Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1235222

Summary: adding project with parent_project_id fails
Product: Red Hat OpenStack Reporter: Mike Abrams <mabrams>
Component: openstack-keystoneAssignee: Nathan Kinder <nkinder>
Status: CLOSED NOTABUG QA Contact: Rodrigo Duarte <rduartes>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.0 (Kilo)CC: ayoung, jschluet, mabrams, nkinder, rduartes, yeylon
Target Milestone: ---   
Target Release: 8.0 (Liberty)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-04-04 14:24:59 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mike Abrams 2015-06-24 10:41:50 UTC 
Description of problem:
curl -H "X-Auth-Token:$MYTOKEN"  -H "Content-type:application/json" http://localhost:35357/v3/projects -d '{"project": {"name": "projectA", "domain_id": "6cf52742d37440a3817dca3225577f93", "enabled": true, "description": "An example project", "parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}}' |python -mjson.tool

fails with a 500 unexpected error.


Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Server release 7.1 (Maipo)

How reproducible:
curl


Steps to Reproduce:
1) use admin_token as MYTOKEN
2) create test domain
3) create project
4) create projectA - curl -H "X-Auth-Token:$MYTOKEN"  -H "Content-type:application/json" http://localhost:35357/v3/projects -d '{"project": {"name": "projectA", "domain_id": "6cf52742d37440a3817dca3225577f93", "enabled": true, "description": "An example project", "parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}}' |python -mjson.tool

Actual results:
[root@mabrams-svr020 ~(keystone_admin)]# curl -H "X-Auth-Token:$MYTOKEN"  -H "Content-type:application/json" http://localhost:35357/v3/projects -d '{"project": {"name": "projectA", "domain_id": "6cf52742d37440a3817dca3225577f93", "enabled": true, "description": "An example project", "parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}}' |python -mjson.tool
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   371  100   178  100   193    514    557 --:--:-- --:--:-- --:--:--   559
{
    "error": {
        "code": 500,
        "message": "An unexpected error occurred when trying to store project (Disable debug mode to suppress these details.)",
        "title": "Internal Server Error"
    }
}
[root@mabrams-svr020 ~(keystone_admin)]# 


Expected results:
succeeds creating projectA


Additional info:
excerpt from the /var/log/keystone/keystone.log:

2015-06-24 13:31:11.667 14780 DEBUG keystone.middleware.core [-] RBAC: auth_context: {} process_request /usr/lib/python2.7/site-packages/keystone/middleware/core.py:239
2015-06-24 13:31:11.673 14780 INFO keystone.common.wsgi [-] POST /projects?
2015-06-24 13:31:11.673 14780 WARNING keystone.common.controller [-] RBAC: Bypassing authorization
2015-06-24 13:31:11.714 14780 DEBUG keystone.common.sql.core [-] Conflict project: (IntegrityError) (1452, 'Cannot add or update a child row: a foreign key constraint fails (`keystone`.`project`, CONSTRAINT `fk_project_domain_id` FOREIGN KEY (`domain_id`) REFERENCES `domain` (`id`))') 'INSERT INTO project (id, name, domain_id, description, enabled, extra, parent_id) VALUES (%s, %s, %s, %s, %s, %s, %s)' ('41d4bcb10e7645be8b7f79634e9053f2', 'projectA', '6cf52742d37440a3817dca3225577f93', 'An example project', 1, '{"parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}', None) wrapper /usr/lib/python2.7/site-packages/keystone/common/sql/core.py:419
2015-06-24 13:31:11.716 14780 WARNING keystone.common.wsgi [-] An unexpected error occurred when trying to store project (Disable debug mode to suppress these details.)
Comment 3 Adam Young 2015-06-29 18:25:13 UTC 
In the middle of the generated SQL there is this chunk of JSON: 

'{"parent_project_id": "a0a50effff624ef9832afdcb069c4d52"}'

Which looks like it should just be 


'a0a50effff624ef9832afdcb069c4d52'

So it looks like the request is not getting properly parsed.
Comment 4 Adam Young 2015-06-30 01:44:46 UTC 
I am not seeing this with 

$ rpmquery openstack-keystone
openstack-keystone-2015.1.0-1.el7.noarch

$ curl -H "X-Auth-Token:$OS_SERVICE_TOKEN"  -H "Content-type:application/json" http://localhost:35357/v3/projects -d '{"project": {"name": "projectA", "domain_id": "bce213f1ac724e9587bf8734aeb42769", "enabled": true, "description": "An example project", "parent_project_id": "cc28a3c368014b13bdcc0e0616b49a31"}}'
{"project": {"parent_project_id": "cc28a3c368014b13bdcc0e0616b49a31", "description": "An example project", "links": {"self": "http://localhost:35357/v3/projects/3eacccebf3c9496a88f40bcd15926ced"}, "enabled": true, "id": "3eacccebf3c9496a88f40bcd15926ced", "parent_id": null, "domain_id": "bce213f1ac724e9587bf8734aeb42769", "name": "projectA"}}[centos@rdo ~(keystone_admin)]$ 
$ openstack project list
+----------------------------------+----------+
| ID                               | Name     |
+----------------------------------+----------+
| 10bef0f52cd641aa93c72129c26b3331 | services |
| 3eacccebf3c9496a88f40bcd15926ced | projectA |
| 7ada433aa8fb4cc69e32b78eb795ad53 | demo     |
| cc28a3c368014b13bdcc0e0616b49a31 | parent   |
| ef8e35f5e488418aacd7a7aaa6534c13 | admin    |
+----------------------------------+----------+
[centos@rdo ~(keystone_admin)]$ openstack project show 3eacccebf3c9496a88f40bcd15926ced
+-------------------+----------------------------------+
| Field             | Value                            |
+-------------------+----------------------------------+
| description       | An example project               |
| domain_id         | bce213f1ac724e9587bf8734aeb42769 |
| enabled           | True                             |
| id                | 3eacccebf3c9496a88f40bcd15926ced |
| name              | projectA                         |
| parent_project_id | cc28a3c368014b13bdcc0e0616b49a31 |
+-------------------+----------------------------------+

The failure mode you are seeing above almost looks like it might be an older Keystone server.
Comment 8 Rodrigo Duarte 2016-03-17 22:10:00 UTC 
the field name is "parent_id", not "parent_project_id" and this is well tested. Will take a look anyway, the version where the problem happen is 7.0?
Comment 9 Adam Young 2016-03-25 15:14:19 UTC 
Yes.  This was reported during test up for the 7.0 release.  It is still an issue?
Comment 10 Rodrigo Duarte 2016-04-04 14:24:59 UTC 
Tested for: openstack-keystone-2015.1.2-2.el7ost.noarch

$ curl -H "X-Auth-Token:$MYTOKEN"  -H "Content-type:application/json" https://openstack.rduartes.unknown.test:5000/v3/projects -d '{"project": {"name": "projectA", "domain_id": "default", "enabled": true, "description": "An example project", "parent_project_id": "fc5dbad7bb9748f6bfd4e10c8232718b"}}' | python -mjson.tool


{
   "project":{
      "parent_project_id":"fc5dbad7bb9748f6bfd4e10c8232718b",
      "description":"An example project",
      "links":{
         "self":"https://openstack.rduartes.unknown.test:5000/v3/projects/1cf1ab71e27e450d992416134245ed39"
      },
      "enabled":true,
      "id":"1cf1ab71e27e450d992416134245ed39",
      "parent_id":null,
      "domain_id":"default",
      "name":"projectA"
   }
}

As you can see, "parent_project_id" is set, but it is the wrong attribute, the correct one is "parent_id". So, why it was set? Because of the "extra" column in the project table:

+----------------------------------+----------+-----------------------------------------------------------+--------------------+---------+-----------+-----------+
| id                               | name     | extra                                                     | description        | enabled | domain_id | parent_id |
+----------------------------------+----------+-----------------------------------------------------------+--------------------+---------+-----------+-----------+
| 1cf1ab71e27e450d992416134245ed39 | projectA | {"parent_project_id": "fc5dbad7bb9748f6bfd4e10c8232718b"} | An example project |       1 | default   | NULL      |
+----------------------------------+----------+-----------------------------------------------------------+--------------------+---------+-----------+-----------+

Using the correct field, "parent_id", we get what is expected:

$ curl -H "X-Auth-Token:$MYTOKEN"  -H "Content-type:application/json" https://openstack.rduartes.unknown.test:5000/v3/projects -d '{"project": {"name": "projectB", "domain_id": "default", "enabled": true, "description": "An example project", "parent_id": "fc5dbad7bb9748f6bfd4e10c8232718b"}}' | python -mjson.tool


{
    "project": {
        "description": "An example project",
        "domain_id": "default",
        "enabled": true,
        "id": "eb58c486a88c4ca4bccb4d8e6f4d5adf",
        "links": {
            "self": "https://openstack.rduartes.unknown.test:5000/v3/projects/eb58c486a88c4ca4bccb4d8e6f4d5adf"
        },
        "name": "projectB",
        "parent_id": "fc5dbad7bb9748f6bfd4e10c8232718b"
    }
}