Update credential to "ec2" type accepts a credential without the project set

[Rodrigo Duarte]

In the credentials API schema validation [1] is mandatory to include a project when creating a credential of the "ec2" type, but we can create a credential from a different type and update it to "ec2" without providing a project [2].

[1] https://github.com/openstack/keystone/blob/master/keystone/credential/schema.py#L29-L55
[2] https://github.com/openstack/keystone/blob/master/keystone/credential/schema.py#L57-L62

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/357950

[Rodrigo Duarte (rodrigodsousa)]

If we update the credential to the ec2 type without the project_id, the API will fail in a further step of the API path (when trying to use the credential). Think we need to make the credential type immutable, but we would need a deprecation cycle as pointed out by Dolph in IRC.

For now, I think we can return a 404 error if the user tries to update the type to ec2 without providing a project_id since the API will break in a further step anyways.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/357950
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=8144e28336e1c9bf2128409172f48b3ea1cd1ee5
Submitter: Jenkins
Branch: master

commit 8144e28336e1c9bf2128409172f48b3ea1cd1ee5
Author: Rodrigo Duarte Sousa <email address hidden>
Date: Fri Aug 19 11:54:57 2016 -0300

    Fix credential update to ec2 type

    It was possible to create a credential without providing a project_id
    and later updating it to the ec2 type.

    This patch fixes the issue by adding a manual checking in the
    manager layer since it needs to check the old credential contents
    prior failing the request.

    Change-Id: I1eb28a46c89e17d9c990cc798867d1a59714fe5f
    Closes-Bug: #1613466

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/keystone 10.0.0.0b3 development milestone.