yahoo-eng-team team mailing list archive

Thread
Date
[Bug 1470570] [NEW] role assignment to group fails: Bad search filter

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Hans Feldt <hans.feldt@xxxxxxxxxxxx>
Date: Wed, 01 Jul 2015 15:49:34 -0000
Reply-to: Bug 1470570 <1470570@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
Public bug reported:

Kilo packages from Ubuntu 15.04

I have a user and group in an LDAP domain. I add a project to that
domain. When adding a project role to the group the following happens:

root@707c0f475a99:~# openstack role add --project $projid --group demo --group-domain acme user
ERROR: openstack An unexpected error prevented the server from fulfilling your request: {'desc': 'Bad search filter'} (Disable debug mode to suppress these details.) (HTTP 500) (Request-ID: req-48d22a63-cfd2-47ae-a247-c51ca4a68674)

and keystone logs shows:

2015-07-01 15:34:40.833 60 DEBUG keystone.common.ldap.core [-] LDAP search: base=ou=Groups,dc=acme,dc=org scope=1 filterstr=(&(&None(cn=demo))(objectClass=groupOfNames)) attrs=['cn', 'description'] attrsonly=0 search_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:931
2015-07-01 15:34:40.834 60 DEBUG keystone.common.ldap.core [-] LDAP unbind unbind_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:904
2015-07-01 15:34:40.834 60 ERROR keystone.common.wsgi [-] {'desc': 'Bad search filter'}
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi Traceback (most recent call last):
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/wsgi.py", line 239, in __call__
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = method(context, **params)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/controller.py", line 202, in wrapper
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, context, filters, **kwargs)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/controllers.py", line 309, in list_groups
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     hints=hints)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/manager.py", line 52, in wrapper
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 345, in wrapper
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 356, in wrapper
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 1003, in list_groups
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     ref_list = driver.list_groups(hints)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 164, in list_groups
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.group.get_all_filtered(hints)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 402, in get_all_filtered
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for group in self.get_all(query)]
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1505, in get_all
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for x in self._ldap_get_all(ldap_filter)]
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1467, in _ldap_get_all
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrs)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 944, in search_s
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist_utf8, attrsonly)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 541, in search_s
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist, attrsonly)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 552, in search_s
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 545, in search_ext_s
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     msgid = self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientctrls,timeout,sizelimit)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 541, in search_ext
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     timeout,sizelimit,
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 99, in _ldap_call
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = func(*args,**kwargs)
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi FILTER_ERROR: {'desc': 'Bad search filter'}
2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi
2015-07-01 15:34:40.838 60 INFO eventlet.wsgi.server [-] 172.17.0.25 - - [01/Jul/2015 15:34:40] "GET /v3/groups?domain_id=d5486c74465945b8bf1046339cf23171&name=demo HTTP/1.1" 500 483 0.011650

This is roughly the same problem as in
https://bugs.launchpad.net/keystone/+bug/1454309, but for groups.

** Affects: keystone
     Importance: Undecided
     Assignee: Hans Feldt (hans-feldt)
         Status: New

** Affects: keystone (Ubuntu)
     Importance: Undecided
         Status: New

** Changed in: keystone
     Assignee: (unassigned) => Hans Feldt (hans-feldt)

** Description changed:

- 
- I have a user and a project in a LDAP domain, when adding a project role to a group the following happens:
+ I have a user and a project in a LDAP domain, when adding a project role
+ to a group the following happens:
  
  root@707c0f475a99:~# openstack role add --project $projid --group demo --group-domain acme user
  ERROR: openstack An unexpected error prevented the server from fulfilling your request: {'desc': 'Bad search filter'} (Disable debug mode to suppress these details.) (HTTP 500) (Request-ID: req-48d22a63-cfd2-47ae-a247-c51ca4a68674)
  
  and keystone logs shows:
  
  2015-07-01 15:34:40.833 60 DEBUG keystone.common.ldap.core [-] LDAP search: base=ou=Groups,dc=acme,dc=org scope=1 filterstr=(&(&None(cn=demo))(objectClass=groupOfNames)) attrs=['cn', 'description'] attrsonly=0 search_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:931
  2015-07-01 15:34:40.834 60 DEBUG keystone.common.ldap.core [-] LDAP unbind unbind_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:904
  2015-07-01 15:34:40.834 60 ERROR keystone.common.wsgi [-] {'desc': 'Bad search filter'}
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi Traceback (most recent call last):
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/wsgi.py", line 239, in __call__
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = method(context, **params)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/controller.py", line 202, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, context, filters, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/controllers.py", line 309, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     hints=hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/manager.py", line 52, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 345, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 356, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 1003, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     ref_list = driver.list_groups(hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 164, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.group.get_all_filtered(hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 402, in get_all_filtered
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for group in self.get_all(query)]
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1505, in get_all
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for x in self._ldap_get_all(ldap_filter)]
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1467, in _ldap_get_all
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 944, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist_utf8, attrsonly)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 541, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist, attrsonly)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 552, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 545, in search_ext_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     msgid = self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientctrls,timeout,sizelimit)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 541, in search_ext
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     timeout,sizelimit,
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 99, in _ldap_call
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = func(*args,**kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi FILTER_ERROR: {'desc': 'Bad search filter'}
- 2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi 
+ 2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi
  2015-07-01 15:34:40.838 60 INFO eventlet.wsgi.server [-] 172.17.0.25 - - [01/Jul/2015 15:34:40] "GET /v3/groups?domain_id=d5486c74465945b8bf1046339cf23171&name=demo HTTP/1.1" 500 483 0.011650
  
  This is roughly the same problem as in
- https://bugs.launchpad.net/keystone/+bug/1459382, but for groups.
+ https://bugs.launchpad.net/keystone/+bug/1454309, but for groups.

** Description changed:

- I have a user and a project in a LDAP domain, when adding a project role
- to a group the following happens:
+ I have a user and group in an LDAP domain. I add a project to that
+ domain. When adding a project role to the group the following happens:
  
  root@707c0f475a99:~# openstack role add --project $projid --group demo --group-domain acme user
  ERROR: openstack An unexpected error prevented the server from fulfilling your request: {'desc': 'Bad search filter'} (Disable debug mode to suppress these details.) (HTTP 500) (Request-ID: req-48d22a63-cfd2-47ae-a247-c51ca4a68674)
  
  and keystone logs shows:
  
  2015-07-01 15:34:40.833 60 DEBUG keystone.common.ldap.core [-] LDAP search: base=ou=Groups,dc=acme,dc=org scope=1 filterstr=(&(&None(cn=demo))(objectClass=groupOfNames)) attrs=['cn', 'description'] attrsonly=0 search_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:931
  2015-07-01 15:34:40.834 60 DEBUG keystone.common.ldap.core [-] LDAP unbind unbind_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:904
  2015-07-01 15:34:40.834 60 ERROR keystone.common.wsgi [-] {'desc': 'Bad search filter'}
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi Traceback (most recent call last):
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/wsgi.py", line 239, in __call__
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = method(context, **params)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/controller.py", line 202, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, context, filters, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/controllers.py", line 309, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     hints=hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/manager.py", line 52, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 345, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 356, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 1003, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     ref_list = driver.list_groups(hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 164, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.group.get_all_filtered(hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 402, in get_all_filtered
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for group in self.get_all(query)]
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1505, in get_all
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for x in self._ldap_get_all(ldap_filter)]
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1467, in _ldap_get_all
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 944, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist_utf8, attrsonly)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 541, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist, attrsonly)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 552, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 545, in search_ext_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     msgid = self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientctrls,timeout,sizelimit)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 541, in search_ext
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     timeout,sizelimit,
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 99, in _ldap_call
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = func(*args,**kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi FILTER_ERROR: {'desc': 'Bad search filter'}
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi
  2015-07-01 15:34:40.838 60 INFO eventlet.wsgi.server [-] 172.17.0.25 - - [01/Jul/2015 15:34:40] "GET /v3/groups?domain_id=d5486c74465945b8bf1046339cf23171&name=demo HTTP/1.1" 500 483 0.011650
  
  This is roughly the same problem as in
  https://bugs.launchpad.net/keystone/+bug/1454309, but for groups.

** Also affects: keystone (Ubuntu)
   Importance: Undecided
       Status: New

** Description changed:

+ Kilo packages from Ubuntu 15.04
+ 
  I have a user and group in an LDAP domain. I add a project to that
  domain. When adding a project role to the group the following happens:
  
  root@707c0f475a99:~# openstack role add --project $projid --group demo --group-domain acme user
  ERROR: openstack An unexpected error prevented the server from fulfilling your request: {'desc': 'Bad search filter'} (Disable debug mode to suppress these details.) (HTTP 500) (Request-ID: req-48d22a63-cfd2-47ae-a247-c51ca4a68674)
  
  and keystone logs shows:
  
  2015-07-01 15:34:40.833 60 DEBUG keystone.common.ldap.core [-] LDAP search: base=ou=Groups,dc=acme,dc=org scope=1 filterstr=(&(&None(cn=demo))(objectClass=groupOfNames)) attrs=['cn', 'description'] attrsonly=0 search_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:931
  2015-07-01 15:34:40.834 60 DEBUG keystone.common.ldap.core [-] LDAP unbind unbind_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:904
  2015-07-01 15:34:40.834 60 ERROR keystone.common.wsgi [-] {'desc': 'Bad search filter'}
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi Traceback (most recent call last):
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/wsgi.py", line 239, in __call__
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = method(context, **params)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/controller.py", line 202, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, context, filters, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/controllers.py", line 309, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     hints=hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/manager.py", line 52, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 345, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 356, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 1003, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     ref_list = driver.list_groups(hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 164, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.group.get_all_filtered(hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 402, in get_all_filtered
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for group in self.get_all(query)]
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1505, in get_all
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for x in self._ldap_get_all(ldap_filter)]
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1467, in _ldap_get_all
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 944, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist_utf8, attrsonly)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 541, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist, attrsonly)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 552, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 545, in search_ext_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     msgid = self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientctrls,timeout,sizelimit)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 541, in search_ext
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     timeout,sizelimit,
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 99, in _ldap_call
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = func(*args,**kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi FILTER_ERROR: {'desc': 'Bad search filter'}
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi
  2015-07-01 15:34:40.838 60 INFO eventlet.wsgi.server [-] 172.17.0.25 - - [01/Jul/2015 15:34:40] "GET /v3/groups?domain_id=d5486c74465945b8bf1046339cf23171&name=demo HTTP/1.1" 500 483 0.011650
  
  This is roughly the same problem as in
  https://bugs.launchpad.net/keystone/+bug/1454309, but for groups.

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1470570

Title:
  role assignment to group fails: Bad search filter

Status in OpenStack Identity (Keystone):
  New
Status in keystone package in Ubuntu:
  New

Bug description:
  Kilo packages from Ubuntu 15.04

  I have a user and group in an LDAP domain. I add a project to that
  domain. When adding a project role to the group the following happens:

  root@707c0f475a99:~# openstack role add --project $projid --group demo --group-domain acme user
  ERROR: openstack An unexpected error prevented the server from fulfilling your request: {'desc': 'Bad search filter'} (Disable debug mode to suppress these details.) (HTTP 500) (Request-ID: req-48d22a63-cfd2-47ae-a247-c51ca4a68674)

  and keystone logs shows:

  2015-07-01 15:34:40.833 60 DEBUG keystone.common.ldap.core [-] LDAP search: base=ou=Groups,dc=acme,dc=org scope=1 filterstr=(&(&None(cn=demo))(objectClass=groupOfNames)) attrs=['cn', 'description'] attrsonly=0 search_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:931
  2015-07-01 15:34:40.834 60 DEBUG keystone.common.ldap.core [-] LDAP unbind unbind_s /usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py:904
  2015-07-01 15:34:40.834 60 ERROR keystone.common.wsgi [-] {'desc': 'Bad search filter'}
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi Traceback (most recent call last):
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/wsgi.py", line 239, in __call__
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = method(context, **params)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/controller.py", line 202, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, context, filters, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/controllers.py", line 309, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     hints=hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/manager.py", line 52, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 345, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 356, in wrapper
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return f(self, *args, **kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/core.py", line 1003, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     ref_list = driver.list_groups(hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 164, in list_groups
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.group.get_all_filtered(hints)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/identity/backends/ldap.py", line 402, in get_all_filtered
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for group in self.get_all(query)]
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1505, in get_all
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     for x in self._ldap_get_all(ldap_filter)]
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 1467, in _ldap_get_all
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 944, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist_utf8, attrsonly)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/keystone/common/ldap/core.py", line 541, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     attrlist, attrsonly)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 552, in search_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 545, in search_ext_s
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     msgid = self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientctrls,timeout,sizelimit)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 541, in search_ext
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     timeout,sizelimit,
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 99, in _ldap_call
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi     result = func(*args,**kwargs)
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi FILTER_ERROR: {'desc': 'Bad search filter'}
  2015-07-01 15:34:40.834 60 TRACE keystone.common.wsgi
  2015-07-01 15:34:40.838 60 INFO eventlet.wsgi.server [-] 172.17.0.25 - - [01/Jul/2015 15:34:40] "GET /v3/groups?domain_id=d5486c74465945b8bf1046339cf23171&name=demo HTTP/1.1" 500 483 0.011650

  This is roughly the same problem as in
  https://bugs.launchpad.net/keystone/+bug/1454309, but for groups.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1470570/+subscriptions
Follow ups

[Bug 1470570] [NEW] role assignment to group fails: Bad search filter
From: Hans Feldt, 2015-07-01
References

[Bug 1470570] [NEW] role assignment to group fails: Bad search filter
From: Hans Feldt, 2015-07-01