Keystone v2 list users by name should be supported to avoid potential performance problem

[Guang Yee]

We have a case where users are provided by LDAP backend. There are over 400,000 users in the global enterprise directory. Before creating the service users, TripleO first make sure the given user does not already exist. This is done by calling keystoneclient.users.find(). See

https://github.com/openstack/os-cloud-config/blob/master/os_cloud_config/keystone.py#L490

This is problematic because keystoneclient will attempt to fetch ALL the users and then do a linear search. See

https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/base.py#L257

This results in either connection timeout or incomplete list being return as there are simply too many users. Turns out, keystoneclient.v2.users.list() only accept three parameters, which are tenant_id, limit, and marker. See

https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/users.py#L108

We can’t filter on name even though the API supports it. See

https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L42

Lookup user by name support should be supported by python-keystoneclient.

[Steve Martinelli (stevemar)]

i think filtering by name (calling .list() with the correct filters) would solve some issues, especially where we are using .find() (which is listing and doing a linear search). It won't help the overall performance issues, but it's a start.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/167543

[Boris Bobrov (bbobrov)]

The patch mentioned above has not beed updated for more than 6 months, so I will set the status of the bug to "Confirmed" and will remove the assignee

[OpenStack Infra (hudson-openstack)]

Change abandoned by Steve Martinelli (<email address hidden>) on branch: master
Review: https://review.openstack.org/167543
Reason: abandoning this because it has a bunch of negative reviews and no movement in 5 months.

[Morgan Fainberg (mdrnstm)]

With Keytone v2 being gone, marking this as wont fix.