the owner field in glance is tenant_name

[Vish Ishaya]

Glance is reporting the owner of the image as tenant_name instead of tenant_id. I checked the mysql table and it is storing the name as well. I think this is incorrect, because the name of a tenant could be changed which would cause them to lose all of their images in glance.

[Jay Pipes (jaypipes)]

On it.

[Thierry Carrez (ttx)]

From Jay on the ML:

OK, so the source of this issue is actually in Keystone. The glance_auth_token middleware is creating the RequestContext that Glance uses when querying for the caller's tenant. The code uses the value of the X_TENANT header to populate the tenant supplied to the RequestContext's constructor, which is what Glance ends up storing in the registry as the image owner_id.

So... the solution, I think, is to patch the glance_auth_token middleware in Keystone to use the value of the X_TENANT_ID header, not X_TENANT, and write some sort of data migration script to address the problem of stored owner_id values being name and not ID of tenant.

[Thierry Carrez (ttx)]

Added keystone to scope to match jay's findings

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/5161

[Gabriel Hurley (gabriel-hurley)]

Horizon will need to update as soon as this is fixed by the other projects. Related to: https://bugs.launchpad.net/horizon/+bug/955744

[Brian Waldon (bcwaldon)]

Middleware lives in glance now, so untargeting Keystone.

[Brian Waldon (bcwaldon)]

Just wanted to note that we need to migrate user names to ids in the case that 'owner_is_tenant' is set to false in a glance deployment.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/5533

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/5533
Committed: http://github.com/openstack/glance/commit/f5603c87282c2b25be9ba5af304be777e0f53766
Submitter: Jenkins
Branch: master

commit f5603c87282c2b25be9ba5af304be777e0f53766
Author: Brian Waldon <email address hidden>
Date: Mon Mar 19 10:41:53 2012 -0700

    Use tenant/user ids rather than names

    * Add script that migrates image owners from user/tenant names to ids
    * Fixes bug 950364

    Change-Id: I157cb010ed0f8997bd2e1794e9c3b66eba75e36b

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/5549

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/5549
Committed: http://github.com/openstack/horizon/commit/2a51171517de2890d26130225a60901827fdfd51
Submitter: Jenkins
Branch: master

commit 2a51171517de2890d26130225a60901827fdfd51
Author: Gabriel Hurley <email address hidden>
Date: Mon Mar 19 18:49:01 2012 -0700

    Corrects glance image action permissions.

      * Admins have full permissions to edit and delete images
        from syspanel, plus Glance's client returns a proper
        403 error instead of 401, so inappropriate access no longer
        logs the user out inappropriately. Fixes bug 955744.
      * Regular users can edit and delete if their tenant owns the
        image. Fixes bug 950364 and fixes bug 737360.

    Note, this requires the latest version of Glance.

    Change-Id: Ib816d7e6e1320a9024c5dbe95b04249291ec0463