Bug 1756502

Summary: Users should be able to forcibly remove role assignments for non-existent users and groups
Product: Red Hat OpenStack Reporter: Lance Bragstad <lbragsta>
Component: python-openstackclientAssignee: Dave Wilde <dwilde>
Status: CLOSED CURRENTRELEASE QA Contact: Jeremy Agee <jagee>
Severity: medium Docs Contact:
Priority: medium    
Version: 16.2 (Train)CC: apevec, dwilde, jpichon, lhh, mkopec, nkinder, pweeks
Target Milestone: z3Keywords: Triaged
Target Release: 16.2 (Train on RHEL 8.4)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1914339 1947195 (view as bug list) Environment:
Last Closed: 2024-12-04 20:22:14 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1914339, 1947195    

Description Lance Bragstad 2019-09-27 19:18:01 UTC 
Description of problem:

Currently, python-openstackclient will preemptively check the existence of users and groups in ``openstack role remove --user|--group`` commands. If the user doesn't exist, the client will fail before calling keystone (DELETE /v3/projects/$project/users/$user/roles/$role) to revoke the role assignment.

Keystone defers existence checks to make it easier to clean up role assignments with non-existent users from LDAP.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Create a user in LDAP (ipa user-add jsmith --first=jon --last=smith)
2. Verify the user is listed by keystone ``openstack user list --domain REDHAT``
3. Grant the user role assignments on a project ``openstack role add --user $user-id --project admin reader``
4. Remove the user from LDAP (ipa user-del jsmith)
5. List role assignments ``openstack role assignment list``
6. Verify the user still has role assignments in keyston even though they've been removed from LDAP
7. Attempt to remove the user's role assignments ``openstack role remove --user $user-id --project admin admin``

Actual results:

HTTP 404 Not Found when python-openstackclient attempts to find the user in keystone.

Expected results:

HTTP 204 No Content because keystone allows roles to be revoked on non-existent users.

Additional info:
Comment 4 Martin Kopec 2021-07-28 07:35:18 UTC 
This can be closed together with https://bugzilla.redhat.com/show_bug.cgi?id=1947195 as that's a tracker for 16.2 too. Seems like 1756502 and 1947195 are the same - one is a duplicate of the other.