Keystone v3/roles has differnt response for HEAD and GET (again)

[Attila Fazekas]

The issue is very similar to the one already discussed at
https://bugs.launchpad.net/keystone/+bug/1334368 , http://lists.openstack.org/pipermail/openstack-dev/2014-July/039140.html .

# curl -v -X HEAD http://172.17.1.18:5000/v3/roles/7acb026c29a24fb2a1d92a4e5291de24/implies/11b21cc37d7644c8bc955ff956b2d56e -H "Content-Type: application/json" -H "X-Auth-Token: gAAAAABZViMqU8rSuv7qlmcUlv1hYHegvN6EelqJPt-MTWBkIOewhSjNeiwZcksDUKm2JOfNtw78iAAmscx86N9UiekxkluvzRpatFyWooOkCATkqJFn4HgCFr_an9X7kmOhJTOguqGH6uCYz4K6ak1NfuEvtRShe3lDXyScL51JaZqtw8bCWzo"
* About to connect() to 172.17.1.18 port 5000 (#0)
* Trying 172.17.1.18...
* Connected to 172.17.1.18 (172.17.1.18) port 5000 (#0)
> HEAD /v3/roles/7acb026c29a24fb2a1d92a4e5291de24/implies/11b21cc37d7644c8bc955ff956b2d56e HTTP/1.1
> User-Agent: curl/7.29.0
> Host: 172.17.1.18:5000
> Accept: */*
> Content-Type: application/json
> X-Auth-Token: gAAAAABZViMqU8rSuv7qlmcUlv1hYHegvN6EelqJPt-MTWBkIOewhSjNeiwZcksDUKm2JOfNtw78iAAmscx86N9UiekxkluvzRpatFyWooOkCATkqJFn4HgCFr_an9X7kmOhJTOguqGH6uCYz4K6ak1NfuEvtRShe3lDXyScL51JaZqtw8bCWzo
>
< HTTP/1.1 204 No Content
< Date: Fri, 30 Jun 2017 10:09:30 GMT
< Server: Apache
< Vary: X-Auth-Token
< x-openstack-request-id: req-e64410ae-5d4a-48f7-8508-615752877277
< Content-Type: text/plain
<
* Connection #0 to host 172.17.1.18 left intact

# curl -v -X GET http://172.17.1.18:5000/v3/roles/7acb026c29a24fb2a1d92a4e5291de24/implies/11b21cc37d7644c8bc955ff956b2d56e -H "Content-Type: application/json" -H "X-Auth-Token: gAAAAABZViMqU8rSuv7qlmcUlv1hYHegvN6EelqJPt-MTWBkIOewhSjNeiwZcksDUKm2JOfNtw78iAAmscx86N9UiekxkluvzRpatFyWooOkCATkqJFn4HgCFr_an9X7kmOhJTOguqGH6uCYz4K6ak1NfuEvtRShe3lDXyScL51JaZqtw8bCWzo"
* About to connect() to 172.17.1.18 port 5000 (#0)
* Trying 172.17.1.18...
* Connected to 172.17.1.18 (172.17.1.18) port 5000 (#0)
> GET /v3/roles/7acb026c29a24fb2a1d92a4e5291de24/implies/11b21cc37d7644c8bc955ff956b2d56e HTTP/1.1
> User-Agent: curl/7.29.0
> Host: 172.17.1.18:5000
> Accept: */*
> Content-Type: application/json
> X-Auth-Token: gAAAAABZViMqU8rSuv7qlmcUlv1hYHegvN6EelqJPt-MTWBkIOewhSjNeiwZcksDUKm2JOfNtw78iAAmscx86N9UiekxkluvzRpatFyWooOkCATkqJFn4HgCFr_an9X7kmOhJTOguqGH6uCYz4K6ak1NfuEvtRShe3lDXyScL51JaZqtw8bCWzo
>
< HTTP/1.1 200 OK
< Date: Fri, 30 Jun 2017 10:09:38 GMT
< Server: Apache
< Content-Length: 507
< Vary: X-Auth-Token,Accept-Encoding
< x-openstack-request-id: req-cc320571-a59d-4ea2-b459-117053367c55
< Content-Type: application/json
<
* Connection #0 to host 172.17.1.18 left intact
{"role_inference": {"implies": {"id": "11b21cc37d7644c8bc955ff956b2d56e", "links": {"self": "http://172.17.1.18:5000/v3/roles/11b21cc37d7644c8bc955ff956b2d56e"}, "name": "tempest-role-1212191884"}, "prior_role": {"id": "7acb026c29a24fb2a1d92a4e5291de24", "links": {"self": "http://172.17.1.18:5000/v3/roles/7acb026c29a24fb2a1d92a4e5291de24"}, "name": "tempest-role-500046640"}}, "links": {"self": "http://172.17.1.18:5000/v3/roles/7acb026c29a24fb2a1d92

mod_wsgi based on the version and configuration (WSGIMapHEADToGET (requires mod_wsgi >= 4.3.0)) mod_wsgi might send GET instead of HEAD in order to avoid invalid responses being cached in case of an application bug.

Unfortunately tempest expects the wrong behavior, is it also needs to be changed,

tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
---------------------------------------------------------------------------------------------------------------------------------------------

Captured traceback:
~~~~~~~~~~~~~~~~~~~
    Traceback (most recent call last):
      File "/usr/lib/python2.7/site-packages/tempest/api/identity/admin/v3/test_roles.py", line 228, in test_implied_roles_create_check_show_delete
        prior_role_id, implies_role_id)
      File "/usr/lib/python2.7/site-packages/tempest/lib/services/identity/v3/roles_client.py", line 233, in check_role_inference_rule
        self.expected_success(204, resp.status)
      File "/usr/lib/python2.7/site-packages/tempest/lib/common/rest_client.py", line 252, in expected_success
        raise exceptions.InvalidHttpSuccessCode(details)
    tempest.lib.exceptions.InvalidHttpSuccessCode: The success code is different than the expected one
    Details: Unexpected http success status code 200, The expected status code is 204

[Attila Fazekas (afazekas)]

https://developer.openstack.org/api-ref/identity/v3/?expanded=confirm-role-inference-rule-detail,get-role-inference-rule-detail 204 unfortunately documented at the moment.

[YaZug (jon-schlueter)]

documented behavior

https://developer.openstack.org/api-ref/identity/v3/?expanded=confirm-role-inference-rule-detail,get-role-inference-rule-detail

Tempest patch that checks for this behavior

https://review.openstack.org/#/c/462507/2

[YaZug (jon-schlueter)]

https://github.com/GrahamDumpleton/mod_wsgi/issues/2

[Attila Fazekas (afazekas)]

tempest change: https://review.openstack.org/#/c/479286/

[chandan kumar (chkumar246)]

Found open reviews for this bug in gerrit, setting to In Progress.

review: https://review.openstack.org/479286 in branch: master

[Lance Bragstad (lbragstad)]

According to the interoperability guide lines [0], we won't be able to fix this unless we implement v4 or microversions.

[0] http://specs.openstack.org/openstack/api-wg/guidelines/api_interoperability.html

[Morgan Fainberg (mdrnstm)]

As per lance, this is being marked as wont fix. we can re-visit when/if microversions or v4 is implemented.

[OpenStack Infra (hudson-openstack)]

Change abandoned by afazekas (<email address hidden>) on branch: master
Review: https://review.openstack.org/479286
Reason: Looks like there is not much interest for this change.

[Martin Kopec (mkopec)]

Moving to New as the associated change has been abandoned.

[Martin Kopec (mkopec)]

Moving to Confirmed as tempest's client still expects 204 response code.