Bug 2077780

Summary:	Keystone fails to check whether user belongs to group for federated user from federated group
Product:	Red Hat OpenStack	Reporter:	Alex Stupnikov <astupnik>
Component:	openstack-keystone	Assignee:	Dave Wilde <dwilde>
Status:	NEW ---	QA Contact:	Jeremy Agee <jagee>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	17.1 (Wallaby)	CC:	dwilde, hrybacki, oblaut
Target Milestone:	zstream	Keywords:	Triaged
Target Release:	---	Flags:	ifrangs: needinfo? (dwilde)
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1590932

Description Alex Stupnikov 2022-04-22 08:59:27 UTC

Description of problem:
'openstack group contains user' command output is incorrect when both user and group are federated: it states that user is "not in group". Command works as expected when federated user belongs to non-federated group.

Version-Release number of selected component (if applicable):
Red Hat OpenStack Platform release 16.1.6 GA

How reproducible:

- customer is using OpenID Connect Service Provider for Keystone
- 'openstack group contains user' provides incorrect result when both user and user's group belong to federated domain