Roles lost in Folsom to Grizzly upgrade
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Identity (keystone) |
Fix Released
|
Critical
|
Adam Young |
Bug Description
In a Folsom -> Grizzly upgrade I noticed my admin user wasn't authorised to admininster keystone any more. I had to hack my policy.json so I could interrogate keystone to find out why.
keystone user-role-list has one entry. Giving my admin user the '_member_' role:
| 9fe2ff9ee4384b1
So the "Admin" role was missing. Different roles are missing from other users too.
Original Folsom tables:
mysql> show tables;
+------
| Tables_in_keystone |
+------
| ec2_credential |
| endpoint |
| metadata |
| migrate_version |
| role |
| service |
| tenant |
| token |
| user |
| user_tenant_
+------
10 rows in set (0.00 sec)
From what I can tell, roles used to be stored in the 'metadata' table in Folsom.
mysql> describe metadata;
+------
| Field | Type | Null | Key | Default | Extra |
+------
| user_id | varchar(64) | NO | PRI | NULL | |
| tenant_id | varchar(64) | NO | PRI | NULL | |
| data | text | YES | | NULL | |
+------
3 rows in set (0.01 sec)
Sample row:
user_id: 671dcaba8087487
tenant_id: e4eee8dbc16a49d
data: {"roles": ["ce685d2405f14
At version 7 keystone adds a new 'user_domain_
user_
meta,
sql.Column(
sql.Column(
user_
At version 17 there's another similar-looking 'user_project_
If I drop the user_project_
Changed in keystone: | |
milestone: | none → grizzly-rc1 |
tags: | added: upgrade |
Changed in keystone: | |
importance: | Undecided → High |
Changed in keystone: | |
status: | New → In Progress |
Changed in keystone: | |
assignee: | Jason Cannavale (jcannava) → Dolph Mathews (dolph) |
Changed in keystone: | |
assignee: | Dolph Mathews (dolph) → Jason Cannavale (jcannava) |
Changed in keystone: | |
assignee: | Jason Cannavale (jcannava) → Adam Young (ayoung) |
Changed in keystone: | |
status: | Fix Committed → Fix Released |
Changed in keystone: | |
milestone: | grizzly-rc1 → 2013.1 |
Is this a duplicate of 1119789?