keystone/keystone
Colleen Murphy b6a009254f Delete SQL users before deleting domain
Since the users table has a foreign key to the projects table[1], users
must be deleted before the domain can be deleted. However, the
notification emitted from the domain deletion comes too late, and
keystone runs into a foreign key reference error before it can delete
the users. This patch addresses the problem by adding a new internal
notification to alert the identity manager that users should be deleted.
This uses a new notification rather than the existing notification
because the existing one is used to alert listeners that the domain
deletion has been fully completed, whereas this one must happen in the
middle of the domain delete process.

The callback must also only try to delete SQL users. The LDAP driver
doesn't support deleting users, and we can't assume other drivers
support it either. Moreover, the foreign key reference is only a problem
for SQL users anyway.

Because our backend unit tests run with SQLite and foreign keys do not
work properly, we can't properly expose this bug in our unit tests, but
there is an accompanying tempest test[2][3] to validate this fix.

[1] https://github.com/openstack/keystone/blob/2bd88d3/keystone/common/sql/expand_repo/versions/014_expand_add_domain_id_to_user_table.py#L140-L141
[2] https://review.openstack.org/#/c/509610
[3] https://review.openstack.org/#/c/509947

Change-Id: If5bdb6f5eef80b50b000aed5188ce7da4dfd1083
Closes-bug: #1718747
(cherry picked from commit 62ee18b359)
2018-02-12 14:22:52 +01:00
..
assignment Handle group NotFound in effective assignment list 2017-05-31 12:23:02 +05:30
auth Merge "Remove de-dupe for MFA Rule parsing." 2017-02-01 20:51:18 +00:00
catalog Do not call `to_dict` outside of a session context 2017-01-25 06:12:20 +00:00
cmd Fix bad error message from FernetUtils 2017-01-30 19:11:49 -08:00
common Merge "Use https for docs.openstack.org references" 2017-02-01 16:36:44 +00:00
conf Create user option `ignore_lockout_failure_attempts` 2017-01-29 13:19:44 -08:00
contrib Fix the s3tokens endpoint 2017-11-29 15:37:26 +00:00
credential Fix bad error message from FernetUtils 2017-01-30 19:11:49 -08:00
endpoint_policy Merge "Create unit tests for endpoint policy drivers" 2016-11-10 13:45:23 +00:00
federation Use https for docs.openstack.org references 2017-01-30 16:05:08 -08:00
identity Delete SQL users before deleting domain 2018-02-12 14:22:52 +01:00
locale Imported Translations from Zanata 2017-04-08 07:35:01 +00:00
middleware Merge "Add is_admin_project to policy dict" 2016-10-14 15:59:07 +00:00
models Fix cloud_admin rule and ensure only project tokens can be cloud admin 2016-12-23 09:31:08 +00:00
oauth1 Change url scheme passed to oauth signature verifier 2017-07-13 22:10:13 +00:00
policy Merge "Pass initiator to Manager as a kwarg" 2016-10-09 02:57:43 +00:00
resource Delete SQL users before deleting domain 2018-02-12 14:22:52 +01:00
revoke Use https for docs.openstack.org references 2017-01-30 16:05:08 -08:00
server Error messages are not translating with locale. 2017-03-26 17:53:50 +00:00
tests Fix the s3tokens endpoint 2017-11-29 15:37:26 +00:00
token Fixing flushing tokens workflow 2017-07-11 15:28:06 +00:00
trust Remove eventlet-related call to sleep 2016-11-24 12:43:18 +00:00
v2_crud Use https for docs.openstack.org references 2017-01-30 16:05:08 -08:00
version Use https for docs.openstack.org references 2017-01-30 16:05:08 -08:00
__init__.py Revert "Disable eventlet monkey-patching of DNS" 2013-05-10 10:24:48 -04:00
exception.py Process and validate auth methods against MFA rules 2017-01-31 08:48:35 -08:00
i18n.py Use https for docs.openstack.org references 2017-01-30 16:05:08 -08:00
notifications.py Delete SQL users before deleting domain 2018-02-12 14:22:52 +01:00