When disabling or enabling a user, the client assumes "default" domain

[Anne Gentle]

I'm using a private cloud as an admin that has no domain named "default."

But when issuing this command, I see that the project_domain_id passed in is default, and I don't see any way to tell the client which domain context I'm in.

$ openstack --debug user set interop --disable

Here's the relevant debug info that makes me think this is the case:

Using parameters {'username': 'agentle', 'password': '***', 'project_name': 'STAGE1-TW', 'user_domain_id': '3efc7152f9c24557bf20d108edd8fa9a', 'auth_url': 'https://api-stage1.client.metacloud.net:5000', 'project_id': 'd5a0286ec5504077bbc98a1f1e03079a', 'project_domain_id': 'default'}

[Steve Martinelli (stevemar)]

To specify the domain context you are in, you can set it with an env. var or as a flag. Here are some examples:

if you're using a domain named 'default'

$ env | grep OS
OS_PROJECT_DOMAIN_ID=default
OS_REGION_NAME=RegionOne
OS_USER_DOMAIN_ID=default
OS_PROJECT_NAME=admin
OS_IDENTITY_API_VERSION=3
OS_PASSWORD=openstack
OS_AUTH_URL=http://172.16.240.205:5000/v3
OS_USERNAME=admin

or if you're using a non-default domain

$ env | grep OS
OS_PROJECT_DOMAIN_NAME=ibm
OS_REGION_NAME=RegionOne
OS_USER_DOMAIN_NAME=ibm
OS_PROJECT_NAME=my_project
OS_IDENTITY_API_VERSION=3
OS_PASSWORD=humptydumpty
OS_AUTH_URL=http://172.16.240.205:5000/v3
OS_USERNAME=stevemar

Not that you specify either OS_USER_DOMAIN_NAME or OS_USER_DOMAIN_ID, never both. Same goes for OS_PROJECT_DOMAIN_NAME and OS_PROJECT_DOMAIN_ID.

[Steve Martinelli (stevemar)]

Nevermind, ignore comment #1. I mis-read the question. I think you're trying to disable the new user in domain foo.

Trouble is, there is no option to specify a domain where the user exist.

# openstack user set --help

positional arguments:
  <user> User to modify (name or ID)

optional arguments:
  -h, --help show this help message and exit
  --name <name> Set user name
  --project <project> Set default project (name or ID)
  --project-domain <project-domain>
                        Domain the project belongs to (name or ID). This can
                        be used in case collisions between project names
                        exist.
  --password <password>
                        Set user password
  --password-prompt Prompt interactively for password
  --email <email-address>
                        Set user email address
  --description <description>
                        Set user description
  --enable Enable user (default)
  --disable Disable user

There should be a --domain option in there to specify the user's domain that you are modifying.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/425276

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/425276
Committed: https://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=4cb56269ad30d0bd59f7685040ab0585f38c3b0f
Submitter: Jenkins
Branch: master

commit 4cb56269ad30d0bd59f7685040ab0585f38c3b0f
Author: Samuel Pilla <email address hidden>
Date: Wed Jan 25 10:40:49 2017 -0600

    Adds domain specification for SetUser

    This patch adds the ability to specify the domain context for making
    changes to a user with `--domain` flag.

    Example:
    $ openstack user set test_user --domain test_domain --enable

    Change-Id: I2b3241785c22e72e19181394acff650422299b0e
    Closes-Bug: #1658147

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/python-openstackclient 3.8.0 release.