[SRU] Issue with Project administration at Cloud Admin level
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
OpenStack Dashboard (Horizon) |
Fix Released
|
Undecided
|
Hua Zhang | |||
Ubuntu Cloud Archive |
Fix Released
|
Undecided
|
Unassigned | |||
Antelope |
Fix Released
|
Medium
|
Unassigned | |||
Bobcat |
Fix Released
|
Undecided
|
Unassigned | |||
Caracal |
Fix Released
|
Undecided
|
Unassigned | |||
Yoga |
Fix Released
|
Undecided
|
Unassigned | |||
Zed |
Won't Fix
|
Undecided
|
Unassigned | |||
horizon (Ubuntu) | Status tracked in Oracular | |||||
Jammy |
Fix Released
|
Medium
|
Hua Zhang | |||
Mantic |
Fix Released
|
Medium
|
Hua Zhang | |||
Noble |
Fix Released
|
Medium
|
Mauricio Faria de Oliveira | |||
Oracular |
Fix Released
|
Medium
|
Mauricio Faria de Oliveira |
Bug Description
[Impact]
We are not able to see the list of users and groups assigned to a project in Horizon.
[Test Case]
Please refer to [Test steps] section below.
[Regression Potential]
The fix ed768ab is already in the upstream main, stable/2024.1, stable/2023.2 branches, so it is a clean backport and might be helpful for deployments using dashboard.
Regressions would likely manifest in the users/groups tabs when listing users.
[Others]
Original Bug Description Below
===========
We are not able to see the list of users assigned to a project in Horizon.
Scenario:
- Log in as Cloud Admin
- Set Domain Context (k8s)
- Go to projects section
- Click on project Permissions_
- Go to Users
Expectation: Get a table with the users assigned to this project.
Result: Get an error - https:/
[Test steps]
1, Create an ordinary openstack test env with horizon.
2, Prepared some test data (eg: one domain k8s, one project k8s, and one user k8s-admain with the role k8s-admin-role)
openstack domain create k8s
openstack role create k8s-admin-role
openstack project create --domain k8s k8s
openstack user create --project-domain k8s --project k8s --domain k8s --password password k8s-admin
openstack role add --user k8s-admin --user-domain k8s --project k8s --project-domain k8s k8s-admin-role
$ openstack role assignment list --project k8s --names
+------
| Role | User | Group | Project | Domain | System | Inherited |
+------
| k8s-admin-role | k8s-admin@k8s | | k8s@k8s | | | False |
+------
3, Log in horizon dashboard with admin user(eg: admin/openstack
4, Click 'Identity -> Domains' to set domain context to the domain 'k8s'.
5, Click 'Identity -> Project -> k8s project -> Users'.
6, This is the result, it said 'Unable to disaply the users of this project' - https:/
7, These are some logs
==> /var/log/
[Fri Feb 23 10:03:12.201024 2024] [wsgi:error] [pid 47342:tid 140254008985152] [remote 10.5.3.120:58978] Recoverable error: 'e900b8934d1145
==> /var/log/
10.5.3.120 - - [23/Feb/
[Some Analyses]
This action will call this function in horizon [1].
This function will firstly get a list of users (api.keystone.
Without setting domain context, this works fine.
However, if setting domain context, the project displayed is in a different domain.
The user list from [2] only contains users of the user's own domain, while the role assignment list [3] includes users in another domain since the project is in another domain.
From horizon's debug log, here is an example of user list:
{"users": [{"email": "juju@localhost", "id": "8cd8f92ac2f941
Here is an example of role assignment list:
{"role_
Then later in the horizon function, it tries to get user details from user list for users in role assignment list [4], and fails,
because users in role assignment list don't exist in user list.
Horizon throws an error like:
[Fri Feb 23 10:03:12.201024 2024] [wsgi:error] [pid 47342:tid 140254008985152] [remote 10.5.3.120:58978] Recoverable error: 'e900b8934d1145
This id is the id of a user, which is used as a key to find a user in the user list.
But user list doesn't have this id, so it fails.
[1] https:/
[2] https:/
[3] https:/
[4] https:/
Related branches
- Ubuntu Sponsors: Pending requested
- git-ubuntu import: Pending requested
-
Diff: 9481 lines (+4373/-1) (has conflicts)133 files modified.zuul.d/base.yaml (+4/-0)
.zuul.d/nodejs-jobs.yaml (+8/-0)
.zuul.d/project.yaml (+17/-0)
.zuul.d/tempest-and-integrated.yaml (+20/-0)
.zuul.d/xstatic-master.yaml (+5/-0)
AUTHORS (+20/-0)
ChangeLog (+53/-0)
PKG-INFO (+130/-0)
debian/changelog (+11/-0)
debian/patches/embedded-xstatic.patch (+12/-0)
debian/patches/fix-dashboard-manage.patch (+7/-0)
debian/patches/fix-horizon-test-settings.patch (+7/-0)
debian/patches/series (+4/-0)
debian/patches/ubuntu_settings.patch (+48/-0)
doc/requirements.txt (+6/-0)
doc/source/configuration/settings.rst (+24/-0)
doc/source/contributor/ref/tables.rst (+19/-0)
doc/source/locale/en_GB/LC_MESSAGES/doc-configuration.po (+39/-0)
doc/source/locale/en_GB/LC_MESSAGES/doc-contributor.po (+80/-0)
doc/source/locale/en_GB/LC_MESSAGES/doc-install.po (+31/-0)
horizon.egg-info/PKG-INFO (+130/-0)
horizon.egg-info/SOURCES.txt (+17/-0)
horizon.egg-info/entry_points.txt (+3/-0)
horizon.egg-info/pbr.json (+5/-1)
horizon.egg-info/requires.txt (+17/-0)
horizon/exceptions.py (+6/-0)
horizon/middleware/base.py (+7/-0)
horizon/tables/base.py (+12/-0)
horizon/test/unit/middleware/test_base.py (+15/-0)
horizon/utils/csvbase.py (+7/-0)
openstack_auth/backend.py (+8/-0)
openstack_dashboard/api/keystone.py (+4/-0)
openstack_dashboard/api/neutron.py (+198/-0)
openstack_dashboard/api/placement.py (+16/-0)
openstack_dashboard/api/rest/config.py (+12/-0)
openstack_dashboard/dashboards/admin/aggregates/workflows.py (+4/-0)
openstack_dashboard/dashboards/admin/networks/subnets/tests.py (+12/-0)
openstack_dashboard/dashboards/admin/networks/tables.py (+10/-0)
openstack_dashboard/dashboards/admin/networks/tests.py (+72/-0)
openstack_dashboard/dashboards/admin/networks/views.py (+10/-0)
openstack_dashboard/dashboards/identity/application_credentials/forms.py (+5/-0)
openstack_dashboard/dashboards/identity/projects/tabs.py (+27/-0)
openstack_dashboard/dashboards/identity/projects/tests.py (+48/-0)
openstack_dashboard/dashboards/identity/users/forms.py (+10/-0)
openstack_dashboard/dashboards/project/floating_ips/forms.py (+16/-0)
openstack_dashboard/dashboards/project/instances/tests.py (+4/-0)
openstack_dashboard/dashboards/project/instances/utils.py (+4/-0)
openstack_dashboard/dashboards/project/instances/workflows/update_instance.py (+4/-0)
openstack_dashboard/dashboards/project/network_topology/tests.py (+14/-0)
openstack_dashboard/dashboards/project/network_topology/views.py (+8/-0)
openstack_dashboard/dashboards/project/networks/subnets/tests.py (+36/-0)
openstack_dashboard/dashboards/project/networks/subnets/views.py (+8/-0)
openstack_dashboard/dashboards/project/networks/tables.py (+14/-0)
openstack_dashboard/dashboards/project/networks/tabs.py (+4/-0)
openstack_dashboard/dashboards/project/networks/templates/networks/_detail_overview.html (+6/-0)
openstack_dashboard/dashboards/project/networks/tests.py (+167/-0)
openstack_dashboard/dashboards/project/networks/views.py (+15/-0)
openstack_dashboard/dashboards/project/routers/tests.py (+4/-0)
openstack_dashboard/dashboards/project/volumes/forms.py (+21/-0)
openstack_dashboard/dashboards/project/volumes/tables.py (+5/-0)
openstack_dashboard/dashboards/project/volumes/templates/volumes/_show_transfer.html (+3/-0)
openstack_dashboard/dashboards/project/volumes/tests.py (+19/-0)
openstack_dashboard/dashboards/project/volumes/urls.py (+7/-0)
openstack_dashboard/dashboards/project/volumes/views.py (+58/-0)
openstack_dashboard/dashboards/settings/user/forms.py (+17/-0)
openstack_dashboard/exceptions.py (+16/-0)
openstack_dashboard/locale/as/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/bn_IN/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/brx/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/cs/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/de/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/en_AU/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/en_GB/LC_MESSAGES/django.po (+102/-0)
openstack_dashboard/locale/en_GB/LC_MESSAGES/djangojs.po (+50/-0)
openstack_dashboard/locale/eo/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/es/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/fr/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/gu/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/hi/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/id/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/it/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/ja/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/ka_GE/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/kn/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/ko_KR/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/kok/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/ks/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/mai/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/mni/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/mr/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/ne/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/pa_IN/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/pl_PL/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/pt_BR/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/ru/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/ta/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/tr_TR/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/ur/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/zh_Hans/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/locale/zh_Hant/LC_MESSAGES/django.po (+7/-0)
openstack_dashboard/settings.py (+9/-0)
openstack_dashboard/test/integration_tests/decorators.py (+12/-0)
openstack_dashboard/test/integration_tests/helpers.py (+8/-0)
openstack_dashboard/test/selenium/integration/conftest.py (+71/-0)
openstack_dashboard/test/selenium/integration/test_credentials.py (+14/-0)
openstack_dashboard/test/selenium/integration/test_floatingips.py (+25/-0)
openstack_dashboard/test/selenium/integration/test_images.py (+182/-0)
openstack_dashboard/test/selenium/integration/test_instances.py (+367/-0)
openstack_dashboard/test/selenium/integration/test_routers.py (+10/-0)
openstack_dashboard/test/selenium/integration/test_volume_snapshots.py (+62/-0)
openstack_dashboard/test/selenium/integration/test_volumes.py (+78/-0)
openstack_dashboard/test/selenium/ui/conftest.py (+34/-0)
openstack_dashboard/test/selenium/ui/test_browse.py (+151/-0)
openstack_dashboard/test/selenium/ui/test_hypervisors.py (+97/-0)
openstack_dashboard/test/selenium/ui/test_settings.py (+47/-0)
openstack_dashboard/test/selenium/widgets.py (+35/-0)
openstack_dashboard/test/test_data/neutron_data.py (+279/-0)
openstack_dashboard/test/unit/api/rest/test_network.py (+6/-0)
openstack_dashboard/test/unit/api/test_network.py (+23/-0)
openstack_dashboard/test/unit/api/test_neutron.py (+295/-0)
openstack_dashboard/utils/filters.py (+7/-0)
releasenotes/notes/remove-py38-6914ddb9fdf4cacd.yaml (+5/-0)
releasenotes/source/2024.1.rst (+6/-0)
releasenotes/source/index.rst (+4/-0)
releasenotes/source/locale/de/LC_MESSAGES/releasenotes.po (+7/-0)
releasenotes/source/locale/en_GB/LC_MESSAGES/releasenotes.po (+131/-0)
releasenotes/source/locale/fr/LC_MESSAGES/releasenotes.po (+280/-0)
releasenotes/source/locale/id/LC_MESSAGES/releasenotes.po (+37/-0)
releasenotes/source/locale/ja/LC_MESSAGES/releasenotes.po (+25/-0)
releasenotes/source/zed.rst (+4/-0)
requirements.txt (+22/-0)
setup.cfg (+10/-0)
test-requirements.txt (+4/-0)
description: | updated |
Changed in horizon: | |
assignee: | nobody → Hua Zhang (zhhuabj) |
tags: | added: sts |
description: | updated |
tags: |
added: verification-caracal-done removed: verification-caracal-needed |
Changed in cloud-archive: | |
status: | Fix Released → Fix Committed |
I did some analysis according the data in https:/ /paste. openstack. org/show/ bnaAKV0YXlVn088 MvsFB/
1, 'users = api.keystone. user_list( self.request) ' gets the user admin(3436fc62a 232444597496d57 e5f4b5fc)
2, 'project_ users_roles = api.keystone. get_project_ users_roles( self.request, project= project_ id)' gets
defaultdict(<class 'list'>, {'e900b8934d114 58b8eb9db21671c 1b11': ['a6ab948d1f794 7a98e2363f14af1 0fbb']} )
# openstack role add --user k8s-admin --user-domain k8s --project k8s --project-domain k8s k8s-admin-role ------- ------- ------- ------- +------ ------- ------- ------- ------- +------ -+----- ------- ------- ------- ------- -+----- ---+--- -----+- ------- ---+ ------- ------- ------- ------- +------ ------- ------- ------- ------- +------ -+----- ------- ------- ------- ------- -+----- ---+--- -----+- ------- ---+ 98e2363f14af10f bb | e900b8934d11458 b8eb9db21671c1b 11 | | 07123041ee0544e 0ab32e50dde780a fd | | | False | ------- ------- ------- ------- +------ ------- ------- ------- ------- +------ -+----- ------- ------- ------- ------- -+----- ---+--- -----+- ------- ---+ 98e2363f14af10f bb | k8s-admin-role |
$ openstack role assignment list --project k8s
+------
| Role | User | Group | Project | Domain | System | Inherited |
+------
| a6ab948d1f7947a
+------
$ openstack role list |grep k8s
| a6ab948d1f7947a
3, the user e900b8934d11458 b8eb9db21671c1b 11 (k8s-admin) is in the domain k8s
$ openstack user list --domain k8s ------- ------- ------- ------- +------ -----+ ------- ------- ------- ------- +------ -----+ b8eb9db21671c1b 11 | k8s-admin | ------- ------- ------- ------- +------ -----+
+------
| ID | Name |
+------
| e900b8934d11458
+------
not in the default domain
$ openstack user list ------- ------- ------- ------- +------ ----+ ------- ------- ------- ------- +------ ----+ 597496d57e5f4b5 fc | admin | 09e93c3179c9f8a 50 | demo | a8974c794826886 8d | alt_demo | ------- ------- ------- ------- +------ ----+
+------
| ID | Name |
+------
| 3436fc62a232444
| 7413f0a568fb414
| 2dcabd8e53e0424
+------
$ env |grep OS_ openstack API_VERSION= 3 DOMAIN_ NAME=admin_ domain NAME=RegionOne /10.5.1. 174:5000/ v3 DOMAIN_ NAME=admin_ domain PROTOCOL= https TYPE=password NAME=admin
OS_PASSWORD=
OS_IDENTITY_
OS_USER_
OS_REGION_
OS_AUTH_URL=https:/
OS_PROJECT_
OS_AUTH_
OS_USERNAME=admin
OS_AUTH_
OS_PROJECT_