inconsistent results for user show of yourself as a non-admin

Bug #1561599 reported by Matthew Edmonds
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Fix Released
David Rosales

Bug Description

when using non-admin credentials, openstack user show works if you specify a user id:

# openstack user show 631bbab78e33e554bc6c7fd53071c6e046fd37680b1b154261bd6183b123e8b0
| Field | Value |
| domain_id | default |
| id | 631bbab78e33e554bc6c7fd53071c6e046fd37680b1b154261bd6183b123e8b0 |
| name | arc1_dep |

but fails if you specify a user name and domain name:

# openstack user show --domain Default arc1_dep
ERROR: openstack You are not authorized to perform the requested action: identity:list_users (HTTP 403) (Request-ID: req-6e3ab4fc-8279-4608-834e-40104397818d)

This is because when you specify user id, openstackclient can make a GET /v3/users/{user_id} call, which policy allows for non-admins as long as the user_id matches their token, but if you specify the name openstackclient can't make that call because it doesn't know the user_id, so it makes a GET /v3/users call instead, which policy only allows for admins.

I think we could fix this by pulling the user_id from the token if/when the user and domain names specified on the openstack user show invocation match the user and domain names of the token, and using that to make the GET /v3/users/{user_id} call instead of relying on GET/v3/users. We would still have to rely on GET /v3/users as today when the names don't match, of course... and it would be right to return a 403 forbidden error when the names don't match, so that's fine.

Revision history for this message
Matthew Edmonds (edmondsw) wrote :

The same issue (and possible solution) also applies to projects

AMIT KUMAR (maurya0092)
Changed in python-openstackclient:
assignee: nobody → AMIT KUMAR (maurya0092)
Revision history for this message
Matthew Edmonds (edmondsw) wrote :

I believe the same kind of thing also applies when you specify a domain name instead of domain id... rather than have to have the ability to list domains, we should check to see if the name matches the current domain name, and if so we should already know the domain id from the token response.

David Rosales (darosale)
Changed in python-openstackclient:
assignee: AMIT KUMAR (maurya0092) → David Rosales (darosale)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to python-openstackclient (master)

Fix proposed to branch: master

Changed in python-openstackclient:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-openstackclient (master)

Submitter: Jenkins
Branch: master

commit 337d013c94378a4b3f0e8f90e4f5bd745448658f
Author: David Rosales <email address hidden>
Date: Fri Apr 29 12:12:52 2016 -0500

    Use resource id when name given for identity show

    Currently a user is allowed to specify either a resource ID or name
    when running openstack identity comands. In some cases, when a name
    is specified instead of an ID, the command will return as not able
    to find the resource when it in fact does exist.

    The changes here are to check the client against the token on such
    requests and to extract the ID of the resource specified if enough
    information exists between the two. We then use the ID associated
    with the resource to complete the user requests.

    Change-Id: I40713b0ded42063b786dc21247e854224b9d2fe2
    Closes-Bug: #1561599

Changed in python-openstackclient:
status: In Progress → Fix Released
Revision history for this message
Davanum Srinivas (DIMS) (dims-v) wrote : Fix included in openstack/keystone

This issue was fixed in the openstack/keystone development milestone.

Revision history for this message
Matthew Edmonds (edmondsw) wrote :

I'm not sure why this wasn't noted by infra, but the keystone change here was made under

Changed in python-openstackclient:
importance: Undecided → Medium
Revision history for this message
Doug Hellmann (doug-hellmann) wrote : Fix included in openstack/python-openstackclient 3.0.0

This issue was fixed in the openstack/python-openstackclient 3.0.0 release.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers