yahoo-eng-team team mailing list archive

Thread
Date
[Bug 2119091] [NEW] Tempest failure: Invalid application credential: Cannot create an application credential with unassigned role

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Alexey Stupnikov <2119091@xxxxxxxxxxxxxxxxxx>
Date: Wed, 30 Jul 2025 08:21:18 -0000
Reply-to: Bug 2119091 <2119091@xxxxxxxxxxxxxxxxxx>
Sender: noreply@xxxxxxxxxxxxx
Public bug reported:

Openstackclient functional test
https://zuul.opendev.org/t/openstack/build/d86cc220c3b941238e9e04abb0199a14/logs
failed:

https://ab763eb0d7c63fa81442-6f68292648870900061da6578eace132.ssl.cf5.rackcdn.com/openstack/d86cc220c3b941238e9e04abb0199a14/job-output.txt
2025-07-29 16:41:16.031802 | controller | {2} openstackclient.tests.functional.identity.v3.test_application_credential.ApplicationCredentialTests.test_application_credential_create_with_options [12.022572s] ... FAILED
2025-07-29 16:41:16.031824 | controller |
2025-07-29 16:41:16.031828 | controller | Captured traceback:
2025-07-29 16:41:16.031831 | controller | ~~~~~~~~~~~~~~~~~~~
2025-07-29 16:41:16.031834 | controller |     Traceback (most recent call last):
2025-07-29 16:41:16.031837 | controller |
2025-07-29 16:41:16.031841 | controller |       File "/home/zuul/src/opendev.org/openstack/python-openstackclient/openstackclient/tests/functional/identity/v3/test_application_credential.py", line 114, in test_application_credential_create_with_options
2025-07-29 16:41:16.031844 | controller |     raw_output = self.openstack(
2025-07-29 16:41:16.031847 | controller |                  ^^^^^^^^^^^^^^^
2025-07-29 16:41:16.031849 | controller |
2025-07-29 16:41:16.031852 | controller |       File "/home/zuul/src/opendev.org/openstack/python-openstackclient/openstackclient/tests/functional/base.py", line 94, in openstack
2025-07-29 16:41:16.031855 | controller |     output = execute(
2025-07-29 16:41:16.031858 | controller |              ^^^^^^^^
2025-07-29 16:41:16.031860 | controller |
2025-07-29 16:41:16.031863 | controller |       File "/home/zuul/src/opendev.org/openstack/python-openstackclient/openstackclient/tests/functional/base.py", line 45, in execute
2025-07-29 16:41:16.031866 | controller |     raise exceptions.CommandFailed(
2025-07-29 16:41:16.031868 | controller |
2025-07-29 16:41:16.031982 | controller |     tempest.lib.exceptions.CommandFailed: Command 'openstack --os-cloud devstack-admin application credential create tempest-name-99802068 --secret tempest-secret-710046600 --description tempest-description-1861015131 --expiration 2025-07-30T16:41:04 --role tempest-TestRole-1588609862 --role tempest-TestRole-2048979491 --unrestricted' returned non-zero exit status 1.
2025-07-29 16:41:16.031989 | controller | stdout:
2025-07-29 16:41:16.031993 | controller |
2025-07-29 16:41:16.031996 | controller | stderr:
2025-07-29 16:41:16.031999 | controller | b'BadRequestException: 400: Client Error for url: https://10.0.17.184/identity/v3/users/b1b1ddf67dd143f883082253589ba01e/application_credentials, Invalid application credential: Cannot create an application credential with unassigned role\n'

Keystone logs:
https://ab763eb0d7c63fa81442-6f68292648870900061da6578eace132.ssl.cf5.rackcdn.com/openstack/d86cc220c3b941238e9e04abb0199a14/controller/logs/screen-keystone.txt
Jul 29 16:41:12.598964 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.middleware.auth_context [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] RBAC: auth_context: {'token': <TokenModel (audit_id=AAwnYeM9R-q6opdPhSRp1A, audit_chain_id=['AAwnYeM9R-q6opdPhSRp1A']) at 0x7ace881d2960>, 'domain_id': None, 'trust_id': None, 'trustor_id': None, 'trustee_id': None, 'domain_name': None, 'group_ids': [], 'user_id': 'b1b1ddf67dd143f883082253589ba01e', 'user_domain_id': 'default', 'system_scope': None, 'project_id': '999584f0d89a473db317bcc7ad60e37f', 'project_domain_id': 'default', 'roles': ['manager', 'tempest-TestRole-1588609862', 'reader', 'admin', 'member'], 'is_admin_project': True, 'service_user_id': None, 'service_user_domain_id': None, 'service_project_id': None, 'service_project_domain_id': None, 'service_roles': []} {{(pid=50957) fill_context /opt/stack/keystone/keystone/server/flask/request_processing/middleware/auth_context.py:509}}
Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] REQUEST_METHOD: `POST` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:26}}
Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] SCRIPT_NAME: `/identity` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:27}}
Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] REQUEST_METHOD: `POST` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:26}}
Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] SCRIPT_NAME: `/identity` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:27}}
Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] PATH_INFO: `/v3/users/b1b1ddf67dd143f883082253589ba01e/application_credentials` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:28}}
Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.common.rbac_enforcer.enforcer [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] RBAC: Authorizing `identity:create_application_credential(user_id=b1b1ddf67dd143f883082253589ba01e)` {{(pid=50957) enforce_call /opt/stack/keystone/keystone/common/rbac_enforcer/enforcer.py:494}}
Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.common.rbac_enforcer.enforcer [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] RBAC: Authorization granted {{(pid=50957) enforce_call /opt/stack/keystone/keystone/common/rbac_enforcer/enforcer.py:505}}
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] Invalid application credential: Cannot create an application credential with unassigned role: keystone.exception.ApplicationCredentialValidationError: Invalid application credential: Cannot create an application credential with unassigned role
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application Traceback (most recent call last):
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask_restful/__init__.py", line 295, in error_router
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     return self.handle_error(e)
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask_restful/__init__.py", line 310, in handle_error
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     _handle_flask_propagate_exceptions_config(current_app, e)
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask/app.py", line 917, in full_dispatch_request
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     rv = self.dispatch_request()
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application          ^^^^^^^^^^^^^^^^^^^^^^^
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask/app.py", line 902, in dispatch_request
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)  # type: ignore[no-any-return]
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask_restful/__init__.py", line 489, in wrapper
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     resp = resource(*args, **kwargs)
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask/views.py", line 110, in view
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     return current_app.ensure_sync(self.dispatch_request)(**kwargs)  # type: ignore[no-any-return]
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask_restful/__init__.py", line 604, in dispatch_request
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     resp = meth(*args, **kwargs)
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/keystone/keystone/api/validation/__init__.py", line 80, in wrapper
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     return func(*args, **kwargs)
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/keystone/keystone/api/validation/__init__.py", line 139, in wrapper
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     response = func(*args, **kwargs)
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application                ^^^^^^^^^^^^^^^^^^^^^
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/keystone/keystone/api/users.py", line 728, in post
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     app_cred_data['roles'] = self._get_roles(app_cred_data, token)
Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/keystone/keystone/api/users.py", line 673, in _get_roles
Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     raise ks_exception.ApplicationCredentialValidationError(
Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application keystone.exception.ApplicationCredentialValidationError: Invalid application credential: Cannot create an application credential with unassigned role
Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application 
Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: [pid: 50957|app: 0|req: 1629/3249] 10.0.17.184 () {68 vars in 1476 bytes} [Tue Jul 29 16:41:12 2025] POST /identity/v3/users/b1b1ddf67dd143f883082253589ba01e/application_credentials => generated 150 bytes in 17 msecs (HTTP/1.1 400) 5 headers in 186 bytes (1 switches on core 0)


It looks like request itself was valid and role assignment was a correct one when request was made. It looks like some server-side regression. A minor side issue: Keystone should likely log the role id that failed check for troubleshooting purposes

** Affects: keystone
     Importance: Undecided
         Status: New


** Tags: tempest

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/2119091

Title:
  Tempest failure:  Invalid application credential: Cannot create an
  application credential with unassigned role

Status in OpenStack Identity (keystone):
  New

Bug description:
  Openstackclient functional test
  https://zuul.opendev.org/t/openstack/build/d86cc220c3b941238e9e04abb0199a14/logs
  failed:

  https://ab763eb0d7c63fa81442-6f68292648870900061da6578eace132.ssl.cf5.rackcdn.com/openstack/d86cc220c3b941238e9e04abb0199a14/job-output.txt
  2025-07-29 16:41:16.031802 | controller | {2} openstackclient.tests.functional.identity.v3.test_application_credential.ApplicationCredentialTests.test_application_credential_create_with_options [12.022572s] ... FAILED
  2025-07-29 16:41:16.031824 | controller |
  2025-07-29 16:41:16.031828 | controller | Captured traceback:
  2025-07-29 16:41:16.031831 | controller | ~~~~~~~~~~~~~~~~~~~
  2025-07-29 16:41:16.031834 | controller |     Traceback (most recent call last):
  2025-07-29 16:41:16.031837 | controller |
  2025-07-29 16:41:16.031841 | controller |       File "/home/zuul/src/opendev.org/openstack/python-openstackclient/openstackclient/tests/functional/identity/v3/test_application_credential.py", line 114, in test_application_credential_create_with_options
  2025-07-29 16:41:16.031844 | controller |     raw_output = self.openstack(
  2025-07-29 16:41:16.031847 | controller |                  ^^^^^^^^^^^^^^^
  2025-07-29 16:41:16.031849 | controller |
  2025-07-29 16:41:16.031852 | controller |       File "/home/zuul/src/opendev.org/openstack/python-openstackclient/openstackclient/tests/functional/base.py", line 94, in openstack
  2025-07-29 16:41:16.031855 | controller |     output = execute(
  2025-07-29 16:41:16.031858 | controller |              ^^^^^^^^
  2025-07-29 16:41:16.031860 | controller |
  2025-07-29 16:41:16.031863 | controller |       File "/home/zuul/src/opendev.org/openstack/python-openstackclient/openstackclient/tests/functional/base.py", line 45, in execute
  2025-07-29 16:41:16.031866 | controller |     raise exceptions.CommandFailed(
  2025-07-29 16:41:16.031868 | controller |
  2025-07-29 16:41:16.031982 | controller |     tempest.lib.exceptions.CommandFailed: Command 'openstack --os-cloud devstack-admin application credential create tempest-name-99802068 --secret tempest-secret-710046600 --description tempest-description-1861015131 --expiration 2025-07-30T16:41:04 --role tempest-TestRole-1588609862 --role tempest-TestRole-2048979491 --unrestricted' returned non-zero exit status 1.
  2025-07-29 16:41:16.031989 | controller | stdout:
  2025-07-29 16:41:16.031993 | controller |
  2025-07-29 16:41:16.031996 | controller | stderr:
  2025-07-29 16:41:16.031999 | controller | b'BadRequestException: 400: Client Error for url: https://10.0.17.184/identity/v3/users/b1b1ddf67dd143f883082253589ba01e/application_credentials, Invalid application credential: Cannot create an application credential with unassigned role\n'

  Keystone logs:
  https://ab763eb0d7c63fa81442-6f68292648870900061da6578eace132.ssl.cf5.rackcdn.com/openstack/d86cc220c3b941238e9e04abb0199a14/controller/logs/screen-keystone.txt
  Jul 29 16:41:12.598964 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.middleware.auth_context [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] RBAC: auth_context: {'token': <TokenModel (audit_id=AAwnYeM9R-q6opdPhSRp1A, audit_chain_id=['AAwnYeM9R-q6opdPhSRp1A']) at 0x7ace881d2960>, 'domain_id': None, 'trust_id': None, 'trustor_id': None, 'trustee_id': None, 'domain_name': None, 'group_ids': [], 'user_id': 'b1b1ddf67dd143f883082253589ba01e', 'user_domain_id': 'default', 'system_scope': None, 'project_id': '999584f0d89a473db317bcc7ad60e37f', 'project_domain_id': 'default', 'roles': ['manager', 'tempest-TestRole-1588609862', 'reader', 'admin', 'member'], 'is_admin_project': True, 'service_user_id': None, 'service_user_domain_id': None, 'service_project_id': None, 'service_project_domain_id': None, 'service_roles': []} {{(pid=50957) fill_context /opt/stack/keystone/keystone/server/flask/request_processing/middleware/auth_context.py:509}}
  Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] REQUEST_METHOD: `POST` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:26}}
  Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] SCRIPT_NAME: `/identity` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:27}}
  Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] REQUEST_METHOD: `POST` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:26}}
  Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] SCRIPT_NAME: `/identity` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:27}}
  Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.server.flask.request_processing.req_logging [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] PATH_INFO: `/v3/users/b1b1ddf67dd143f883082253589ba01e/application_credentials` {{(pid=50957) log_request_info /opt/stack/keystone/keystone/server/flask/request_processing/req_logging.py:28}}
  Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.common.rbac_enforcer.enforcer [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] RBAC: Authorizing `identity:create_application_credential(user_id=b1b1ddf67dd143f883082253589ba01e)` {{(pid=50957) enforce_call /opt/stack/keystone/keystone/common/rbac_enforcer/enforcer.py:494}}
  Jul 29 16:41:12.600880 np0391899a67ab4 devstack@keystone.service[50957]: DEBUG keystone.common.rbac_enforcer.enforcer [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] RBAC: Authorization granted {{(pid=50957) enforce_call /opt/stack/keystone/keystone/common/rbac_enforcer/enforcer.py:505}}
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application [None req-f0e424b2-d20c-4e30-bef3-98bf135863ac admin admin] Invalid application credential: Cannot create an application credential with unassigned role: keystone.exception.ApplicationCredentialValidationError: Invalid application credential: Cannot create an application credential with unassigned role
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application Traceback (most recent call last):
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask_restful/__init__.py", line 295, in error_router
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     return self.handle_error(e)
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask_restful/__init__.py", line 310, in handle_error
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     _handle_flask_propagate_exceptions_config(current_app, e)
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask/app.py", line 917, in full_dispatch_request
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     rv = self.dispatch_request()
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application          ^^^^^^^^^^^^^^^^^^^^^^^
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask/app.py", line 902, in dispatch_request
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)  # type: ignore[no-any-return]
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  Jul 29 16:41:12.610553 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask_restful/__init__.py", line 489, in wrapper
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     resp = resource(*args, **kwargs)
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^^^^^
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask/views.py", line 110, in view
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     return current_app.ensure_sync(self.dispatch_request)(**kwargs)  # type: ignore[no-any-return]
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/data/venv/lib/python3.12/site-packages/flask_restful/__init__.py", line 604, in dispatch_request
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     resp = meth(*args, **kwargs)
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/keystone/keystone/api/validation/__init__.py", line 80, in wrapper
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     return func(*args, **kwargs)
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application            ^^^^^^^^^^^^^^^^^^^^^
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/keystone/keystone/api/validation/__init__.py", line 139, in wrapper
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     response = func(*args, **kwargs)
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application                ^^^^^^^^^^^^^^^^^^^^^
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/keystone/keystone/api/users.py", line 728, in post
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     app_cred_data['roles'] = self._get_roles(app_cred_data, token)
  Jul 29 16:41:12.612009 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application   File "/opt/stack/keystone/keystone/api/users.py", line 673, in _get_roles
  Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application     raise ks_exception.ApplicationCredentialValidationError(
  Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application keystone.exception.ApplicationCredentialValidationError: Invalid application credential: Cannot create an application credential with unassigned role
  Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: ERROR keystone.server.flask.application 
  Jul 29 16:41:12.612230 np0391899a67ab4 devstack@keystone.service[50957]: [pid: 50957|app: 0|req: 1629/3249] 10.0.17.184 () {68 vars in 1476 bytes} [Tue Jul 29 16:41:12 2025] POST /identity/v3/users/b1b1ddf67dd143f883082253589ba01e/application_credentials => generated 150 bytes in 17 msecs (HTTP/1.1 400) 5 headers in 186 bytes (1 switches on core 0)

  
  It looks like request itself was valid and role assignment was a correct one when request was made. It looks like some server-side regression. A minor side issue: Keystone should likely log the role id that failed check for troubleshooting purposes

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/2119091/+subscriptions