Disable user lists without a filter

[Adam Young]

Depends on a solution to https://bugs.launchpad.net/keystone/+bug/1211582

Once Keystone can filter search results, it needs a config option the disables return results with no query, and instead returns an appropriate HTTP response code.

Probably: 412 Precondition Failed
a message body would also state: "reason": "filter_required"

[Dolph Mathews (dolph)]

That would probably be an abuse of 412... a 400 would be sufficient, though. Either way, the error condition should be defined in identity-api

[Steve Martinelli (stevemar)]

Wouldn't this be a massive change in behaviour?!

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/314829

[Samuel de Medeiros Queiroz (samueldmq)]

Can't this be restricted in the policy ? Seems better than adding lots of options to the server

[Lance Bragstad (lbragstad)]

Automatically unassigning due to inactivity. We have a patch in review but it looks like it needs some attention. I'll leave the bug "In Progress" but unassigning in the event someone else has the bandwidth to pick up the patch.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/392306

[OpenStack Infra (hudson-openstack)]

Change abandoned by ayoung (<email address hidden>) on branch: master
Review: https://review.openstack.org/392306
Reason: Will use https://review.openstack.org/#/c/314829/ instead

[Steve Martinelli (stevemar)]

I'm not convinced this is a good approach. I'd prefer to work with the horizon team to make sure the list users page posts a filter/search panel instead of trying to list everything.

[Steve Martinelli (stevemar)]

So, i believe the origin of this bug was a way to make horizon fall on the floor when a user navigates to the user panel, when keystone is backed by ldap. This has been addressed by the horizon team here: https://review.openstack.org/#/c/419133/

Changing behaviour based on a configuration option seems like a hack. Listing all users is fine, unless using LDAP, in which case, use filters. Let's make clients smarter and call the right APIs.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Lance Bragstad (<email address hidden>) on branch: master
Review: https://review.openstack.org/314829
Reason: This has gone a while without an update and based on the reasoning in the bug it doesn't sound like this is needed anymore.

https://bugs.launchpad.net/keystone/+bug/1211586