Unable to list federated projects with unscoped token

[yangweiwei]

When I got the federated user project list, the error is as bellow:

2017-05-26 15:12:54.685 12742 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/wsgi.py", line 228, in __call__
2017-05-26 15:12:54.685 12742 ERROR keystone.common.wsgi result = method(req, **params)
2017-05-26 15:12:54.685 12742 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/controller.py", line 164, in inner
2017-05-26 15:12:54.685 12742 ERROR keystone.common.wsgi return f(self, request, *args, **kwargs)
2017-05-26 15:12:54.685 12742 ERROR keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/federation/controllers.py", line 480, in list_projects_for_user
2017-05-26 15:12:54.685 12742 ERROR keystone.common.wsgi request.auth_context['group_ids'])
2017-05-26 15:12:54.685 12742 ERROR keystone.common.wsgi KeyError: 'group_ids'
2017-05-26 15:12:54.685 12742 ERROR keystone.common.wsgi

and I have got the token scoped in domain.

My mapping rule is as bellow:

[
{
    "local": [
                {
                   "user": {
                        "name": "{0}",
                        "domain": {
                            "name": "{1}"
                        },
                        "type": "local"
                    }
                }
            ],
    "remote": [
        {
            "type": "openstack_user"
        },
        {
            "type": "openstack_user_domain"
        }
    ]
}
]

The error is that token is an unscoped token which is got from the API “/v3/OS-FEDERATION/identity_providers/keystone-idp/protocols/saml2/auth” and then the federated user want to get the projects from /v3/OS-FEDERATION/projects. But error occurs.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/468290

[Lance Bragstad (lbragstad)]

After reviewing this bug a bit more, I'm not sure we should allow the ability to list projects with a domain-scoped token. Domain-scoped tokens, as the name implies, are to be used within a specific domain. A domain contains projects but a federated user can have access to other projects in multiple domains. I don't think being able to list projects with a domain-scoped tokens makes sense in that case, because you're using a token scoped to a specific domain to get information *outside* of that domain.

I believe the KeyError here is coming from using GET /OS-FEDERATION/projects [0] instead of GET /auth/projects/. The GET /auth/projects API knows how to handle group ids and doesn't expect them to be in the token like the /OS-FEDERATION/projects API does. The /OS-FEDERATION/project and /OS-FEDERATION/domains APIs are both deprecated in favor of the /auth/projects and /auth/domains equivalents.

[0] https://github.com/openstack/keystone/blob/fece45d75c4ba893828cbdcbcccc6b97b8c06c68/keystone/federation/controllers.py#L477
[1] https://github.com/openstack/keystone/blob/fece45d75c4ba893828cbdcbcccc6b97b8c06c68/keystone/auth/controllers.py#L365

[Lance Bragstad (lbragstad)]

Marking this as invalid based on the findings above, but we can keep using the thread for discussion if you have more questions about how the various OS-FEDERATION APIs work.

[yangweiwei (496176919-6)]

The /OS-FEDERATION/project and /OS-FEDERATION/domains APIs are both deprecated. Why? I have seen it （/v3/OS-FEDERATION/projects） in https://developer.openstack.org/api-ref/identity/v3-ext/?expanded=request-an-unscoped-os-federation-token-detail,list-projects-a-federated-user-can-access-detail.

Maybe it is used for dealing with local and federated user differently.

[Lance Bragstad (lbragstad)]

From the link above:

"Deprecated in v1.1. Use core GET /auth/projects. This call has the same response format."

Can you recreate the issue above with the GET /auth/projects or GET /auth/domains APIs?

[Lance Bragstad (lbragstad)]

Turns out we formally deprecated those APIs a long time ago. I did some digging and found the original commit to the documentation [0]. I proposed a patch that updates keystone to emit deprecation warnings on that API [1].

[0] https://review.openstack.org/#/c/115423/
[1] https://review.openstack.org/#/c/487219/

[Lance Bragstad (lbragstad)]

Is there still an issue here? The bug title changed from what is being described in the bug description.

[OpenStack Infra (hudson-openstack)]

Change abandoned by yangweiwei (<email address hidden>) on branch: master
Review: https://review.openstack.org/468290

[OpenStack Infra (hudson-openstack)]

Change abandoned by yangweiwei (<email address hidden>) on branch: master
Review: https://review.openstack.org/469318

[Lance Bragstad (lbragstad)]

Automatically unassigning due to inactivity.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]