unable to filter users by default project in V3

[Charles V Bock]

In version 2.0 I used to be able to make this api call:
        /v2.0/tenants/[project id]/users
or in the python client (horizon)simply:
        api.keystone.user_list(request, project=project_id)
to get back a list of the users in a specific project

note the logic here to make this happen:
https://github.com/openstack/python-keystoneclient/blob/0e9ecaa1547306f7af6527126fb88f8151908498/keystoneclient/v2_0/users.py#L124-L128

The same call using python keystone client in V3 returns me all the users in keystone even if I specify a project argument.
and /v3/projects/[project id]/users doesn't seem to even exist.

note the lack of similar logic in the new version:
it seems to treat the project argument as if it was an old property filter, but it wasn't it was a special case for listing a projects users...

https://github.com/openstack/python-keystoneclient/blob/0e9ecaa1547306f7af6527126fb88f8151908498/keystoneclient/v3/users.py#L94-L96

Thoughts?

[Charles V Bock (charles-v-bock)]

I also couldn't find an equivalent v3 version of this functionality on the keystone side:
https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L132

[Dolph Mathews (dolph)]

Several closely related use cases were solved with a single API resource and lots of filtering options:

  GET /v3/role_assignments?project.id={project_id}

Docs: https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#list-effective-role-assignments-get-role_assignments

[Pavel Ikrenyi (ikrenyi1)]

This is still in current documentation.

https://docs.openstack.org/python-keystoneclient/latest/api/keystoneclient.v3.html#module-keystoneclient.v3.users

If it's not planned to be fixed, it should at least be removed from the docs, or the docs should be updated to reflect the new way of calling the API...

[Lance Bragstad (lbragstad)]

We do publish a note about `project` being deprecated [0] saying that it could be removed in the future after version 2.0.0. Since we're into version 3 of the client, I tested this and default_project doesn't appear to filter, either [1].

I would suggest we fix the default_project filtering and we could retarget this but to fix that instead of using project, since that's been deprecated for some time.

[0] https://docs.openstack.org/python-keystoneclient/latest/api/keystoneclient.v3.html#module-keystoneclient.v3.users
[1] https://pasted.tech/pastes/6f81cbe2422449a92d786e6fa97882e0d79b50fd.raw