openid method failed when federation_group_ids is empty list

[norman shen]

LOG:
2019-12-17 02:25:09.269827 2019-12-17 02:25:09.269 10 INFO keystone.common.wsgi [req-521eb002-385e-4015-8035-16bfbdcf0d33 - - - - -] POST http://keystone.openstack.svc.region-guiyang-zyy.myinspurcloud.com/v3/auth/tokens
2019-12-17 02:25:09.270180 2019-12-17 02:25:09.269 10 INFO keystone.common.wsgi [req-521eb002-385e-4015-8035-16bfbdcf0d33 - - - - -] POST http://keystone.openstack.svc.region-guiyang-zyy.myinspurcloud.com/v3/auth/tokens
2019-12-17 02:25:09.298401 2019-12-17 02:25:09.297 10 WARNING keystone.common.fernet_utils [req-521eb002-385e-4015-8035-16bfbdcf0d33 - - - - -] key_repository is world readable: /etc/keystone/fernet-keys/: NeedRegenerationException
2019-12-17 02:25:09.298764 2019-12-17 02:25:09.297 10 WARNING keystone.common.fernet_utils [req-521eb002-385e-4015-8035-16bfbdcf0d33 - - - - -] key_repository is world readable: /etc/keystone/fernet-keys/: NeedRegenerationException
2019-12-17 02:25:09.344893 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi [req-521eb002-385e-4015-8035-16bfbdcf0d33 - - - - -] 'NoneType' object is not iterable: TypeError: 'NoneType' object is not iterable
2019-12-17 02:25:09.344916 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi Traceback (most recent call last):
2019-12-17 02:25:09.344921 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/common/wsgi.py", line 148, in __call__
2019-12-17 02:25:09.344925 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi result = method(req, **params)
2019-12-17 02:25:09.344929 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/auth/controllers.py", line 67, in authenticate_for_token
2019-12-17 02:25:09.344934 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi self.authenticate(request, auth_info, auth_context)
2019-12-17 02:25:09.344938 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/auth/controllers.py", line 236, in authenticate
2019-12-17 02:25:09.344942 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi auth_info.get_method_data(method_name))
2019-12-17 02:25:09.344945 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/auth/plugins/mapped.py", line 58, in authenticate
2019-12-17 02:25:09.344949 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi PROVIDERS.identity_api)
2019-12-17 02:25:09.344953 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/auth/plugins/mapped.py", line 80, in handle_scoped_token
2019-12-17 02:25:09.344957 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi for group_dict in token.federated_groups:
2019-12-17 02:25:09.344961 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi TypeError: 'NoneType' object is not iterable
2019-12-17 02:25:09.344965 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi
2019-12-17 02:25:09.345666 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi [req-521eb002-385e-4015-8035-16bfbdcf0d33 - - - - -] 'NoneType' object is not iterable: TypeError: 'NoneType' object is not iterable
2019-12-17 02:25:09.345681 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi Traceback (most recent call last):
2019-12-17 02:25:09.345686 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/common/wsgi.py", line 148, in __call__
2019-12-17 02:25:09.345690 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi result = method(req, **params)
2019-12-17 02:25:09.345694 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/auth/controllers.py", line 67, in authenticate_for_token
2019-12-17 02:25:09.345698 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi self.authenticate(request, auth_info, auth_context)
2019-12-17 02:25:09.345702 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/auth/controllers.py", line 236, in authenticate
2019-12-17 02:25:09.345706 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi auth_info.get_method_data(method_name))
2019-12-17 02:25:09.345710 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/auth/plugins/mapped.py", line 58, in authenticate
2019-12-17 02:25:09.345714 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi PROVIDERS.identity_api)
2019-12-17 02:25:09.345718 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi File "/var/lib/openstack/local/lib/python2.7/site-packages/keystone/auth/plugins/mapped.py", line 80, in handle_scoped_token
2019-12-17 02:25:09.345722 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi for group_dict in token.federated_groups:
2019-12-17 02:25:09.345726 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi TypeError: 'NoneType' object is not iterable
2019-12-17 02:25:09.345730 2019-12-17 02:25:09.343 10 ERROR keystone.common.wsgi
10.16.4.45 - - [17/Dec/2019:02:25:09 +0000] "POST /v3/auth/tokens HTTP/1.1" 400 96 "-" "curl/7.58.0"

OpenStack Version:

Rocky

We are hitting this error message when using keystone federation. The mapping is simple as follow:

[
   {
      "remote":[
         {
            "type":"REMOTE_USER"
         },
         {
            "type":"OIDC-project"
         }
      ],
      "local":[
         {
            "user":{
               "name":"{0}"
            }
         },
         {
            "projects":[
               {
                  "name":"{1}",
                  "roles":[
                     {
                        "name":"member"
                     }
                  ]
               }
            ]
         }
      ]
   }
]

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/699927

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/699927
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=f0d964e66675037d62ad17847a966e71720dbd54
Submitter: Zuul
Branch: master

commit f0d964e66675037d62ad17847a966e71720dbd54
Author: shenjiatong <email address hidden>
Date: Thu Dec 19 13:38:32 2019 +0800

    Fix token auth error if federated_groups_id is empty list

    `federation_group_ids` could be zero length list, so deciding whether
    a token is federated by checking if it is none.

    Change-Id: I0f4b9e24d949aa4838ee721a165999b29c684d32
    Closes-Bug: #1856962

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/700863

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/700864

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/700863
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=c0d5162288f9985f1a15a7c865e0ba688df428ec
Submitter: Zuul
Branch: stable/train

commit c0d5162288f9985f1a15a7c865e0ba688df428ec
Author: shenjiatong <email address hidden>
Date: Thu Dec 19 13:38:32 2019 +0800

    Fix token auth error if federated_groups_id is empty list

    `federation_group_ids` could be zero length list, so deciding whether
    a token is federated by checking if it is none.

    Change-Id: I0f4b9e24d949aa4838ee721a165999b29c684d32
    Closes-Bug: #1856962
    (cherry picked from commit f0d964e66675037d62ad17847a966e71720dbd54)

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Douglas Mendizábal <email address hidden>" on branch: stable/stein
Review: https://review.opendev.org/c/openstack/keystone/+/700864
Reason: Abandoning unmerged stable/stein changes.