Neutron-LBaaS v2: Invalid tenant id accepted on "add member to pool"

[Franklin Naval]

1. Create load balancer as an admin.
2. Create pool as an admin.
3. As an admin, add member to pool but using an invalid tenant id. (e.g., "$232!$pw" )

Result: API returns 201
Expected: API should return BadRequest 400

Log:
    2016-04-19 00:51:53,500 3286 INFO [tempest.lib.common.rest_client] Request (MembersTestAdmin:test_create_member_invalid_tenant_id): 201 POST http://127.0.0.1:9696/v2.0/lbaas/pools/1bd85f26-1415-46f0-9a46-3630263fab5b/members 0.625s
    2016-04-19 00:51:53,500 3286 DEBUG [tempest.lib.common.rest_client] Request - Headers: {'Accept': 'application/json', 'X-Auth-Token': '<omitted>', 'Content-Type': 'application/json'}
            Body: {"member": {"tenant_id": "$232!$pw", "address": "10.0.0.8", "subnet_id": "c0239aee-c594-42a8-beac-fc6faf980e21", "protocol_port": 80}}
        Response - Headers: {'content-type': 'application/json', 'date': 'Tue, 19 Apr 2016 00:51:53 GMT', 'x-openstack-request-id': 'req-89a0cc84-8ff5-401c-973b-b7b104687e51', 'content-length': '229', 'status': '201', 'connection': 'close'}
            Body: {"member": {"name": "", "weight": 1, "admin_state_up": true, "subnet_id": "c0239aee-c594-42a8-beac-fc6faf980e21", "tenant_id": "$232!$pw", "address": "10.0.0.8", "protocol_port": 80, "id": "597d46fd-1de8-41a5-93f5-cda5c84838e3"}}

[Doug Wiegley (dougwig)]

This was discussed in a neutron meeting about six months ago, with the decision to not validate the tenant. I don't agree, but that was the decision.

[Franklin Naval (franknaval)]

However, tenant_id checking is apparently working when creating health monitors, load balancers, pools and listeners. It does not appear to checking when creating a member. The API checks should be consistent across all the resources.

[Franklin Naval (franknaval)]

at the very least, the api should check that the tenant id is a valid uuid

[Doug Wiegley (dougwig)]

I'd suggest adding this to the the on-demand meeting agenda for neutron. I'm not opposed to that, but none of the other extensions do so at present.