Federation get unscoped token from assertion throws : ERROR tuple index out of range

[Haneef Ali]

Relevant line in the code
  https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py#L158

Relevant logs

keystone.contrib.federation.utils): 2015-03-25 02:40:06,920 DEBUG utils process rules: [{u'remote': [{u'type': u'openstack_user', u'any_one_of': [u'user1', u'admin']}], u'local': [{u'user': {u'name': u'{0}'}}, {u'group': {u'id': u'a9b7c29b5e2d4094a66e240d2827c622'}}]}]
(keystone.contrib.federation.utils): 2015-03-25 02:40:06,920 DEBUG utils _update_local_mapping direct_maps: <keystone.contrib.federation.utils.DirectMaps object at 0x7f2665054510>
(keystone.contrib.federation.utils): 2015-03-25 02:40:06,920 DEBUG utils _update_local_mapping local: {u'user': {u'name': u'{0}'}}
(keystone.contrib.federation.utils): 2015-03-25 02:40:06,920 DEBUG utils _update_local_mapping direct_maps: <keystone.contrib.federation.utils.DirectMaps object at 0x7f2665054510>
(keystone.contrib.federation.utils): 2015-03-25 02:40:06,920 DEBUG utils _update_local_mapping local: {u'name': u'{0}'}
(keystone.contrib.federation.utils): 2015-03-25 02:40:06,920 DEBUG utils __getitem__ []
(keystone.contrib.federation.utils): 2015-03-25 02:40:06,921 DEBUG utils __getitem__ 0
(keystone.common.wsgi): 2015-03-25 02:40:06,922 ERROR wsgi __call__ tuple index out of range
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/keystone/common/wsgi.py", line 239, in __call__
    result = method(context, **params)
  File "/usr/local/lib/python2.7/dist-packages/keystone/contrib/federation/controllers.py", line 267, in federated_authentication
    return self.authenticate_for_token(context, auth=auth)
  File "/usr/local/lib/python2.7/dist-packages/keystone/auth/controllers.py", line 377, in authenticate_for_token
    self.authenticate(context, auth_info, auth_context)
  File "/usr/local/lib/python2.7/dist-packages/keystone/auth/controllers.py", line 502, in authenticate
    auth_context)
  File "/usr/local/lib/python2.7/dist-packages/keystone/auth/plugins/mapped.py", line 70, in authenticate
    self.identity_api)
  File "/usr/local/lib/python2.7/dist-packages/keystone/auth/plugins/mapped.py", line 144, in handle_unscoped_token
    federation_api, identity_api)
  File "/usr/local/lib/python2.7/dist-packages/keystone/auth/plugins/mapped.py", line 193, in apply_mapping_filter
    mapped_properties = rule_processor.process(assertion)
  File "/usr/local/lib/python2.7/dist-packages/keystone/contrib/federation/utils.py", line 453, in process
    new_local = self._update_local_mapping(local, direct_maps)
  File "/usr/local/lib/python2.7/dist-packages/keystone/contrib/federation/utils.py", line 595, in _update_local_mapping
    new_value = self._update_local_mapping(v, direct_maps)
  File "/usr/local/lib/python2.7/dist-packages/keystone/contrib/federation/utils.py", line 597, in _update_local_mapping
    new_value = v.format(*direct_maps)
IndexError: tuple index out of range
(keystone.common.wsgi): 2015-03-25 02:40:06,922 ERROR tuple index out of range

[Steve Martinelli (stevemar)]

The mapping seems wrong, try something like: http://paste.openstack.org/show/196671/

[Haneef Ali (haneef)]

The exception doesn't haappen with new mapping

[Haneef Ali (haneef)]

Just a small correction. The mapping shown in pastebin should be "openstack_roles" and not "openstack_role"