Heat can sometimes delete end-user's own project

[Kieran Spear]

We upgraded from Havana to Icehouse Heat about a month ago. A few days ago I configured Heat to use its own Keystone domain for user/project creation. I short while after that I found that a user's own tenant in the 'default' domain had been deleted.

- Create a stack on a Heat deployment that isn't configured to use its own Keystone domain (i.e., stack_user_domain_id unset).
- Set stack_user_domain_id
- Delete the stack

The user's own project will be deleted.

In retrospect I should have realised this but with Keystone's default policy.json the heat_stack_admin will have admin over everything, not just its own domain.

[Steven Hardy (shardy)]

Ouch! We should definitely add a check to avoid this! :-O

[Steven Hardy (shardy)]

Btw, as you've noted, this is really a consequence of this long-standing keystone bug:

https://bugs.launchpad.net/keystone/+bug/968696

It *should* be possible to create a user who has admin rights over just one domain, but atm in keystone it's not :(

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/119212

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/119996

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/119212
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=e9b5a4a5491d74ed877c1288a81a8d4958673c88
Submitter: Jenkins
Branch: master

commit e9b5a4a5491d74ed877c1288a81a8d4958673c88
Author: Steven Hardy <email address hidden>
Date: Thu Sep 4 22:10:47 2014 +0100

    Only delete stack user project from correct domain

    Check the domain ID for the project matches the configured domain from
    heat.conf, so we avoid the bad outcome of deleting the user's project
    when heat has been configured for stack domain users after creating
    some stacks.

    Change-Id: I247e732033f44daf0de5b0efeff6c263814d13ab
    Closes-Bug: #1365332

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/119996
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=2b4f7be44a7c5eae825c9d340aff8abe93efe449
Submitter: Jenkins
Branch: stable/icehouse

commit 2b4f7be44a7c5eae825c9d340aff8abe93efe449
Author: Steven Hardy <email address hidden>
Date: Thu Sep 4 22:10:47 2014 +0100

    Only delete stack user project from correct domain

    Check the domain ID for the project matches the configured domain from
    heat.conf, so we avoid the bad outcome of deleting the user's project
    when heat has been configured for stack domain users after creating
    some stacks.

    Conflicts:
     heat/common/heat_keystoneclient.py
     heat/tests/test_heatclient.py

    Change-Id: I247e732033f44daf0de5b0efeff6c263814d13ab
    Closes-Bug: #1365332