role assignment inheritance bug?

asked 2016-05-30 21:27:50 -0600

I am playing with nested projects and role inheritance and am somewhat confused by unexpected behaviour. This is on DevStack, stable Mitaka. Am I doing something wrong or is this a bug?

 ‌ $ openstack role add --user-domain HPE --project sales --user demo anotherrole --inherited
  $ openstack role assignment list --project 209241cf64404193bd9cd93f208ff357
  +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
  | Role                             | User                             | Group | Project                          | Domain | Inherited |
  +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
  | d36f9533cf7d44f9a432a52c39783def | 980393753dd8416996ae2e1497e0ae09 |       | 209241cf64404193bd9cd93f208ff357 |        | True      |
  +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
  $ openstack role assignment list --project 209241cf64404193bd9cd93f208ff357 --names
  +-------------+----------+-------+-----------+--------+-----------+
  | Role        | User     | Group | Project   | Domain | Inherited |
  +-------------+----------+-------+-----------+--------+-----------+
  | anotherrole | demo@HPE |       | sales@HPE |        | False     |
  +-------------+----------+-------+-----------+--------+-----------+

In case you didn't catch it, when printing IDs the command says that the role is inherited, as expected. When printing names it is not. To add insult to injury, if I try the API directly, the role list for this project is empty. What is going on?

curl -s -H 'x-auth-token: 01a5823b118e4a7793830156a982a1ce' http://192.168.5.10:5000/v3/projects/209241cf64404193bd9cd93f208ff357/users/980393753dd8416996ae2e1497e0ae09/roles | python -m json.tool
{
    "links": {
        "next": null,
        "previous": null,
        "self": "http://192.168.5.10:5000/v3/projects/209241cf64404193bd9cd93f208ff357/users/980393753dd8416996ae2e1497e0ae09/roles"
    },
    "roles": []
}

A final grief: Although I specified this role as inherited, the subprojects don't seem to have any role assignments.

edit retag flag offensive close merge delete