62ee18b359
Since the users table has a foreign key to the projects table[1], users must be deleted before the domain can be deleted. However, the notification emitted from the domain deletion comes too late, and keystone runs into a foreign key reference error before it can delete the users. This patch addresses the problem by adding a new internal notification to alert the identity manager that users should be deleted. This uses a new notification rather than the existing notification because the existing one is used to alert listeners that the domain deletion has been fully completed, whereas this one must happen in the middle of the domain delete process. The callback must also only try to delete SQL users. The LDAP driver doesn't support deleting users, and we can't assume other drivers support it either. Moreover, the foreign key reference is only a problem for SQL users anyway. Because our backend unit tests run with SQLite and foreign keys do not work properly, we can't properly expose this bug in our unit tests, but there is an accompanying tempest test[2][3] to validate this fix. [1] https://github.com/openstack/keystone/blob/2bd88d3/keystone/common/sql/expand_repo/versions/014_expand_add_domain_id_to_user_table.py#L140-L141 [2] https://review.openstack.org/#/c/509610 [3] https://review.openstack.org/#/c/509947 Change-Id: If5bdb6f5eef80b50b000aed5188ce7da4dfd1083 Closes-bug: #1718747
18 lines
865 B
YAML
18 lines
865 B
YAML
---
|
|
fixes:
|
|
- |
|
|
[`bug 1718747 <https://bugs.launchpad.net/keystone/+bug/1718747>`_]
|
|
Fixes a regression where deleting a domain with users in it caues a server
|
|
error. This bugfix restores the previous behavior of deleting the users
|
|
namespaced in the domain. This only applies when using the SQL identity
|
|
backend.
|
|
other:
|
|
- |
|
|
[`bug 1718747 <https://bugs.launchpad.net/keystone/+bug/1718747>`_]
|
|
As part of solving a regression in the identity SQL backend that prevented
|
|
domains containing users from being deleted, a notification callback was
|
|
altered so that users would only be deleted if the identity backend is SQL.
|
|
If you have a custom identity backend that is not read-only, deleting a
|
|
domain in keystone will not delete the users in your backend unless your
|
|
driver has an is_sql property that evaluates to true.
|