Update user name not supported by LDAP identity driver

[Ya Hong Du]

Run command keystone help user-update, know that user name can be updated.
[root@localhost ~]# keystone help user-update
usage: keystone user-update [--name <user-name>] [--email <email>]
                            [--enabled <true|false>]
                            <user>

Update user's name, email, and enabled status

Arguments:
  --name <user-name> Desired new user name
  --email <email> Desired new email address
  --enabled <true|false>
                        Enable or disable user
  <user> Name or ID of user to update

Update username from yahongdu to yhd, but failed
[root@localhost ~]# keystone user-update --name yhd yahongdu
Unable to update user: Cannot change user name (HTTP 409)

[Ya Hong Du (yahongdu)]

/usr/lib/python2.6/site-packages/keystone/identity/backends/ldap.py

def update_user(self, user_id, user):
        user = self.assignment_api._validate_default_domain(user)
        if 'id' in user and user['id'] != user_id:
            raise exception.ValidationError('Cannot change user ID')
        old_obj = self.user.get(user_id)
        if 'name' in user and old_obj.get('name') != user['name']:
            raise exception.Conflict('Cannot change user name')

This is the code that cause this issue. I will remove the check for name. If anyone has any other concern, please let me know.

[Ya Hong Du (yahongdu)]

Code change in this code review.
https://review.openstack.org/#/c/41603/1

[Adam Young (ayoung)]

As you can see from the original code, this was a deliberate implementation decision. Neither the SQL nor the LDAP code allows modification of the usernames. Please respond here why you need this change.

[Ya Hong Du (yahongdu)]

Some reasons to allow change user name.

1. SQL backend allows to change user name (tested) 2. keystone CLI allows to change user name 3. I think we should not allow changing name to existing names by conflict check, but if the name is changed to a new name, I don't see a reason to not allow it.

[Adam Young (ayoung)]

It is more likely as mistake that the SQL allows modification of the User Name than that we do not. Since Username is a unique identifier through the system, modification can have significant consequences. However, the business rule probably should be enforced by the LDAP backend, and not by Keystone.

[Dolph Mathews (dolph)]

Unassigning due to inactivity.

[Ya Hong Du (yahongdu)]

I will be out of the office starting 01/26/2014 and will not return until
02/10/2014.

I will respond to your message when I return.

[Dolph Mathews (dolph)]

Related: https://bugs.launchpad.net/keystone/+bug/1136403

[Mahesh Sawaiker (mahesh-sawaiker)]

I also think modification of name should be allowed, especially since the database driver allows it.

[Dolph Mathews (dolph)]

Mahesh: FWIW, most LDAP deployments of keystone only have read-only access to the directory anyway. This sounds like a feature addition more-so than a bug fix to me.

[Mahesh Sawaiker (mahesh-sawaiker)]

I think that can be controlled by the allow user update flag in keystone.conf.
So really it seems ok to allow the update of the user name.

[David Stanek (dstanek)]

I agree with Dolph that this really should be a blueprint to describe and track the new feature.

[Steve Martinelli (stevemar)]

write support for the identity ldap backend is being deprecated