)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"a1716c1f63455da5a50201285bb7879e0a412238","unresolved":false,"context_lines":[{"line_number":9,"context_line":"When an LDAP user is deleted, keystone was removing it from groups that"},{"line_number":10,"context_line":"matched the group_filter conf setting, but not from other groups. This"},{"line_number":11,"context_line":"change fixes it to remove the user from all groups."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Icca09d2782b4adf9519a24d1713adcb8b3e2a27c"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7aa08908_44f20b07","line":12,"updated":"2016-06-08 21:53:59.000000000","message":"Sounds bug worthy","commit_id":"90a5c75201bcb2c412511be47964473248503964"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0a57b0d6620f5cebd853ad41fdeb2ee2c18d41ce","unresolved":false,"context_lines":[{"line_number":9,"context_line":"When an LDAP user is deleted, keystone was removing it from groups that"},{"line_number":10,"context_line":"matched the group_filter conf setting, but not from other groups. This"},{"line_number":11,"context_line":"change fixes it to remove the user from all groups."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Icca09d2782b4adf9519a24d1713adcb8b3e2a27c"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7aa08908_44e7abab","line":12,"in_reply_to":"7aa08908_44f20b07","updated":"2016-06-08 22:03:52.000000000","message":"yeah, I opened one, but forgot to reference... Fixed.","commit_id":"90a5c75201bcb2c412511be47964473248503964"}],"keystone/identity/backends/ldap/core.py":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"a1716c1f63455da5a50201285bb7879e0a412238","unresolved":false,"context_lines":[{"line_number":129,"context_line":"            try:"},{"line_number":130,"context_line":"                super(GroupApi, self.group).remove_member(user_dn, group_dn)"},{"line_number":131,"context_line":"            except ldap.NO_SUCH_ATTRIBUTE:"},{"line_number":132,"context_line":"                pass  # user has already been removed"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"},{"line_number":135,"context_line":"            self.project.remove_user(user.tenant_id, user_dn)"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_043ac398","line":132,"updated":"2016-06-08 21:53:59.000000000","message":"I suspect bandit will flag this.","commit_id":"90a5c75201bcb2c412511be47964473248503964"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0a57b0d6620f5cebd853ad41fdeb2ee2c18d41ce","unresolved":false,"context_lines":[{"line_number":129,"context_line":"            try:"},{"line_number":130,"context_line":"                super(GroupApi, self.group).remove_member(user_dn, group_dn)"},{"line_number":131,"context_line":"            except ldap.NO_SUCH_ATTRIBUTE:"},{"line_number":132,"context_line":"                pass  # user has already been removed"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"},{"line_number":135,"context_line":"            self.project.remove_user(user.tenant_id, user_dn)"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_6424670c","line":132,"in_reply_to":"7aa08908_043ac398","updated":"2016-06-08 22:03:52.000000000","message":"why?","commit_id":"90a5c75201bcb2c412511be47964473248503964"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"7140bfabcc3ef236da59dfecbd1e1b8ee1e529c2","unresolved":false,"context_lines":[{"line_number":129,"context_line":"            try:"},{"line_number":130,"context_line":"                super(GroupApi, self.group).remove_member(user_dn, group_dn)"},{"line_number":131,"context_line":"            except ldap.NO_SUCH_ATTRIBUTE:"},{"line_number":132,"context_line":"                pass  # user has already been removed"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"},{"line_number":135,"context_line":"            self.project.remove_user(user.tenant_id, user_dn)"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_d74fcf8f","line":132,"in_reply_to":"7aa08908_6424670c","updated":"2016-06-08 22:28:54.000000000","message":"Bandit flags any pass in except. So you\u0027ll want a # nosec here. For example:\n\n\nhttps://github.com/openstack/keystone/blob/8a56c161ee29e34e70c6334b048881e8fbbd7514/keystone/token/providers/fernet/utils.py#L250","commit_id":"90a5c75201bcb2c412511be47964473248503964"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"b10d05708db042b4aea8083d589b8d66f58dbecf","unresolved":false,"context_lines":[{"line_number":376,"context_line":"        user_dn_esc \u003d ldap.filter.escape_filter_chars(user_dn)"},{"line_number":377,"context_line":"        query \u003d \u0027(%s\u003d%s)%s\u0027 % (self.member_attribute,"},{"line_number":378,"context_line":"                               user_dn_esc,"},{"line_number":379,"context_line":"                               self.ldap_filter or \u0027\u0027)"},{"line_number":380,"context_line":"        return self.get_all(query)"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    def list_user_groups_filtered(self, user_dn, hints):"}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_5ac2e685","side":"PARENT","line":379,"range":{"start_line":379,"start_character":31,"end_line":379,"end_character":53},"updated":"2016-06-08 22:38:08.000000000","message":"why are you removing this ? this way group_filter option won\u0027t be honored in this case","commit_id":"a0bf8a02ca567276fd37b8e12fe6b79edaf363de"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"cdb5fbe95cb09de5777a5d57903aec49fc00daf3","unresolved":false,"context_lines":[{"line_number":376,"context_line":"        user_dn_esc \u003d ldap.filter.escape_filter_chars(user_dn)"},{"line_number":377,"context_line":"        query \u003d \u0027(%s\u003d%s)%s\u0027 % (self.member_attribute,"},{"line_number":378,"context_line":"                               user_dn_esc,"},{"line_number":379,"context_line":"                               self.ldap_filter or \u0027\u0027)"},{"line_number":380,"context_line":"        return self.get_all(query)"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    def list_user_groups_filtered(self, user_dn, hints):"}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_84ee8fb2","side":"PARENT","line":379,"range":{"start_line":379,"start_character":31,"end_line":379,"end_character":53},"in_reply_to":"7aa08908_5a1e660c","updated":"2016-06-09 13:49:19.000000000","message":"Yes, that\u0027s intentional. It\u0027s actually the main piece of the fix. The group_filter has to be ignored here so that the only caller of this method (delete_user) can see all groups of which this user is a member and therefore can remove them from all of those groups, so we\u0027re not leaving behind member references for a deleted user. This also fits with the name of the method, as opposed to the list_user_groups_filtered method immediately after it, so I would not expect to see other code that wants filtering to start using this and be broken... they would use the filtered method..","commit_id":"a0bf8a02ca567276fd37b8e12fe6b79edaf363de"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"08029ed8ea4312a157dd353356df5e3a48cd4d18","unresolved":false,"context_lines":[{"line_number":376,"context_line":"        user_dn_esc \u003d ldap.filter.escape_filter_chars(user_dn)"},{"line_number":377,"context_line":"        query \u003d \u0027(%s\u003d%s)%s\u0027 % (self.member_attribute,"},{"line_number":378,"context_line":"                               user_dn_esc,"},{"line_number":379,"context_line":"                               self.ldap_filter or \u0027\u0027)"},{"line_number":380,"context_line":"        return self.get_all(query)"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    def list_user_groups_filtered(self, user_dn, hints):"}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_5a1e660c","side":"PARENT","line":379,"range":{"start_line":379,"start_character":31,"end_line":379,"end_character":53},"in_reply_to":"7aa08908_5ac2e685","updated":"2016-06-08 22:40:29.000000000","message":"Notice get_all [1] don\u0027t honor this filter\n\n[1] https://github.com/openstack/keystone/blob/d5cca09/keystone/identity/backends/ldap/common.py#L1540-L1543","commit_id":"a0bf8a02ca567276fd37b8e12fe6b79edaf363de"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"b10d05708db042b4aea8083d589b8d66f58dbecf","unresolved":false,"context_lines":[{"line_number":128,"context_line":"            group_dn \u003d group_ref[\u0027dn\u0027]"},{"line_number":129,"context_line":"            try:"},{"line_number":130,"context_line":"                super(GroupApi, self.group).remove_member(user_dn, group_dn)"},{"line_number":131,"context_line":"            except ldap.NO_SUCH_ATTRIBUTE:"},{"line_number":132,"context_line":"                pass  # user has already been removed"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_f765ab1d","line":131,"range":{"start_line":131,"start_character":12,"end_line":131,"end_character":42},"updated":"2016-06-08 22:38:08.000000000","message":"This should not be happening since we just retrieved user\u0027s groups in L125. However I agree it\u0027s good to have this try:except just in the case.\n\nCould you add a warning here saying the user was expected to be in this group but it has been already removed ? There are other places where we do a similar behavior (LOG), e.g when a circular reference is found in a project hierarchy (that\u0027s should not be possible since our code does not allow such situation, but we made the code robust)","commit_id":"f57cdba04713eee29f6e86ec78814d547893f30d"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"cdb5fbe95cb09de5777a5d57903aec49fc00daf3","unresolved":false,"context_lines":[{"line_number":128,"context_line":"            group_dn \u003d group_ref[\u0027dn\u0027]"},{"line_number":129,"context_line":"            try:"},{"line_number":130,"context_line":"                super(GroupApi, self.group).remove_member(user_dn, group_dn)"},{"line_number":131,"context_line":"            except ldap.NO_SUCH_ATTRIBUTE:"},{"line_number":132,"context_line":"                pass  # user has already been removed"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_c415379c","line":131,"range":{"start_line":131,"start_character":12,"end_line":131,"end_character":42},"in_reply_to":"7aa08908_f765ab1d","updated":"2016-06-09 13:49:19.000000000","message":"Sure, I can add a log statement. That\u0027s a good idea.","commit_id":"f57cdba04713eee29f6e86ec78814d547893f30d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"43c55a215312f88691e45606c28252a92de80f3f","unresolved":false,"context_lines":[{"line_number":129,"context_line":"            try:"},{"line_number":130,"context_line":"                super(GroupApi, self.group).remove_member(user_dn, group_dn)"},{"line_number":131,"context_line":"            except ldap.NO_SUCH_ATTRIBUTE:"},{"line_number":132,"context_line":"                LOG.warning((\u0027User %s was not removed from group %s because \u0027"},{"line_number":133,"context_line":"                             \u0027the relationship was not found\u0027) %"},{"line_number":134,"context_line":"                            (user_id, group[\u0027id\u0027]))"},{"line_number":135,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"7aa08908_8ff13cd0","line":132,"updated":"2016-06-10 17:24:46.000000000","message":"Could/should use\n\n  _LW()\n\nto provide i18n.","commit_id":"d1cfee74a60dbfdc4235b722b8482a3498b63f60"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"2e04eacfae4a7894bd6c44729f0013b783a91d68","unresolved":false,"context_lines":[{"line_number":375,"context_line":"        \"\"\"Return a list of groups for which the user is a member.\"\"\""},{"line_number":376,"context_line":"        user_dn_esc \u003d ldap.filter.escape_filter_chars(user_dn)"},{"line_number":377,"context_line":"        query \u003d \u0027(%s\u003d%s)%s\u0027 % (self.member_attribute,"},{"line_number":378,"context_line":"                               user_dn_esc,"},{"line_number":379,"context_line":"                               self.ldap_filter or \u0027\u0027)"},{"line_number":380,"context_line":"        return self.get_all(query)"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    def list_user_groups_filtered(self, user_dn, hints):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_8d7941ff","side":"PARENT","line":379,"range":{"start_line":378,"start_character":42,"end_line":379,"end_character":54},"updated":"2016-06-10 19:11:23.000000000","message":"I am not sure it this method is suppose to not honor filters at all (including group_filter from config), I\u0027d like someone else to confirm","commit_id":"53b186306ce7379d869e93ad324326625fd95818"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"4812c99f22ea5229a4901571c4ae46a8e2ddb464","unresolved":false,"context_lines":[{"line_number":375,"context_line":"        \"\"\"Return a list of groups for which the user is a member.\"\"\""},{"line_number":376,"context_line":"        user_dn_esc \u003d ldap.filter.escape_filter_chars(user_dn)"},{"line_number":377,"context_line":"        query \u003d \u0027(%s\u003d%s)%s\u0027 % (self.member_attribute,"},{"line_number":378,"context_line":"                               user_dn_esc,"},{"line_number":379,"context_line":"                               self.ldap_filter or \u0027\u0027)"},{"line_number":380,"context_line":"        return self.get_all(query)"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    def list_user_groups_filtered(self, user_dn, hints):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_531eda63","side":"PARENT","line":379,"range":{"start_line":378,"start_character":42,"end_line":379,"end_character":54},"in_reply_to":"7aa08908_4d59195a","updated":"2016-06-10 19:39:38.000000000","message":"This needs to continue to honor filters.","commit_id":"53b186306ce7379d869e93ad324326625fd95818"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"58edb60b66ffa2148be2c434254f62d5ea1152c6","unresolved":false,"context_lines":[{"line_number":375,"context_line":"        \"\"\"Return a list of groups for which the user is a member.\"\"\""},{"line_number":376,"context_line":"        user_dn_esc \u003d ldap.filter.escape_filter_chars(user_dn)"},{"line_number":377,"context_line":"        query \u003d \u0027(%s\u003d%s)%s\u0027 % (self.member_attribute,"},{"line_number":378,"context_line":"                               user_dn_esc,"},{"line_number":379,"context_line":"                               self.ldap_filter or \u0027\u0027)"},{"line_number":380,"context_line":"        return self.get_all(query)"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    def list_user_groups_filtered(self, user_dn, hints):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_441c4ec1","side":"PARENT","line":379,"range":{"start_line":378,"start_character":42,"end_line":379,"end_character":54},"in_reply_to":"7aa08908_531eda63","updated":"2016-06-10 21:00:02.000000000","message":"Samuel/Adam/Morgan, I think everyone\u0027s confusing this method with list_groups_for_user. The latter is a driver method, and absolutely needs to honor group_filter. But this method is not a driver method. It\u0027s only ever called by delete_user. And in the case where delete_user calls it, it is essential that it NOT honor group_filter, as explained in the comment there.","commit_id":"53b186306ce7379d869e93ad324326625fd95818"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"bf3689e79eb972cde983d1af99a5391171eb7351","unresolved":false,"context_lines":[{"line_number":375,"context_line":"        \"\"\"Return a list of groups for which the user is a member.\"\"\""},{"line_number":376,"context_line":"        user_dn_esc \u003d ldap.filter.escape_filter_chars(user_dn)"},{"line_number":377,"context_line":"        query \u003d \u0027(%s\u003d%s)%s\u0027 % (self.member_attribute,"},{"line_number":378,"context_line":"                               user_dn_esc,"},{"line_number":379,"context_line":"                               self.ldap_filter or \u0027\u0027)"},{"line_number":380,"context_line":"        return self.get_all(query)"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    def list_user_groups_filtered(self, user_dn, hints):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_6d1b3581","side":"PARENT","line":379,"range":{"start_line":378,"start_character":42,"end_line":379,"end_character":54},"in_reply_to":"7aa08908_8d7941ff","updated":"2016-06-10 19:17:41.000000000","message":"I confirmed with Adam, this method needs to honor self.ldap_filter (group_filter from config).\n\nBoth list_user_groups and list_user_groups_filtered (and all the other query methods) need to honor group_filter. The difference of list_user_groups_filtered is that it takes *additional* filters (hints parameter).","commit_id":"53b186306ce7379d869e93ad324326625fd95818"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"bc3408d36bc8b2b4ce384b7374ec77aa1456c58d","unresolved":false,"context_lines":[{"line_number":375,"context_line":"        \"\"\"Return a list of groups for which the user is a member.\"\"\""},{"line_number":376,"context_line":"        user_dn_esc \u003d ldap.filter.escape_filter_chars(user_dn)"},{"line_number":377,"context_line":"        query \u003d \u0027(%s\u003d%s)%s\u0027 % (self.member_attribute,"},{"line_number":378,"context_line":"                               user_dn_esc,"},{"line_number":379,"context_line":"                               self.ldap_filter or \u0027\u0027)"},{"line_number":380,"context_line":"        return self.get_all(query)"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    def list_user_groups_filtered(self, user_dn, hints):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_4d59195a","side":"PARENT","line":379,"range":{"start_line":378,"start_character":42,"end_line":379,"end_character":54},"in_reply_to":"7aa08908_8d7941ff","updated":"2016-06-10 19:18:03.000000000","message":"this looks like it was improperly removed","commit_id":"53b186306ce7379d869e93ad324326625fd95818"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0840b16643683ebaace172c366125269eab6377f","unresolved":false,"context_lines":[{"line_number":132,"context_line":"                LOG.warning("},{"line_number":133,"context_line":"                    _LW(\u0027User %(user)s was not removed from group %(group)s \u0027"},{"line_number":134,"context_line":"                        \u0027because the relationship was not found\u0027),"},{"line_number":135,"context_line":"                    {\u0027user\u0027: user_id, \u0027group\u0027: group[\u0027id\u0027]})"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"},{"line_number":138,"context_line":"            self.project.remove_user(user.tenant_id, user_dn)"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_ca820f00","line":135,"updated":"2016-06-10 18:45:09.000000000","message":"This is a nice improvement as well.","commit_id":"907ee2d15ede024e2b32472fdfb163edc413bbd8"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"4812c99f22ea5229a4901571c4ae46a8e2ddb464","unresolved":false,"context_lines":[{"line_number":132,"context_line":"                LOG.warning("},{"line_number":133,"context_line":"                    _LW(\u0027User %(user)s was not removed from group %(group)s \u0027"},{"line_number":134,"context_line":"                        \u0027because the relationship was not found\u0027),"},{"line_number":135,"context_line":"                    {\u0027user\u0027: user_id, \u0027group\u0027: group[\u0027id\u0027]})"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"},{"line_number":138,"context_line":"            self.project.remove_user(user.tenant_id, user_dn)"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_73d31660","line":135,"in_reply_to":"7aa08908_4d07591c","updated":"2016-06-10 19:39:38.000000000","message":"This is a much better report/not bailing on error. However*** are you sure you\u0027re looking for the group_ref unfiltered? This seems to break the configured filter within keystone and could end up with a wildly different impact to your ldap. This seems like a bad idea(tm)","commit_id":"907ee2d15ede024e2b32472fdfb163edc413bbd8"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"58edb60b66ffa2148be2c434254f62d5ea1152c6","unresolved":false,"context_lines":[{"line_number":132,"context_line":"                LOG.warning("},{"line_number":133,"context_line":"                    _LW(\u0027User %(user)s was not removed from group %(group)s \u0027"},{"line_number":134,"context_line":"                        \u0027because the relationship was not found\u0027),"},{"line_number":135,"context_line":"                    {\u0027user\u0027: user_id, \u0027group\u0027: group[\u0027id\u0027]})"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"},{"line_number":138,"context_line":"            self.project.remove_user(user.tenant_id, user_dn)"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_a4d09254","line":135,"in_reply_to":"7aa08908_73d31660","updated":"2016-06-10 21:00:02.000000000","message":"@morgan Yes, I\u0027m sure. If you\u0027re removing a user, then that user cannot continue to be a member of ANY group... either groups that are managed by keystone (match group_filter) OR groups that are not. The user no longer exists. So we need to clean up the membership for ALL groups to reflect that.","commit_id":"907ee2d15ede024e2b32472fdfb163edc413bbd8"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"79c363c7daae1d7cdf3b48aceb9d473c1e33b326","unresolved":false,"context_lines":[{"line_number":132,"context_line":"                LOG.warning("},{"line_number":133,"context_line":"                    _LW(\u0027User %(user)s was not removed from group %(group)s \u0027"},{"line_number":134,"context_line":"                        \u0027because the relationship was not found\u0027),"},{"line_number":135,"context_line":"                    {\u0027user\u0027: user_id, \u0027group\u0027: group[\u0027id\u0027]})"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"},{"line_number":138,"context_line":"            self.project.remove_user(user.tenant_id, user_dn)"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_64306a02","line":135,"in_reply_to":"7aa08908_a4d09254","updated":"2016-06-10 21:06:45.000000000","message":"This bug inherently makes me think we\u0027re supporting something terrible. I am with adam, the only way you get wedged here is if someone manually edited LDAP outside of the scope of keystone or changed the whole way keystone is matching groups mid-run [new config] (which would break a ton of other things).\n\nThis is highlighting why keystone needs to own it\u0027s data store *or* be a read only consumer (and one of many reasons we\u0027re droping read-write ldap)","commit_id":"907ee2d15ede024e2b32472fdfb163edc413bbd8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"bc3408d36bc8b2b4ce384b7374ec77aa1456c58d","unresolved":false,"context_lines":[{"line_number":132,"context_line":"                LOG.warning("},{"line_number":133,"context_line":"                    _LW(\u0027User %(user)s was not removed from group %(group)s \u0027"},{"line_number":134,"context_line":"                        \u0027because the relationship was not found\u0027),"},{"line_number":135,"context_line":"                    {\u0027user\u0027: user_id, \u0027group\u0027: group[\u0027id\u0027]})"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"        if hasattr(user, \u0027tenant_id\u0027):"},{"line_number":138,"context_line":"            self.project.remove_user(user.tenant_id, user_dn)"}],"source_content_type":"text/x-python","patch_set":4,"id":"7aa08908_4d07591c","line":135,"in_reply_to":"7aa08908_ca820f00","updated":"2016-06-10 19:18:03.000000000","message":"WHile the error reporting is better, think this patch is not a good idea; it is based on too intimiate LDAP knowledge, and Keystone really should not be used to manage LDAP.  I won\u0027t hold it up, but can\u0027t say I\u0027m convinced this is the right approach","commit_id":"907ee2d15ede024e2b32472fdfb163edc413bbd8"}]}