Bug 1756502 - Users should be able to forcibly remove role assignments for non-existent users and groups
Summary: Users should be able to forcibly remove role assignments for non-existent use...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: python-openstackclient
Version: 16.2 (Train)
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: z3
: 16.2 (Train on RHEL 8.4)
Assignee: Dave Wilde
QA Contact: Jeremy Agee
URL:
Whiteboard:
Depends On:
Blocks: 1914339 1947195
TreeView+ depends on / blocked
 
Reported: 2019-09-27 19:18 UTC by Lance Bragstad
Modified: 2024-12-04 20:22 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1914339 1947195 (view as bug list)
Environment:
Last Closed: 2024-12-04 20:22:14 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
OpenStack Storyboard 2006635 0 None None None 2019-09-27 19:19:45 UTC
OpenStack gerrit 740380 0 None MERGED Bypass user and group verification in RemoveRole 2021-02-17 15:55:58 UTC
Red Hat Issue Tracker OSP-377 0 None None None 2022-03-29 20:31:44 UTC

Description Lance Bragstad 2019-09-27 19:18:01 UTC
Description of problem:

Currently, python-openstackclient will preemptively check the existence of users and groups in ``openstack role remove --user|--group`` commands. If the user doesn't exist, the client will fail before calling keystone (DELETE /v3/projects/$project/users/$user/roles/$role) to revoke the role assignment.

Keystone defers existence checks to make it easier to clean up role assignments with non-existent users from LDAP.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Create a user in LDAP (ipa user-add jsmith --first=jon --last=smith)
2. Verify the user is listed by keystone ``openstack user list --domain REDHAT``
3. Grant the user role assignments on a project ``openstack role add --user $user-id --project admin reader``
4. Remove the user from LDAP (ipa user-del jsmith)
5. List role assignments ``openstack role assignment list``
6. Verify the user still has role assignments in keyston even though they've been removed from LDAP
7. Attempt to remove the user's role assignments ``openstack role remove --user $user-id --project admin admin``

Actual results:

HTTP 404 Not Found when python-openstackclient attempts to find the user in keystone.

Expected results:

HTTP 204 No Content because keystone allows roles to be revoked on non-existent users.

Additional info:

Comment 4 Martin Kopec 2021-07-28 07:35:18 UTC
This can be closed together with https://bugzilla.redhat.com/show_bug.cgi?id=1947195 as that's a tracker for 16.2 too. Seems like 1756502 and 1947195 are the same - one is a duplicate of the other.


Note You need to log in before you can comment on or make changes to this bug.