Wrong return code for inherited project role checking

[Rodrigo Duarte]

The documentation states that the return code to check inherited roles do projects is 200 OK [1], which isn't true (see comments below). All grant checks are done via the same method.

https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-inherit-ext.rst#check-if-user-has-an-inherited-project-role-on-project

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/137782

[Samuel de Medeiros Queiroz (samueldmq)]

I'm not against this particular change, but I'll probably be addressing every similar doc incompatibility when submitting patches to [1].

[1] https://bugs.launchpad.net/keystone/+bug/1402339

[Rodrigo Duarte (rodrigodsousa)]

This is *not* an exhaustive search for inconsistent return code. This bug was intent to fix a *known* issue. Second, the pointed bug was created *after* this bug.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Rodrigo Duarte (<email address hidden>) on branch: master
Review: https://review.openstack.org/137782
Reason: abandoning due out of place discussions.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/142065

[Brant Knudson (blk-u)]

I get 204 on my system:

$ curl -i -H "X-Auth-Token: $TOKEN" http://localhost:5000/v3/OS-INHERIT/domains/default/users/$USER_ID/roles/$ROLE_ID/inherited_to_projects
HTTP/1.1 204 No Content
Vary: X-Auth-Token
Content-Length: 0
Date: Thu, 15 Jan 2015 00:04:03 GMT

$ curl -i -I -H "X-Auth-Token: $TOKEN" http://localhost:5000/v3/OS-INHERIT/domains/default/users/$USER_ID/roles/$ROLE_ID/inherited_to_projects
HTTP/1.1 204 No Content
Vary: X-Auth-Token
Content-Length: 0
Date: Thu, 15 Jan 2015 00:04:20 GMT

$ curl -i -X HEAD -H "X-Auth-Token: $TOKEN" http://localhost:5000/v3/OS-INHERIT/domains/default/users/$USER_ID/roles/$ROLE_ID/inherited_to_projects
HTTP/1.1 204 No Content
Vary: X-Auth-Token
Content-Length: 0
Date: Thu, 15 Jan 2015 00:05:04 GMT

Why are you getting Content-Length: 334 ? I don't think there can be any content.

[Rodrigo Duarte (rodrigodsousa)]

Looks like I was checking the wrong URL (missed the $ROLE_ID). Seems that we have an inconsistency here, according to http://tools.ietf.org/html/rfc2616#section-10.2.1 the return must be 200 OK.

Can you easily check for inherited roles to projects in a project hierarchy (don't have a full setup in the moment).

What do you think?

[Brant Knudson (blk-u)]

I don't think there's an inconsistency with keystone's implementation and the RFC. If there's no body then the server should return 204 No Content.

The code is here: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/assignment/controllers.py#n565

All the calls go through the same code so I'd expect them all to respond the same way.

[Rodrigo Duarte (rodrigodsousa)]

As per http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html : "The HEAD method is identical to GET except that the server MUST NOT return a message-body in the response. The metainformation contained in the HTTP headers in response to a HEAD request SHOULD be identical to the information sent in response to a GET request." and http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html and https://developer.mozilla.org/en-US/docs/Web/HTTP/Response_codes (see 200 OK session), the return code should be same as for the GET method, but without a body, which I think it means the return should be a 200, not 204.

[Brant Knudson (blk-u)]

Rodrigo - The return for a GET request is already the same as the HEAD request. It's 204 No Content. This is what I posted in comment 6:

$ curl -i -H "X-Auth-Token: $TOKEN" http://localhost:5000/v3/OS-INHERIT/domains/default/users/$USER_ID/roles/$ROLE_ID/inherited_to_projects
HTTP/1.1 204 No Content

$ curl -i -I -H "X-Auth-Token: $TOKEN" http://localhost:5000/v3/OS-INHERIT/domains/default/users/$USER_ID/roles/$ROLE_ID/inherited_to_projects
HTTP/1.1 204 No Content

$ curl -i -X HEAD -H "X-Auth-Token: $TOKEN" http://localhost:5000/v3/OS-INHERIT/domains/default/users/$USER_ID/roles/$ROLE_ID/inherited_to_projects
HTTP/1.1 204 No Content

[Rodrigo Duarte (rodrigodsousa)]

Thanks for the clarification Brant =)

[OpenStack Infra (hudson-openstack)]

Change abandoned by Rodrigo Duarte (<email address hidden>) on branch: master
Review: https://review.openstack.org/142065
Reason: Not a bug, HEAD and GET returns the same status code:

$ curl -i -H "X-Auth-Token: $TOKEN" http://localhost:5000/v3/OS-INHERIT/domains/default/users/$USER_ID/roles/$ROLE_ID/inherited_to_projects
HTTP/1.1 204 No Content

$ curl -i -I -H "X-Auth-Token: $TOKEN" http://localhost:5000/v3/OS-INHERIT/domains/default/users/$USER_ID/roles/$ROLE_ID/inherited_to_projects
HTTP/1.1 204 No Content

$ curl -i -X HEAD -H "X-Auth-Token: $TOKEN" http://localhost:5000/v3/OS-INHERIT/domains/default/users/$USER_ID/roles/$ROLE_ID/inherited_to_projects
HTTP/1.1 204 No Content

[Lance Bragstad (lbragstad)]

Is this still valid to have as an open bug?

[Steve Martinelli (stevemar)]

Lance, seems like it's not valid, marking as invalid