OpenStack Identity (keystone)

GET v3/role_assignments?scope.project.id=<nonexistent>&include_subtree=true result in HTTP 500

Bug #1950146 reported by Balazs Gibizer on 2021-11-08

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	OpenStack Identity (keystone)	New	Undecided	Unassigned

Bug Description

Querying role assignments with include_subtree=true for a non existing project results in HTTP 500 response and a stack trace in the keystone logs.

Querying an existing project with include_subtree works. Querying a non existing project without include_subtree results in an empty role assignment list returned.

This is observed in a single node devstack built on recent master:
stack@aio:/opt/stack/keystone$ git log --oneline | head -n1
1e7ecca88 Merge "Fix typo in identity provider policies"

curl -g -i -X GET 'http://192.168.121.179/identity/v3/role_assignments?scope.project.id=a76977f990744754a0c7bb6b35f6ec07&include_subtree=true' -H "Accept: application/json" -H "User-Agent: python-keystoneclient" -H "X-Auth-Token: $TOKEN"
HTTP/1.1 500 Internal Server Error
Date: Mon, 08 Nov 2021 10:02:51 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 613
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
misconfiguration and was unable to complete
your request.</p>
<p>Please contact the server administrator at
webmaster@localhost to inform them of the time this error occurred,
and the actions you performed just before this error.</p>
<p>More information about this error may be available
in the server error log.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at 192.168.121.179 Port 80</address>
</body></html>

Nov 08 10:02:51 aio <email address hidden>[737]: DEBUG keystone.server.flask.request_processing.middleware.auth_context [None req-f29fdba2-1e62-435b-b743-ec019f02e93a None None] Authenticating user token {{(pid=737) process_request /usr/local/lib/python3.8/dist-packages/keystonemiddleware/auth_token/__init__.py:407}}
Nov 08 10:02:51 aio <email address hidden>[737]: DEBUG keystone.server.flask.request_processing.middleware.auth_context [None req-f29fdba2-1e62-435b-b743-ec019f02e93a None None] Validating token access rules against request {{(pid=737) validate_allowed_request /usr/local/lib/python3.8/dist-packages/keystonemiddleware/auth_token/__init__.py:545}}
Nov 08 10:02:51 aio <email address hidden>[737]: DEBUG keystone.server.flask.request_processing.middleware.auth_context [None req-fc96f88c-8201-427e-b496-6eed631042d7 admin admin] RBAC: auth_context: {'token': <TokenModel (audit_id=LU1XuSxpQ0SgLFChi8GvHQ, audit_chain_id=['LU1XuSxpQ0SgLFChi8GvHQ']) at 0x7fcc7ff936d0>, 'domain_id': None, 'trust_id': None, 'trustor_id': None, 'trustee_id': None, 'domain_name': None, 'group_ids': [], 'user_id': '518a974af6ba45758e46c3ad13ebe4d9', 'user_domain_id': 'default', 'system_scope': None, 'project_id': 'a76977f990744754a0c7bb6b35f6ec08', 'project_domain_id': 'default', 'roles': ['admin', 'member', 'reader'], 'is_admin_project': True, 'service_user_id': None, 'service_user_domain_id': None, 'service_project_id': None, 'service_project_domain_id': None, 'service_roles': []} {{(pid=737) fill_context /opt/stack/keystone/keystone/server/flask/request_processing/middleware/auth_context.py:478}}
Nov 08 10:02:51 aio <email address hidden>[737]: DEBUG keystone.server.flask.request_processing.req_logging [None req-fc96f88c-8201-427e-b496-6eed631042d7 admin admin] REQUEST_METHOD: `GET` {{(pid=737) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:27}}
Nov 08 10:02:51 aio <email address hidden>[737]: DEBUG keystone.server.flask.request_processing.req_logging [None req-fc96f88c-8201-427e-b496-6eed631042d7 admin admin] SCRIPT_NAME: `/identity` {{(pid=737) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:28}}
Nov 08 10:02:51 aio <email address hidden>[737]: DEBUG keystone.server.flask.request_processing.req_logging [None req-fc96f88c-8201-427e-b496-6eed631042d7 admin admin] PATH_INFO: `/v3/role_assignments` {{(pid=737) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:29}}
Nov 08 10:02:51 aio <email address hidden>[737]: WARNING keystone.server.flask.application [None req-fc96f88c-8201-427e-b496-6eed631042d7 admin admin] Could not find project: a76977f990744754a0c7bb6b35f6ec07.: keystone.exception.ProjectNotFound: Could not find project: a76977f990744754a0c7bb6b35f6ec07.
Nov 08 10:02:51 aio <email address hidden>[737]: CRITICAL keystone [None req-fc96f88c-8201-427e-b496-6eed631042d7 admin admin] Unhandled error: AssertionError: PROGRAMMING ERROR: enforcement (`keystone.common.rbac_enforcer.enforcer.RBACEnforcer.enforce_call()`) has not been called; API is unenforced.
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone Traceback (most recent call last):
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/flask/app.py", line 2091, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return self.wsgi_app(environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/werkzeug/middleware/proxy_fix.py", line 187, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return self.app(environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 129, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone resp = self.call_func(req, *args, **kw)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 193, in call_func
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return self.func(req, *args, **kwargs)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/oslo_middleware/base.py", line 124, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone response = req.get_response(self.application)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1313, in send
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone status, headers, app_iter = self.call_application(
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1278, in call_application
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone app_iter = application(self.environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 143, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return resp(environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 129, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone resp = self.call_func(req, *args, **kw)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 193, in call_func
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return self.func(req, *args, **kwargs)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/oslo_middleware/base.py", line 124, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone response = req.get_response(self.application)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1313, in send
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone status, headers, app_iter = self.call_application(
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1278, in call_application
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone app_iter = application(self.environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 129, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone resp = self.call_func(req, *args, **kw)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 193, in call_func
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return self.func(req, *args, **kwargs)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/osprofiler/web.py", line 112, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return request.get_response(self.application)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1313, in send
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone status, headers, app_iter = self.call_application(
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1278, in call_application
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone app_iter = application(self.environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 129, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone resp = self.call_func(req, *args, **kw)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 193, in call_func
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return self.func(req, *args, **kwargs)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/oslo_middleware/request_id.py", line 58, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone response = req.get_response(self.application)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1313, in send
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone status, headers, app_iter = self.call_application(
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1278, in call_application
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone app_iter = application(self.environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/opt/stack/keystone/keystone/server/flask/request_processing/middleware/url_normalize.py", line 38, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return self.app(environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 129, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone resp = self.call_func(req, *args, **kw)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/dec.py", line 193, in call_func
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return self.func(req, *args, **kwargs)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/keystonemiddleware/auth_token/__init__.py", line 341, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone response = req.get_response(self._app)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1313, in send
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone status, headers, app_iter = self.call_application(
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/webob/request.py", line 1278, in call_application
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone app_iter = application(self.environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/werkzeug/middleware/dispatcher.py", line 78, in __call__
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return app(environ, start_response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/flask/app.py", line 2076, in wsgi_app
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone response = self.handle_exception(e)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/flask_restful/__init__.py", line 271, in error_router
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return original_handler(e)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/flask_restful/__init__.py", line 271, in error_router
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return original_handler(e)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/flask_restful/__init__.py", line 271, in error_router
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return original_handler(e)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone [Previous line repeated 27 more times]
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/flask/app.py", line 2073, in wsgi_app
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone response = self.full_dispatch_request()
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/flask/app.py", line 1519, in full_dispatch_request
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone return self.finalize_request(rv)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/flask/app.py", line 1540, in finalize_request
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone response = self.process_response(response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/usr/local/lib/python3.8/dist-packages/flask/app.py", line 1885, in process_response
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone response = self.ensure_sync(func)(response)
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone File "/opt/stack/keystone/keystone/server/flask/common.py", line 151, in _assert_rbac_enforcement_called
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone assert getattr( # nosec
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone AssertionError: PROGRAMMING ERROR: enforcement (`keystone.common.rbac_enforcer.enforcer.RBACEnforcer.enforce_call()`) has not been called; API is unenforced.
Nov 08 10:02:51 aio <email address hidden>[737]: ERROR keystone
Nov 08 10:02:51 aio <email address hidden>[737]: [pid: 737|app: 0|req: 28/52] 192.168.121.179 () {52 vars in 1227 bytes} [Mon Nov 8 10:02:51 2021] GET /identity/v3/role_assignments?scope.project.id=a76977f990744754a0c7bb6b35f6ec07&include_subtree=true => generated 0 bytes in 34 msecs (HTTP/1.1 500) 0 headers in 0 bytes (0 switches on core 0)

See original description

Balazs Gibizer (balazs-gibizer) on 2021-11-08

description:

updated

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.