Inconsistance between horizon and django_openstack_auth default keystone version

Bug #1231357 reported by Yves-Gwenael Bourhis
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Dashboard (Horizon)
Fix Released
Medium
Yves-Gwenael Bourhis
Havana
Fix Released
Medium
Akihiro Motoki

Bug Description

If one does not set in "local_settings.py":

OPENSTACK_API_VERSIONS = {
    "identity": 2.0
}

django_openstack_auth falls back to version 2.0, and horizon to version 3.

This leads to weird behaviour.
When the keystone API is version 2.0 and that horizon falls back on to using 3 you get this:
- In the dashboard, as admin, add your user to a project.
- Log out and in
- You can select the project
- select the project you are admin on, and go to the admin tab
- remove yourself from the project you added yourself previously.
- Log out and in
- You can still see the project from which you removed yourself but can't select it (it falls back to the one you realy belong to).
- You can still see yourself in the project via the shell command "keystone user-list --tenant <project_id>"
- the "keystone user-role-remove --user <user_id> --tenant <project_id> --role <role_id>" fails with the following message: "Cannot remove role that has not been granted" even though you can list yourself in it with the previous command.

We should have a coherent fall-back version.
The best would be a real detection of the API version and a fall-back if detection fails, but the fall-back should be coherent (same mechanism -> same module).

In order to be DRY (Don't Repeat Yourself), since horizon requires the django_openstack_auth, horizon should e.g. use "openstack_auth.utils.get_keystone_version()" in order to set horizon.openstack_dashboard.keystone.VERSIONS.preferred_version
instead of forcing it to a hard-coded 3, so we should have:
from openstack_auth import utils
VERSIONS = IdentityAPIVersionManager("identity", preferred_version=utils.get_keystone_version())
instead of:
VERSIONS = IdentityAPIVersionManager("identity", preferred_version=3)

but the method to use to have coherent fall-back is open to debate.

Changed in horizon:
assignee: nobody → Yves-Gwenael Bourhis (yves-gwenael-bourhis)
Revision history for this message
Gabriel Hurley (gabriel-hurley) wrote :

Definitely right that this is a problem. If we can get a patch up ASAP I'd consider it for the Havana RC, but I'm not gonna hold it as a blocker.

Changed in horizon:
importance: Undecided → Medium
milestone: none → icehouse-1
status: New → Confirmed
tags: added: havana-rc-potential
Changed in horizon:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to horizon (master)

Fix proposed to branch: master
Review: https://review.openstack.org/49151

Thierry Carrez (ttx)
tags: added: havana-backport-potential
removed: havana-rc-potential
Thierry Carrez (ttx)
Changed in horizon:
milestone: icehouse-1 → icehouse-2
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to horizon (master)

Reviewed: https://review.openstack.org/49151
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=ea447939a88dd80e54612a49a66ae57243e1164b
Submitter: Jenkins
Branch: master

commit ea447939a88dd80e54612a49a66ae57243e1164b
Author: Yves-Gwenael Bourhis <email address hidden>
Date: Tue Oct 1 14:58:30 2013 +0200

    Common keystone version fallback

    If OPENSTACK_API_VERSIONS["identity"] was not set in local_settings.py,
    django_openstack_auth and horizon had their own fallback method which
    did not necessarily fallback on the same version and was leading to
    discrepancies and erratic behavior.

    Refactored in order to use the same fallback method defined in
    django_openstack_auth.utils

    Change-Id: I583d49a73077a20baf5f01628b0b6e8480296964
    Closes-Bug: #1231357

Changed in horizon:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to horizon (stable/havana)

Fix proposed to branch: stable/havana
Review: https://review.openstack.org/63379

Akihiro Motoki (amotoki)
tags: removed: havana-backport-potential
Thierry Carrez (ttx)
Changed in horizon:
status: Fix Committed → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to horizon (stable/havana)

Reviewed: https://review.openstack.org/63379
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=6801ec1db31eb6b486b7f778b5ac8d689b52e0c2
Submitter: Jenkins
Branch: stable/havana

commit 6801ec1db31eb6b486b7f778b5ac8d689b52e0c2
Author: Yves-Gwenael Bourhis <email address hidden>
Date: Tue Oct 1 14:58:30 2013 +0200

    Common keystone version fallback

    If OPENSTACK_API_VERSIONS["identity"] was not set in local_settings.py,
    django_openstack_auth and horizon had their own fallback method which
    did not necessarily fallback on the same version and was leading to
    discrepancies and erratic behavior.

    Refactored in order to use the same fallback method defined in
    django_openstack_auth.utils

    Change-Id: I583d49a73077a20baf5f01628b0b6e8480296964
    Closes-Bug: #1231357
    (cherry picked from commit ea447939a88dd80e54612a49a66ae57243e1164b)

Thierry Carrez (ttx)
Changed in horizon:
milestone: icehouse-2 → 2014.1
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.