Bug 1480067

Description of problem:

Stack creation gets failed with error message: "Missing required credential: roles [u'_member_', u'admin']"

Every time a federated user tries to create a stack.

1. The role are assigned to the group, and the users are the part of the group.
2. Heat tries to treat Federated user as regular Keystone user which usually has ID, assigned project(s) and assigned role(s). However, federated users don't belong to Keystone database. They get mapped to user groups and inherit group roles and projects in runtime, during the authentication process. When someone, for example, Heat, tries to query Keystone about federated user, this will lead to Identity Error and, as a consequence, make Heat fail.

Workaround
-----------
We need to manually assign the role for federated users, so that the assignment is stored in keystone database.
1. Get the user id for the federated user.
~~~
$openstack user show c7612
+----------+----------------------------------+
| Field    | Value                            |
+----------+----------------------------------+
| ..       | ..                               |
| id       | f321a124ad524dedb0c2492fce5f38ee |
| name     | c7612                            |
| ..       | ..                               |
+----------+----------------------------------+
~~~

2. Use the 'user id'  and 'project name' to manually assign role for that user.
~~~
$openstack role add --user f321a124ad524dedb0c2492fce5f38ee --project project-name _member_
$openstack role add --user f321a124ad524dedb0c2492fce5f38ee --project project-name heat_stack_owner
~~~

3. Check if the role has been properly assigned.
~~~
$openstack role assignment list --user f321a124ad524dedb0c2492fce5f38ee --project project-name
~~~

4. Now you can create the stack, it will work.

This should be done only once, so that authorization details are stored in keystone database.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. 
2. 
3.

Actual results:


Expected results:


Additional info:

Upstream related Bug: https://bugs.launchpad.net/keystone/+bug/1600366