Creating a user/group/project without a domain should be deprecated (or even raise an exception)

Bug #1482330 reported by Henry Nash
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Medium
Henry Nash

Bug Description

According to the API spec, you must supply a domain for a user, group or project on create. You can do this either by specifying it explicitly in the object or by using a domain scoped token. Although the spec doesn't say this explicitly, one would expect an exception to be raised if you don't do either the these (e.g. try using a project scoped token). However, due to a long fixed bug (1283539) in a heat tempest, we actually fall back and try and use the default domain (which may still fail of course if you don't have a role on the default domain).

This fall back is neither in the spec nor is it sensible in the long run. We should raise a ValidationError in the situation when no domain is specified.

The only one concern I have is whether someone might have discovered this fall back in the field....and so there is an argument as to whether we should add deprecation warning if we detect this situation for a cycle?

Whatever we decide, we should make the identity spec clearer as to what happens in this situation.

Henry Nash (henry-nash)
summary: - Creating a user/group without a domain should raise an exception
+ Creating a user/group/project without a domain should raise an exception
Changed in keystone:
assignee: nobody → Henry Nash (henry-nash)
Changed in keystone:
status: New → In Progress
Dolph Mathews (dolph)
Changed in keystone:
importance: Undecided → Medium
tags: added: user-experience
Henry Nash (henry-nash)
description: updated
Revision history for this message
Henry Nash (henry-nash) wrote : Re: Creating a user/group/project without a domain should raise an exception

As discussed on IRC, we should probably deprecate this functionality first, in case someone has fallen into the trap of using it, before we explicitly remove it and raise an exception. We'll follow that up with a fix next cycle.

summary: - Creating a user/group/project without a domain should raise an exception
+ Creating a user/group/project without a domain should be deprecated (or
+ even raise an exception)
Changed in keystone:
assignee: Henry Nash (henry-nash) → Brant Knudson (blk-u)
Brant Knudson (blk-u)
Changed in keystone:
assignee: Brant Knudson (blk-u) → Henry Nash (henry-nash)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (master)

Reviewed: https://review.openstack.org/209848
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=9cf89cca7568aed04ce00433fde939446f8f80aa
Submitter: Jenkins
Branch: master

commit 9cf89cca7568aed04ce00433fde939446f8f80aa
Author: Henry Nash <email address hidden>
Date: Thu Aug 6 10:50:31 2015 +0100

    Issue deprecation warning if domain_id not specified in create call

    Due to a long-fixed bug in a heat tempest test, we failed to
    raise a validation error if a domain_id was not specified in
    a create call for a user, group or project. Instead, we tried
    the default domain. This is neither in the spec or what we
    want.

    Although we would like to remove this, in case any customers
    have discovered this undocumented feature, for now we just
    issue a deprecation warning, saying that we intend to remove
    this is during the N release.

    Closes-bug: #1482330
    Change-Id: Ib3fe50c49063a64146709e57ddbec6665e64160b

Changed in keystone:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in keystone:
milestone: none → liberty-rc1
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in keystone:
milestone: liberty-rc1 → 8.0.0
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers