Cloud Admin user cannot view admin/users/ or admin/projects/ when in alternate domain context

[Drew Freiberger]

19.10 charms
bionic-stein

When the cloud admin user logs into horizon (admin_domain/admin juju-created user), the user can view admin_domain users and projects, but if you visit admin/domains/ and enter domain context for something like "default" or "service_domain", etc, the user cannot see any users or projects within the domain via Horizon.

CLI works fine to run 'openstack project list --domain service_domain' or 'openstack user list --domain service_domain'.

I enabled keystone debug logging and all RBAC calls are returning 'Authorization granted', so I believe this is a bug in openstack_dashboard, the new custom policy configurations for 19.10 charms, or perhaps a Stein-related openstack-dashboard bug.

[Drew Freiberger (afreiberger)]

Special note, the environment where this is being witnessed has upgraded from xenial-queens, through bionic-queens, bionic-rocky, and is now running bionic-stein.

[Drew Freiberger (afreiberger)]

https://bugzilla.redhat.com/show_bug.cgi?id=1648838#c7 could be related.

[Drew Freiberger (afreiberger)]

I tested the workaround noted in that comment 7 of the RH bug by commenting out the DEFAULT_DOMAIN in /etc/openstack-dashboard/local_settings.py and restarting apache2, but this did not solve the issue. I guess that upstream bug was already closed, this is a separate issue.

[Alex Kavanagh (ajkavanagh)]

This is a duplicate of https://bugs.launchpad.net/charm-openstack-dashboard/+bug/1830782 which is due to an upstream bug. Unfortunately, there's not much that can be done apart from fixing it upstream.