Cleaning up user/group assignments makes incorrect assumption that user_id != group_id

[Henry Nash]

The methods delete_user_assignments() and delete_group_assignments() in the assignment backends removes all assignments for a user/group - although the code fails to set the type of assignment, and just uses actor_id. This is nearly always going to be fine, although technically one should also specify the type of the assignment in the delete (e.g. USER_PROJECT/USER_DOMAIN and USER_PROJECT/GROUP_PROJECT).

[Lance Bragstad (lbragstad)]

Henry, I'm not seeing these methods in the current code base. These are what I've found:

keystone/assignment/backends/ldap.py: def delete_project_assignments(self, project_id):
keystone/assignment/backends/ldap.py: def delete_role_assignments(self, role_id):
keystone/assignment/backends/sql.py: def delete_project_assignments(self, project_id):
keystone/assignment/backends/sql.py: def delete_role_assignments(self, role_id):
keystone/assignment/core.py: def delete_tokens_for_role_assignments(self, role_id):
keystone/assignment/core.py: def delete_project_assignments(self, project_id):
keystone/assignment/core.py: def delete_role_assignments(self, role_id):
keystone/assignment/core.py: self.assignment_api.delete_tokens_for_role_assignments(role_id)
keystone/assignment/core.py: self.assignment_api.delete_role_assignments(role_id)
keystone/resource/core.py: self.assignment_api.delete_project_assignments(tenant_id)

[Henry Nash (henry-nash)]

Ahh, sorry, yes - today in the code base they are (confusingly) called delete_user and delete_group (this is in the assignment backend). I have a separate bug logged to change these to delete_user_assignments and delete_group_assignments (see: https://bugs.launchpad.net/keystone/+bug/1438517)

[Steve Martinelli (stevemar)]

unassigning due to inactivity

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/275706

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/282696

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/282696
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=809e5533ccdbffcc73ef9c6bda158e7f8386bb08
Submitter: Jenkins
Branch: master

commit 809e5533ccdbffcc73ef9c6bda158e7f8386bb08
Author: Clenimar Filemon <email address hidden>
Date: Sat Feb 20 12:47:24 2016 -0300

    Fix incorrect assumption when deleting assignments

    The methods delete_user_assignments() and delete_group_assignments()
    in the assignment backend remove all assignments for a user/group -
    although the code fails to set the type of assignment and just uses
    actor_id, making an assumption that user_id != group_id.

    This patch specifies the type of assignments in the delete (i.e
    USER_PROJECT/USER_DOMAIN or GROUP_PROJECT/GROUP_DOMAIN) to make sure
    no assignment will be mistakenly deleted.

    Change-Id: I246a61a291dd41490f49b7b26a04f93e69e61d7a
    Closes-Bug: #1440135

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/keystone 9.0.0.0b3 development milestone.