Application credentials with a deleted role are unusable

[Boris Bobrov]

Steps to reproduce:

1. Create role R
2. Create an application credential with role R in it
3. Delete role R
4. Try to list the application credentials

Observed: list fails with 404: Role Not Found
Expected: not sure

I see the following potential behaviors:
1. The role can be removed from the application credential when the role is deleted, leaving the application credential intact; however, the application credential might remain without roles, and i am not sure what it means;
2. The application credential could be immediately deleted when a role is deleted, because it references an invalid role;
3. The non-existing role can stay with the application credential in the database and can simply be ignored when processing the application credential internally

[Boris Bobrov (bbobrov)]

We actually have a test for that: https://opendev.org/openstack/keystone/src/commit/7dc175a41f92e3f01cf26912431d0f2c98a03b32/keystone/tests/unit/test_v3_auth.py#L5807
But i think the test is wrong and should return 401 instead of 404.

[Boris Bobrov (bbobrov)]

We even have code for the removal! https://opendev.org/openstack/keystone/src/commit/7dc175a41f92e3f01cf26912431d0f2c98a03b32/keystone/assignment/core.py#L97 but it does not seem to work...

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/keystone/+/908998
Committed: https://opendev.org/openstack/keystone/commit/63556be0e3b995a2a232a0b180c932a97736350e
Submitter: "Zuul (22348)"
Branch: master

commit 63556be0e3b995a2a232a0b180c932a97736350e
Author: Boris Bobrov <email address hidden>
Date: Wed Feb 14 16:11:41 2024 +0100

    Fix operation order in role deletion

    Deletion of a role leads to deletion of role assignments and entries in
    the application credentials. However, deletion of the entries in
    application credentials depends on the existence of the assignment, so
    the order of deletion is important.

    Delete the entries from application credentials first and then clean up
    role assignment.

    Closes-Bug: 2053137
    Change-Id: Ibba9063c729961cd4155f8b55dbabd4789d7a438

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 25.0.0.0rc1 release candidate.