Expose defect in users_in_group, groups_for_user exact filters

List users in a group by name and list groups for user by name throws
HTTP 500 error in case of exact filters because filter_by query used
in case of exact filter is not able to filter using 'name' attribute.
This patch exposes this issue by adding new unit test cases to ensure
list_users_in_group and list_groups_for_user APIs are called with
exact filters.

Note: Added 'from keystone.tests.unit.utils import wip' in
test_backend_ldap.py, because 'wip' is not there in
test_backend_ldap imports in stable-liberty.

Conflicts:
        keystone/tests/unit/test_backend.py

Partial-Bug: 1521772
Change-Id: I5d3c2041551a020341a98554ebb885888ec3cc9d
(cherry picked from commit 545987e1c4)

keystone/tests/unit/test_backend.py

@@ -6662,24 +6662,7 @@ class FilterTests(filtering.FilterTests):
 
         self._delete_test_data('user', user_list)
 
-    def test_groups_for_user_filtered(self):
+    def _groups_for_user_data(self):
-        """Test use of filtering doesn't break groups_for_user listing.
-
-        Some backends may use filtering to achieve the list of groups for a
-        user, so test that it can combine a second filter.
-
-        Test Plan:
-
-        - Create 10 groups, some with names we can filter on
-        - Create 2 users
-        - Assign 1 of those users to most of the groups, including some of the
-          well known named ones
-        - Assign the other user to other groups as spoilers
-        - Ensure that when we list groups for users with a filter on the group
-          name, both restrictions have been enforced on what is returned.
-
-        """
-
         number_of_groups = 10
         group_name_data = {
             # entity index: name for entity
@@ -6703,6 +6686,26 @@ class FilterTests(filtering.FilterTests):
                                                 group_list[group]['id'])
 
         hints = driver_hints.Hints()
+        return group_list, user_list, hints
+
+    def test_groups_for_user_inexact_filtered(self):
+        """Test use of filtering doesn't break groups_for_user listing.
+
+        Some backends may use filtering to achieve the list of groups for a
+        user, so test that it can combine a second filter.
+
+        Test Plan:
+
+        - Create 10 groups, some with names we can filter on
+        - Create 2 users
+        - Assign 1 of those users to most of the groups, including some of the
+          well known named ones
+        - Assign the other user to other groups as spoilers
+        - Ensure that when we list groups for users with a filter on the group
+          name, both restrictions have been enforced on what is returned.
+
+        """
+        group_list, user_list, hints = self._groups_for_user_data()
         hints.add_filter('name', 'The', comparator='startswith')
         groups = self.identity_api.list_groups_for_user(
             user_list[0]['id'], hints=hints)
@@ -6714,6 +6717,20 @@ class FilterTests(filtering.FilterTests):
         self._delete_test_data('user', user_list)
         self._delete_test_data('group', group_list)
 
+    @test_utils.wip('Waiting on bug #1521772 to be fixed')
+    def test_groups_for_user_exact_filtered(self):
+        """Test exact filters doesn't break groups_for_user listing."""
+        group_list, user_list, hints = self._groups_for_user_data()
+        hints.add_filter('name', 'The Ministry', comparator='equals')
+        groups = self.identity_api.list_groups_for_user(
+            user_list[0]['id'], hints=hints)
+        # We should only get back 1 out of the 3 groups with name 'The
+        # Ministry' hence showing that both "filters" have been applied.
+        self.assertEqual(1, len(groups))
+        self.assertEqual(group_list[6]['id'], groups[0]['id'])
+        self._delete_test_data('user', user_list)
+        self._delete_test_data('group', group_list)
+
     def _get_user_name_field_size(self):
         """Return the size of the user name field for the backend.
 
@@ -6748,7 +6765,7 @@ class FilterTests(filtering.FilterTests):
         users = self.identity_api.list_users(hints=hints)
         self.assertEqual([], users)
 
-    def test_list_users_in_group_filtered(self):
+    def _list_users_in_group_data(self):
         number_of_users = 10
         user_name_data = {
             1: 'Arthur Conan Doyle',
@@ -6765,6 +6782,10 @@ class FilterTests(filtering.FilterTests):
                                                 group['id'])
 
         hints = driver_hints.Hints()
+        return user_list, group, hints
+
+    def test_list_users_in_group_inexact_filtered(self):
+        user_list, group, hints = self._list_users_in_group_data()
         hints.add_filter('name', 'Arthur', comparator='startswith')
         users = self.identity_api.list_users_in_group(group['id'], hints=hints)
         self.assertThat(len(users), matchers.Equals(2))
@@ -6773,6 +6794,16 @@ class FilterTests(filtering.FilterTests):
         self._delete_test_data('user', user_list)
         self._delete_entity('group')(group['id'])
 
+    @test_utils.wip('Waiting on bug #1521772 to be fixed')
+    def test_list_users_in_group_exact_filtered(self):
+        user_list, group, hints = self._list_users_in_group_data()
+        hints.add_filter('name', 'Arthur Rimbaud', comparator='equals')
+        users = self.identity_api.list_users_in_group(group['id'], hints=hints)
+        self.assertEqual(1, len(users))
+        self.assertEqual(user_list[3]['id'], users[0]['id'])
+        self._delete_test_data('user', user_list)
+        self._delete_entity('group')(group['id'])
+
 
 class LimitTests(filtering.FilterTests):
     ENTITIES = ['user', 'group', 'project']

keystone/tests/unit/test_backend_ldap.py

@@ -37,6 +37,7 @@ from keystone.tests.unit import identity_mapping as mapping_sql
 from keystone.tests.unit.ksfixtures import database
 from keystone.tests.unit.ksfixtures import ldapdb
 from keystone.tests.unit import test_backend
+from keystone.tests.unit.utils import wip
 
 
 CONF = cfg.CONF
@@ -3344,13 +3345,19 @@ class LdapFilterTests(test_backend.FilterTests, unit.TestCase):
         config_files.append(unit.dirs.tests_conf('backend_ldap.conf'))
         return config_files
 
-    def test_list_users_in_group_filtered(self):
+    @wip('Not supported by LDAP identity driver')
+    def test_list_users_in_group_inexact_filtered(self):
         # The LDAP identity driver currently does not support filtering on the
         # listing users for a given group, so will fail this test.
-        try:
+        super(LdapFilterTests,
-            super(LdapFilterTests, self).test_list_users_in_group_filtered()
+              self).test_list_users_in_group_inexact_filtered()
-        except matchers.MismatchError:
+
-            return
+    @wip('Not supported by LDAP identity driver')
-        # We shouldn't get here...if we do, it means someone has implemented
+    def test_list_users_in_group_exact_filtered(self):
-        # filtering, so we can remove this test override.
+        # The LDAP identity driver currently does not support filtering on the
-        self.assertTrue(False)
+        # listing users for a given group, so will fail this test.
+        super(LdapFilterTests, self).test_list_users_in_group_exact_filtered()
+
+    @wip('Waiting on bug #1521772 to be fixed')
+    def test_groups_for_user_exact_filtered(self):
+        super(LdapFilterTests, self).test_groups_for_user_exact_filtered()