Description of problem: curl -H "X-Auth-Token:$MYTOKEN" -H "Content-type:application/json" http://localhost:35357/v3/projects -d '{"project": {"name": "projectA", "domain_id": "6cf52742d37440a3817dca3225577f93", "enabled": true, "description": "An example project", "parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}}' |python -mjson.tool fails with a 500 unexpected error. Version-Release number of selected component (if applicable): Red Hat Enterprise Linux Server release 7.1 (Maipo) How reproducible: curl Steps to Reproduce: 1) use admin_token as MYTOKEN 2) create test domain 3) create project 4) create projectA - curl -H "X-Auth-Token:$MYTOKEN" -H "Content-type:application/json" http://localhost:35357/v3/projects -d '{"project": {"name": "projectA", "domain_id": "6cf52742d37440a3817dca3225577f93", "enabled": true, "description": "An example project", "parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}}' |python -mjson.tool Actual results: [root@mabrams-svr020 ~(keystone_admin)]# curl -H "X-Auth-Token:$MYTOKEN" -H "Content-type:application/json" http://localhost:35357/v3/projects -d '{"project": {"name": "projectA", "domain_id": "6cf52742d37440a3817dca3225577f93", "enabled": true, "description": "An example project", "parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}}' |python -mjson.tool % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 371 100 178 100 193 514 557 --:--:-- --:--:-- --:--:-- 559 { "error": { "code": 500, "message": "An unexpected error occurred when trying to store project (Disable debug mode to suppress these details.)", "title": "Internal Server Error" } } [root@mabrams-svr020 ~(keystone_admin)]# Expected results: succeeds creating projectA Additional info: excerpt from the /var/log/keystone/keystone.log: 2015-06-24 13:31:11.667 14780 DEBUG keystone.middleware.core [-] RBAC: auth_context: {} process_request /usr/lib/python2.7/site-packages/keystone/middleware/core.py:239 2015-06-24 13:31:11.673 14780 INFO keystone.common.wsgi [-] POST /projects? 2015-06-24 13:31:11.673 14780 WARNING keystone.common.controller [-] RBAC: Bypassing authorization 2015-06-24 13:31:11.714 14780 DEBUG keystone.common.sql.core [-] Conflict project: (IntegrityError) (1452, 'Cannot add or update a child row: a foreign key constraint fails (`keystone`.`project`, CONSTRAINT `fk_project_domain_id` FOREIGN KEY (`domain_id`) REFERENCES `domain` (`id`))') 'INSERT INTO project (id, name, domain_id, description, enabled, extra, parent_id) VALUES (%s, %s, %s, %s, %s, %s, %s)' ('41d4bcb10e7645be8b7f79634e9053f2', 'projectA', '6cf52742d37440a3817dca3225577f93', 'An example project', 1, '{"parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}', None) wrapper /usr/lib/python2.7/site-packages/keystone/common/sql/core.py:419 2015-06-24 13:31:11.716 14780 WARNING keystone.common.wsgi [-] An unexpected error occurred when trying to store project (Disable debug mode to suppress these details.)
In the middle of the generated SQL there is this chunk of JSON: '{"parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}' Which looks like it should just be 'a0a50effff624ef9832afdcb069c4d52' So it looks like the request is not getting properly parsed.
I am not seeing this with $ rpmquery openstack-keystone openstack-keystone-2015.1.0-1.el7.noarch $ curl -H "X-Auth-Token:$OS_SERVICE_TOKEN" -H "Content-type:application/json" http://localhost:35357/v3/projects -d '{"project": {"name": "projectA", "domain_id": "bce213f1ac724e9587bf8734aeb42769", "enabled": true, "description": "An example project", "parent_project_id": "cc28a3c368014b13bdcc0e0616b49a31"}}' {"project": {"parent_project_id": "cc28a3c368014b13bdcc0e0616b49a31", "description": "An example project", "links": {"self": "http://localhost:35357/v3/projects/3eacccebf3c9496a88f40bcd15926ced"}, "enabled": true, "id": "3eacccebf3c9496a88f40bcd15926ced", "parent_id": null, "domain_id": "bce213f1ac724e9587bf8734aeb42769", "name": "projectA"}}[centos@rdo ~(keystone_admin)]$ $ openstack project list +----------------------------------+----------+ | ID | Name | +----------------------------------+----------+ | 10bef0f52cd641aa93c72129c26b3331 | services | | 3eacccebf3c9496a88f40bcd15926ced | projectA | | 7ada433aa8fb4cc69e32b78eb795ad53 | demo | | cc28a3c368014b13bdcc0e0616b49a31 | parent | | ef8e35f5e488418aacd7a7aaa6534c13 | admin | +----------------------------------+----------+ [centos@rdo ~(keystone_admin)]$ openstack project show 3eacccebf3c9496a88f40bcd15926ced +-------------------+----------------------------------+ | Field | Value | +-------------------+----------------------------------+ | description | An example project | | domain_id | bce213f1ac724e9587bf8734aeb42769 | | enabled | True | | id | 3eacccebf3c9496a88f40bcd15926ced | | name | projectA | | parent_project_id | cc28a3c368014b13bdcc0e0616b49a31 | +-------------------+----------------------------------+ The failure mode you are seeing above almost looks like it might be an older Keystone server.
the field name is "parent_id", not "parent_project_id" and this is well tested. Will take a look anyway, the version where the problem happen is 7.0?
Yes. This was reported during test up for the 7.0 release. It is still an issue?
Tested for: openstack-keystone-2015.1.2-2.el7ost.noarch $ curl -H "X-Auth-Token:$MYTOKEN" -H "Content-type:application/json" https://openstack.rduartes.unknown.test:5000/v3/projects -d '{"project": {"name": "projectA", "domain_id": "default", "enabled": true, "description": "An example project", "parent_project_id": "fc5dbad7bb9748f6bfd4e10c8232718b"}}' | python -mjson.tool { "project":{ "parent_project_id":"fc5dbad7bb9748f6bfd4e10c8232718b", "description":"An example project", "links":{ "self":"https://openstack.rduartes.unknown.test:5000/v3/projects/1cf1ab71e27e450d992416134245ed39" }, "enabled":true, "id":"1cf1ab71e27e450d992416134245ed39", "parent_id":null, "domain_id":"default", "name":"projectA" } } As you can see, "parent_project_id" is set, but it is the wrong attribute, the correct one is "parent_id". So, why it was set? Because of the "extra" column in the project table: +----------------------------------+----------+-----------------------------------------------------------+--------------------+---------+-----------+-----------+ | id | name | extra | description | enabled | domain_id | parent_id | +----------------------------------+----------+-----------------------------------------------------------+--------------------+---------+-----------+-----------+ | 1cf1ab71e27e450d992416134245ed39 | projectA | {"parent_project_id": "fc5dbad7bb9748f6bfd4e10c8232718b"} | An example project | 1 | default | NULL | +----------------------------------+----------+-----------------------------------------------------------+--------------------+---------+-----------+-----------+ Using the correct field, "parent_id", we get what is expected: $ curl -H "X-Auth-Token:$MYTOKEN" -H "Content-type:application/json" https://openstack.rduartes.unknown.test:5000/v3/projects -d '{"project": {"name": "projectB", "domain_id": "default", "enabled": true, "description": "An example project", "parent_id": "fc5dbad7bb9748f6bfd4e10c8232718b"}}' | python -mjson.tool { "project": { "description": "An example project", "domain_id": "default", "enabled": true, "id": "eb58c486a88c4ca4bccb4d8e6f4d5adf", "links": { "self": "https://openstack.rduartes.unknown.test:5000/v3/projects/eb58c486a88c4ca4bccb4d8e6f4d5adf" }, "name": "projectB", "parent_id": "fc5dbad7bb9748f6bfd4e10c8232718b" } }