Horizon does not allow domain admin to create users

[Jay Jahns]

Hi,

I have a user (rallyadmin) that is given the admin role to the domain (rally). If I pull in the keystone v3 policy.json file to horizon (copy it to the location holding keystone_policy.json) I can create projects within the domain.

However, for some reason, I cannot create users. I can do this from the command line just fine, only if I use the domain ID in the command.

Example:

openstack user create --domain ec52643a4652460d86de1cea5807ac07 --password rally01 rally01
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | ec52643a4652460d86de1cea5807ac07 |
| enabled | True |
| id | 9fe967f27c594c75a4d08d8fde48873e |
| name | rally01 |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+

This puts the user inside the rally domain, as expected.

It appears that Horizon is missing the "Create User" button from the Users list, if you login as the rallyadmin account. I am unsure why it is doing this - perhaps we are checking something that we shouldn't.

I will clear out anything in my memcache to see if that caused the problem, but I do not remember having this issue in the past. Please advise on how to resolve or if you need additional items, such as viewing my policy file (we're tentative on dropping this information to the wild right now).

Thank you - and please, apologies if anything got misfiled or done incorrectly with the bug filing.

[Steve Searles (y9a7s7t-s1ivl-si9yrl0)]

I am having the same issue as well.

[Ying Zuo (yingzuo)]

Does the user rallyadmin have admin role in the project that you are trying to add users from? With rallyadmin's openrc file, can you add users to the project with CLI?

[Jay Jahns (jjahns)]

Yes. rallyadmin has the admin role to the rally project, in the rally domain.

rallyadmin also has admin role on the rally domain.

Despite this, I cannot create users in the UI because the button is missing.

I don't remember this occurring in Newton.

[Ying Zuo (yingzuo)]

What version are you using now? Looking at the ocata code, here's the code for the add user action: https://github.com/openstack/horizon/blob/stable/ocata/openstack_dashboard/dashboards/identity/users/tables.py#L27. Please check if the policy rules and the OPENSTACK_KEYSTONE_BACKEND setting on local_settings.py are set properly.