keystone list project api returns empty if "?name=" is added as url parameter

[Xiaoliang Li]

request: https://{{keystone_ip}}:5000/v3/projects?name=
expect: returns all projects of current user.
but: return empty.

Other OpenStack components obey this convention properly, so keystone is inconsistent with them.

[Kristi Nikolla (knikolla)]

Hi Xiaoliang,

By all other OpenStack components do you mean, for example, listing volumes in cinder? In that case doing /v3/<project_id>/volumes will return all the volumes that you have access to within the project your token is scoped to. In cinder too, doing "?name=" will give you an empty list, since it will be querying for a volume named exactly "" (empty).

The /v3/projects API is for admins only. So when it is performed by an admin it will return all the projects in keystone regardless of user. When you use the "?name=" filter, it will query for a project **matching** exactly the name "" (empty) and failing to find one will correctly return an empty list.

If you are looking to get all projects of the current user you should use /v3/auth/projects.

[Lance Bragstad (lbragstad)]

If you're looking for all projects a user has access to, we have a dedicated API for that per Kristi's comment:

  GET http://{keystone_url}/v3/auth/projects

Feel free to re-open this if you believe this behavior is causing a bug of some sort.

[Xiaoliang Li (caitsithx)]

Hi Kristi,

please try: https://{{keystone_ip}}:9696/v2.0/networks?name=

I mean it makes user very confusing.

[Xiaoliang Li (caitsithx)]

also try:
nova: https://{{keystone_ip}}:8774/v2.1/{{os_project_id}}/servers?name=

looks keystone is consistent with glance and cinder in an "openstack" way, while neutron is consistent with nova in another way which is more common.

it's very confusing.

[Xiaoliang Li (caitsithx)]

also for keystone:

https://{{keystone_ip}}:5000/v3/domains?enabled= is behaving differently, it returns all domains disregarding enabled/or disabled.

Thank you for Kristi's explanation. normally,

Since the url params are filtering strings, when the url param is appended but equals to <empty>, it implies that the filter is not applied. thus, it returns all values without filtering. I feel it's more a common way as nova/neutron is implemented.

[Lance Bragstad (lbragstad)]

Is this still an issue in cinder and glance? Is there any communication happening across projects to address this concern?

[Morgan Fainberg (mdrnstm)]

Unfortunately, we cannot change the behavior without a microversion uspport or something similar. ?name= will need to maintain returning an empty list, as that is the contract. I am closing this as wont fix.