yahoo-eng-team team mailing list archive

[Paul Halmos <paul.halmos@xxxxxxxxxxxxx>]

Public bug reported:

When upgrading from a single domain LDAP environment to a multi domain
LDAP environment all user role assignments are lost. The assignments'
field actor_id is mapped to a user name in a single domain setup.  When
setting 'domain_specific_drivers_enabled=true' the actor_id field now
maps to a new UUID which results in all existing users, including
service users, losing their role assignments.  I was able to overcome
this rather forcefully with this SQL query:

INSERT IGNORE INTO assignment(actor_id, target_id, role_id) SELECT
id_mapping.public_id, assignment.target_id, assignment.role_id FROM
id_mapping INNER JOIN assignment on id_mapping.local_id =
assignment.actor_id;

Version Tested: 2014.2.4

** Affects: keystone
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1483419

Title:
  Single Domain to Multi Domain assignments are lost

Status in Keystone:
  New

Bug description:
  When upgrading from a single domain LDAP environment to a multi domain
  LDAP environment all user role assignments are lost. The assignments'
  field actor_id is mapped to a user name in a single domain setup.
  When setting 'domain_specific_drivers_enabled=true' the actor_id field
  now maps to a new UUID which results in all existing users, including
  service users, losing their role assignments.  I was able to overcome
  this rather forcefully with this SQL query:

  INSERT IGNORE INTO assignment(actor_id, target_id, role_id) SELECT
  id_mapping.public_id, assignment.target_id, assignment.role_id FROM
  id_mapping INNER JOIN assignment on id_mapping.local_id =
  assignment.actor_id;

  Version Tested: 2014.2.4

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1483419/+subscriptions