GET /roles/{role_id}/users does not work as advertised

[Henry Nash]

The v3 api describes this api as follows:

List users with a role: GET /roles/{role_id}/users

query_string: page (optional) query_string: per_page (optional, default 30) query filter for "name", "enabled", "email" (optional)

Response:

Status: 200 OK

[
    {
        "default_project_id": "--default-project-id--",
        "description": "a user",
        "domain_id": "--domain-id--",
        "email": "...",
        "enabled": true,
        "id": "--user-id--",
        "links": {
            "self": "http://identity:35357/v3/users/--user-id--"
        },
        "name": "admin"
    },
    {
        "default_project_id": "--default-project-id--",
        "description": "another user",
        "domain_id": "--domain-id--",
        "email": "...",
        "enabled": true,
        "id": "--user-id--",
        "links": {
            "self": "http://identity:35357/v3/users/--user-id--"
        },
        "name": "someone"
    }
]

In reality we don't support this call in either the v2 or v3 apis - and it was meant to have been removed I think as part of the move away from global roles. Unlike the related bug for GET /user/{user_id}/roles (https://bugs.launchpad.net/keystone/+bug/1183430 - which I think we should still support), I am not sure we really should continue to support the call above. If we did, then the output would need to somehow contain the target of the assignment.

[Dolph Mathews (dolph)]

https://review.openstack.org/32150

[Henry Nash (henry-nash)]

This api call is no longer supported (and should have been removed from the API specification). A more generic API call that enables the same function is provided (GET /role_assignments) from Identity version 3.1 onwards.