to follow the pattern given by
    the "create_user" action, where jsonschema does not validate the
    maxLength and it is instead validated at the core level by a
    keystone.common.clean function. This would solve bug 1557609 and give
    us a more descriptive error message, but moves validation further down
    the chain and contradicts bp api-validation.

    Change-Id: I3e5a41be91ebe87f33eab9e545f330dc141bb88e
    Closes-bug: #1557609

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/keystone 10.0.0.0b1 development milestone.