possible to grant role to user on domain/project when this domain/user was disabled

[Wei Xiaoli]

when domain/user was disabled, we still can grant role to user on domain/project, but doc shows these operations should not be allowed.

see doc: http://docs.openstack.org/api/openstack-identity-service/3/content/domains-v3domains.html
{
...
Setting this attribute to false prevents users from authorizing against this domain or any projects owned by this domain, and prevents users owned by this domain from authenticating or receiving any other authorization. Additionally, all pre-existing tokens applicable to the above entities are immediately invalidated. Re-enabling a domain does not re-enable pre-existing tokens.
}

(morganfainberg): It is likely the documentation should be updated as well to make the expected behavior a bit more clear.

[Rodrigo Duarte (rodrigodsousa)]

I think the docs are correct since it states that the user is not allowed to get a token, but, I'm not sure if granting a role should be authorized or not (which is not what the docs are saying).

[Wei Xiaoli (xiao-li-wei)]

Hi Rodrigo,

Thank you for your comments. :)

Could you let me know if we can grant role to user on domain/project when the domain/user was disabled, if yes, and we can leave this bug as it and need to correct the doc[prevent users from receiving any other authorization], if not, we need to fix this bug in code to forbidden role assignment operation on this user. am I right?

Thanks,
Lily

[Morgan Fainberg (mdrnstm)]

I think the documents are correct, the behavior is incorrect. We should fix the behavior.

[Wei Xiaoli (xiao-li-wei)]

Thanks, Morgan!

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/141746

[Brant Knudson (blk-u)]

I don't see why this is an issue... who is it hurting to be able to create a role assignment on a disabled project or domain?

[wanghong (w-wanghong)]

In my opinion, disable it means you can't do anything on it except enable it again.

[wanghong (w-wanghong)]

But, in current keystone, disabled a user/project/domain just means you can't get token any more. So, I don't sure if this is an issue.

[OpenStack Infra (hudson-openstack)]

Change abandoned by wanghong ([e-mail]) on branch: master
Review: https://review.openstack.org/141746

[Steve Martinelli (stevemar)]

Adding a role to a disabled user/group should be fine. Authentication will still fail for the user if she is disabled or the project is disabled.

[Henry Nash (henry-nash)]

In fact being able to "prepare the assignments" for the domain before enabling it, might well be common practice, and hence the current functionality is desirable.