Resolving the members of a group with no members in LDAP throws an exception

[Jose Castro Leon]

In an environment with an ldap server as identity backend, if a group with no members has a role on a project, if you try to resolve the memberships on a specific project it will throw an exception.

This is caused as when searching from members in a group in LDAP, if it does not have any it returns empty and in the code is always assuming that there is at least an object returned

[Lance Bragstad (lbragstad)]

I could see where keystone could handle this a bit better. Is this no longer a concern?

[Lance Bragstad (lbragstad)]

Actually - I'm attempting to recreate this locally, but I'm unable to get it to throw an error. I have a group in a Users domain that has a role assignment on a project within that same domain. There are no users in the group.

At that point, is there a specific API you're calling that causes this to fail?