keystone doesn't cleanly remove all data for a user when using SQL backend for Identity

[Joseph Heck]

Hello,

How can a user cleanly be removed from Keystone? Maybe I am missing a step - and I apologize if so - but I'm running into the following issue:

keystone tenant-create --name=ProjectX
keystone user-create --name=Foo --pass=password
keystone user-role-add --user=$USER_ID --tenant_id=$TENANT_ID --role=$ADMIN_ROLE_ID

In the SQL database, I can now see entries under the user, tenant, user_tenant_membership, and metadata tables.

Now, if I do

keystone user-delete $USER_ID

The entry is removed from the user table, but no other tables.

If I do

keystone user-role-remove --user=$USER_ID --tenant_id=$TENANT_ID --role=$ADMIN_ROLE_ID

The entry is removed from user_tenant_membership, but not the metadata table.

keystone user-delete $USER_ID

removes the user from the user table, but still not metadata.

If I add the user to more than one role, the user will stay in the user_tenant_membership table until all roles have been removed, but there is still an entry in metadata.

Is this a bug or am I missing a step for cleanly removing a user?

Thanks,
Joe

[yong sheng gong (gongysh)]

I think we should use foreign key and cascading deletion to make sure the clean deletion. In addition, since token table use extra column to save roles, tenants information, we will enhance auth process to deal with if the user, role or tenant has been deleted and then return the right information.
below is an extra field for a certain token:
{"metadata": {"roles": ["ca43893555be4153acc701568beeec8e", "85c54052d4dc41aba5d1671216766064", "3d3f2139ef514935ba698f40012ddaeb"]}, "user": {"email": "<email address hidden>", "enabled": true, "id": "44c3d88f257a4dc39790c318fcb1a2cc", "name": "admin", "tenantId": null}, "tenant": {"enabled": true, "id": "36cf36c3972a437890e5df7bf9805097", "name": "admin", "description": null}}

[PerlStalker (perlstalker)]

I'm seeing the same problem when a role is removed using keystone role-remove. The role ID remains in the json stored in the 'data' column.

[Michael Lin (michael-lin)]

I have the same problem :(

[Akira Yoshiyama (yosshy)]

Me too.

[Alan Pevec (apevec)]

user-delete should be fixed as a part of bug 973243

[Tihomir Trifonov (ttrifonov)]

The problem above results in unexpected behavior when calling user-role-list. If an user is being assigned to a role, and then the role is deleted, the user-role-list fails with 404:

$ keystone user-role-list --user-id 779d85b855824501a9d526a316ed63a5
Could not find role: 5bf8cf73290041bc8954dd123e1c959b (HTTP 404)

[Eduardo Patrocinio (epatro)]

The original bug has been fixed on https://bugs.launchpad.net/bugs/973243.

Working on the issue when the role is deleted, as reported on 2012-08-08.

[Eduardo Patrocinio (epatro)]

The original bug has already been fixed.

The issue reported on 2012-08-08:

$ keystone user-role-list --user-id 779d85b855824501a9d526a316ed63a5
Could not find role: 5bf8cf73290041bc8954dd123e1c959b (HTTP 404)

can't be recreated (keystone user-role-list --user-id <user_id> works properly after the role is deleted).

Rgds,

[gordon chung (chungg)]

cannot reproduce bug anymore. based on comments, bug is fixed.