Domain scope auth fails when use endpoint filter

[Martins Jakubovics]

When use endpoint_filter.sql catalog driver in Newton and authenticate with domain scope, we fail to receive endpoints. Should be all endpoints instead.

[Martins Jakubovics (martins-k)]

Looks like such backport are unable to include in upstream, so if someone have same issue, here are solution:

diff --git a/keystone/contrib/endpoint_filter/backends/catalog_sql.py b/keystone/contrib/endpoint_filter/backends/catalog_sql.py
index b3c2ac5..028df36 100644
--- a/keystone/contrib/endpoint_filter/backends/catalog_sql.py
+++ b/keystone/contrib/endpoint_filter/backends/catalog_sql.py
@@ -34,8 +34,10 @@ class EndpointFilterCatalog(sql.Catalog):

         services = {}

- dict_of_endpoint_refs = (self.catalog_api.
- list_endpoints_for_project(project_id))
+ dict_of_endpoint_refs = {}
+ if project_id:
+ dict_of_endpoint_refs = (self.catalog_api.
+ list_endpoints_for_project(project_id))

         if (not dict_of_endpoint_refs and
                 CONF.endpoint_filter.return_all_endpoints_if_no_filter):

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/492527

[Lance Bragstad (lbragstad)]

The EndpointFilter catalog was removed in Pike [0] and the issue isn't reproducible in stable/ocata.

[0] https://github.com/openstack/keystone/commit/d35f36916e109f0d2557bb778424e7aee3bc6b31

[OpenStack Infra (hudson-openstack)]

Change abandoned by Tony Breeds (<email address hidden>) on branch: stable/newton
Review: https://review.openstack.org/492527
Reason: This branch (stable/newton) is at End Of Life