Bug 1684359

Description of problem:

We are trying to launch a provisioning request using the API from the master region to a subregion. We are using the API request documented here:
http://manageiq.org/docs/reference/fine/api/reference/provision_requests

We have created a service catalog in the master region that parses details from the dialog performs the API call to the subregion to provision the VM. One of the fields in the POST request is the owner. We set that as the current logged in user who initiated the request.

Both master and subregion are integrated with the same active directory. 

If we use the default admin account that ships with CFME it works fine and the VM is provisioned. 

However, if we use a user from the AD who never logged into the sub region, and logged into the Master appliance and order the same catalog. The provision request fails. The API returns a 404.

If the AD user logs in the subregion, and then the process is repeated by ordering from the master it works fine.

After debugging I found out that it is trying to lookup the user and it doesn't find him so it throws a 404. If I log in at least once on the subregion with the AD user and then repeat it works.

Version-Release number of selected component (if applicable):
cfme-5.10.1.2

How reproducible:
Always

Steps to Reproduce:
1- Setup appliance as sub region as remote.
2- Setup appliance as master region as global.
3- Add provider to subregion.
4- Integrate both master and subregion with LDAP (same source)
5- Create a service catalog in sub region
6- Log into the master appliance using a LDAP user who has never logged into to sub region.
7- Make a create_provision_request using the API http://manageiq.org/docs/reference/fine/api/examples/provision_request
8- In the POST body params set the requester info to an LDAP user that has never logged into CFME ex:
      "requester" : {
        "user_name" : "ldapuser1",
        "owner_first_name" : "Sam",
        "owner_last_name" : "ple",
        "owner_email" : "sample",
        "auto_approve" : true
      }
9- Service provisioning will fail (404 errors from subregion API in logs)
10- Login using the same LDAP user but on the subregion
11- Request catalog from master again.
12- Service provisioning is successful.

Actual results:
API Provisioning request fails with 404 Not Found error
~~~
/opt/rh/cfme-gemset/gems/rest-client-2.0.2/lib/restclient/abstract_response.rb:223:in `exception_with_response': 404 Not Found (RestClient::NotFound)
	from /opt/rh/cfme-gemset/gems/rest-client-2.0.2/lib/restclient/abstract_response.rb:103:in `return!'
	from /opt/rh/cfme-gemset/gems/rest-client-2.0.2/lib/restclient/request.rb:809:in `process_result'
	from /opt/rh/cfme-gemset/gems/rest-client-2.0.2/lib/restclient/request.rb:725:in `block in transmit'
	from /opt/rh/rh-ruby23/root/usr/share/ruby/net/http.rb:853:in `start'
	from /opt/rh/cfme-gemset/gems/rest-client-2.0.2/lib/restclient/request.rb:715:in `transmit'
	from /opt/rh/cfme-gemset/gems/rest-client-2.0.2/lib/restclient/request.rb:145:in `execute'
	from /opt/rh/cfme-gemset/gems/rest-client-2.0.2/lib/restclient/request.rb:52:in `execute'
	from rest_check.rb:20:in `create_provision_request_api'
	from rest_check.rb:73:in `<main>'
~~~

Expected results:
API Provisioning should be successful.

Additional info:

The source of the API call is not relevant in this issue. I can make the API call from a master appliance, ansible tower or even a plain ruby script or even cURL.

The issue I am facing is the CFME API itself. This is even reproducible on a single appliance setup:

1- Setup SINGLE CFME appliance
2- Add Provider (vcenter)
3- Add LDAP authentication
4-  Make a create_provision_request using the API http://manageiq.org/docs/reference/fine/api/examples/provision_request
5- In the POST body params set the requester info to an LDAP user that has never logged into CFME ex:
      "requester" : {
        "user_name" : "ldapuser1",
        "owner_first_name" : "John",
        "owner_last_name" : "Doe",
        "owner_email" : "jdoe",
        "auto_approve" : true
      }
6- API response will be 404. Internally the API tries to lookup user and fails even though the user exists in the LDAP.
7- Now log in CFME using ldapuser1
8- Repeat API call
9- API response is 200, provision request is created and vm provision is initiated.