The "create" action from the "openstack_user" resource defined in the "openstackclient" cookbook does not perform correct validation if the indicated user is from a domain other than "default".
From "cookbook-openstackclient/libraries/openstack_user.rb":
"
action :create do
user = new_resource.connection.users.find { |u| u.name == new_resource.user_name }
project = new_resource.connection.projects.find { |p| p.name == new_resource.project_name }
domain = new_resource.connection.domains.find { |u| u.name == new_resource.domain_name }
if user
log "User with name: \"#{new_resource.user_name}\" already exists"
"
I believe that the line "user = new_resource.connection.users.find { |u| u.name == new_resource.user_name }" does not find users from all domains, only users from the "default" domain or the domain related to the credentials used.
Therefore when the validation for the existence of the user is done, it always reports the user does not exist if the domain of the user is different.
Example:
The "openstack-orchestration::identity_registration" recipe creates users for the orchestration service using the "openstack_user" resource, so it creates the "heat_domain_admin" user in the "heat" domain, as shown below, and does it correctly.
# Create heat_domain_admin in domain heat
openstack_user stack_domain_admin do
domain_name heat_domain_name
password stack_domain_admin_password
connection_params connection_params
end
However when running this recipe for the second time, it fails because of this resource with the following error:
"
FATAL: Excon::Error::Conflict: openstack_user[heat_domain_admin] (openstack-orchestration::identity_registration line 168) had an error: Excon::Error::Conflict: Expected([201]) <=> Actual(409 Conflict)
excon.error.response
:body => "{\"error\": {\"message\": \"Conflict occurred attempting to store user - Duplicate entry found with name heat_domain_admin at domain ID 3164c1efabb64720a974db32618421d7.\", \"code\": 409, \"title\": \"Conflict\"}}"
:cookies => [
]
:headers => {
"Content-Length" => "201"
"Content-Type" => "application/json"
"Date" => "Tue, 24 Mar 2020 17:34:46 GMT"
"Server" => "Apache"
"Vary" => "X-Auth-Token"
"x-openstack-request-id" => "req-3f0eeef5-bdc9-4f36-8f69-1d4ca8459530"
}
:host => "127.0.0.1"
:local_address => "127.0.0.1"
:local_port => 48006
:path => "/v3/users"
:port => 5000
:reason_phrase => "Conflict"
:remote_ip => "127.0.0.1"
:status => 409
:status_line => "HTTP/1.1 409 Conflict\r\n"
"
It indicates that the "openstack_user" resource tried to create the user even though it already exists. However this resource should detect the existence of the user and report the user already exists, just like it happens with other users created in the "default" domain in this recipe:
"
* openstack_user[heat] action create
* log[User with name: "heat" already exists] action write
"
After reviewing the code in "cookbook-