Merge "Don't remove role assignment if no change"

heat/engine/resources/openstack/keystone/role_assignments.py

@@ -254,6 +254,8 @@ class KeystoneRoleAssignmentMixin(object):
                     self.properties.get(self.ROLES))
 
     def update_assignment(self, prop_diff, user_id=None, group_id=None):
+        # if there is no change do not update
+        if self.ROLES in prop_diff:
             (new_role_assignments,
              removed_role_assignments) = self._find_differences(
                 prop_diff.get(self.ROLES),

heat/tests/openstack/keystone/test_group.py

@@ -261,6 +261,11 @@ class KeystoneGroupTest(common.HeatTestCase):
             domain_id='test_domain'
         )
 
+        # validate the role assignment isn't updated
+        self.roles = self.keystoneclient.roles
+        self.assertEqual(0, self.roles.revoke.call_count)
+        self.assertEqual(0, self.roles.grant.call_count)
+
     def test_group_handle_update_default(self):
         self.test_group.resource_id = '477e8273-60a7-4c41-b683-fdb0bc7cd151'
         self.test_group._stored_properties_data = dict(domain='default')

heat/tests/openstack/keystone/test_role_assignments.py

@@ -309,6 +309,20 @@ class KeystoneRoleAssignmentMixinTest(common.HeatTestCase):
             group='group_1',
             project='project_1')
 
+    def test_role_assignment_update_roles_no_change(self):
+        prop_diff = {}
+        self.test_role_assignment.update_assignment(
+            group_id='group_1',
+            prop_diff=prop_diff)
+        self.assertEqual(0, self.roles.grant.call_count)
+        self.assertEqual(0, self.roles.revoke.call_count)
+
+        self.test_role_assignment.update_assignment(
+            user_id='user_1',
+            prop_diff=prop_diff)
+        self.assertEqual(0, self.roles.grant.call_count)
+        self.assertEqual(0, self.roles.revoke.call_count)
+
     def test_role_assignment_delete_user(self):
         self.test_role_assignment._stored_properties_data = {
             'roles': [

heat/tests/openstack/keystone/test_user.py

@@ -235,6 +235,11 @@ class KeystoneUserTest(common.HeatTestCase):
                 self.test_user.resource_id,
                 group)
 
+        # validate the role assignment isn't updated
+        self.roles = self.keystoneclient.roles
+        self.assertEqual(0, self.roles.revoke.call_count)
+        self.assertEqual(0, self.roles.grant.call_count)
+
     def test_user_handle_delete(self):
         self.test_user.resource_id = '477e8273-60a7-4c41-b683-fdb0bc7cd151'
         self.test_user._stored_properties_data = {