Repository: ansible/ansible

Issue:
os_user module fails in multidomain environment
<!---
Verify first that your issue/request is not already reported on GitHub.
THIS FORM WILL BE READ BY A MACHINE, COMPLETE ALL SECTIONS AS DESCRIBED.
Also test if the latest release, and devel branch are affected too.
ALWAYS add information AFTER (OUTSIDE) these html comments.
Otherwise it may end up being automatically closed by our bot. -->

##### SUMMARY
<!--- Explain the problem briefly -->
In an OpenStack environment with multiple domains and when using keystone (identity) API v3, os_user module fails with HTTP 401 "The request you have made requires authentication"

##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
<!--- Insert, BELOW THIS COMMENT, the name of the module, plugin, task or feature.
Do not include extra details here, e.g. "vyos_command" not "the network module vyos_command" or the full path-->
os_user

##### ANSIBLE VERSION
<!--- Paste, BELOW THIS COMMENT, verbatim output from "ansible --version" between quotes below -->
```
ansible 2.6.1
  config file = /workspace/ckoester/180715_192801/0001-02040/ansible.cfg
  configured module search path = [u'/home/ckoester/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/ckoester/ansible26/local/lib/python2.7/site-packages/ansible
  executable location = /home/ckoester/ansible26/bin/ansible
  python version = 2.7.12 (default, Nov 20 2017, 18:23:56) [GCC 5.4.0 20160609]
```

##### CONFIGURATION
<!--- If using Ansible 2.4 or above, paste, BELOW THIS COMMENT, the results of "ansible-config dump --only-changed"
Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).-->
N/A

##### OS / ENVIRONMENT
<!--- Mention, BELOW THIS COMMENT, the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.-->
On Ansible and control host side, no specific platform dependencies.

In order to reproduce this issue, on the OpenStack side (which the os_user module is utilized against):

 - must be using Identity API v3
 - must be a multidomain environment (ie. multiple domains must actually exist)

(Even then, the issue may be reproducible on one openstack environment but not on another, depending on the specific configuration on that environment.)

##### STEPS TO REPRODUCE
<!--- For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used. -->

<!--- Paste example playbooks or commands between quotes below -->
```yaml
---
- hosts: inception
  gather_facts: no
  any_errors_fatal: yes
  tasks:
    - name: For debug and illustration, set cloud config here
      set_fact:
        cloud_config:
          auth:
            auth_url: "https://openstack.api.endpoint.url:5000/v3"
            password: "<existing user password>"
            project_name: "<existing user project>"
            username: "<existing username>"
            user_domain_name: "default"
            project_domain_name: "default"
          identity_api_version: 3
          verify: False

    - name: Create user
      os_user:
        cloud: "{{ cloud_config }}"
        state: present
        default_project: "testproject"
        name: "testuser"
        domain: "default"
        password: "testpassword"
```

<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
Expecting user "testuser" to be created

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->
```
TASK [Create user] ********************************************************************************************************************************************************************************************************************
fatal: [ngena3-inception]: FAILED! => {"changed": false, "extra_data": null, "msg": "HttpException: 401: Client Error for url: https://api-ngena3.client.metacloud.net:5000/v3/users, {\"error\": {\"message\": \"The request you have made requires authentication.\", \"code\": 401, \"title\": \"Unauthorized\"}}"}
```

More verbose:

```
The full traceback is:
  File "/tmp/ansible_u05xY8/ansible_module_os_user.py", line 204, in main
    user = cloud.get_user(name)
  File "<decorator-gen-8>", line 2, in get_user
  File "/home/installer/ansible26/lib/python2.7/site-packages/openstack/cloud/_utils.py", line 377, in func_wrapper
    return func(*args, **kwargs)
  File "/home/installer/ansible26/lib/python2.7/site-packages/openstack/cloud/openstackcloud.py", line 1013, in get_user
    return _utils._get_entity(self, 'user', name_or_id, filters, **kwargs)
  File "/home/installer/ansible26/lib/python2.7/site-packages/openstack/cloud/_utils.py", line 204, in _get_entity
    entities = search(name_or_id, filters, **kwargs)
  File "<decorator-gen-6>", line 2, in search_users
  File "/home/installer/ansible26/lib/python2.7/site-packages/openstack/cloud/_utils.py", line 377, in func_wrapper
    return func(*args, **kwargs)
  File "/home/installer/ansible26/lib/python2.7/site-packages/openstack/cloud/openstackcloud.py", line 994, in search_users
    users = self.list_users(**kwargs)
  File "/home/installer/ansible26/lib/python2.7/site-packages/openstack/cloud/openstackcloud.py", line 974, in list_users
    data = self._identity_client.get('/users', params=kwargs)
  File "/home/installer/ansible26/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 328, in get
    return self.request(url, 'GET', **kwargs)
  File "/home/installer/ansible26/lib/python2.7/site-packages/openstack/_adapter.py", line 164, in request
    return _json_response(response, error_message=error_message)
  File "/home/installer/ansible26/lib/python2.7/site-packages/openstack/_adapter.py", line 95, in _json_response
    exceptions.raise_from_response(response, error_message=error_message)
  File "/home/installer/ansible26/lib/python2.7/site-packages/openstack/exceptions.py", line 212, in raise_from_response
    http_status=http_status, request_id=request_id

fatal: [ngena3-inception]: FAILED! => {
    "changed": false,
    "extra_data": null,
    "invocation": {
        "module_args": {
            "api_timeout": null,
            "auth": null,
            "auth_type": null,
            "availability_zone": null,
            "cacert": null,
            "cert": null,
            "default_project": "testproject",
            "description": null,
            "domain": "default",
            "email": null,
            "enabled": true,
            "interface": "public",
            "key": null,
            "name": "testuser",
            "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "region_name": null,
            "state": "present",
            "timeout": 180,
            "update_password": "always",
            "verify": null,
            "wait": true
        }
    },
    "msg": "HttpException: 401: Client Error for url: https://api-ngena3.client.metacloud.net:5000/v3/users, {\"error\": {\"message\": \"The request you have made requires authentication.\", \"code\": 401, \"title\": \"Unauthorized\"}}"
}
```

Note that the "Unauthorized" error suggests that this may be as simple as incorrect credentials, but that is not the case. See following comments in this issue.


Discussion:

Resolving patch:
diff --git a/lib/ansible/module_utils/openstack.py b/lib/ansible/module_utils/openstack.py
--- a/lib/ansible/module_utils/openstack.py
+++ b/lib/ansible/module_utils/openstack.py
@@ -134,11 +134,12 @@ def openstack_cloud_from_module(module, min_version='0.12.0'):
                 " excluded.")
             for param in (
                     'auth', 'region_name', 'verify',
-                    'cacert', 'key', 'api_timeout', 'interface'):
+                    'cacert', 'key', 'api_timeout', 'auth_type'):
                 if module.params[param] is not None:
                     module.fail_json(msg=fail_message.format(param=param))
-            if module.params['auth_type'] != 'password':
-                module.fail_json(msg=fail_message.format(param='auth_type'))
+            # For 'interface' parameter, fail if we receive a non-default value
+            if module.params['interface'] != 'public':
+                module.fail_json(msg=fail_message.format(param='interface'))
             return sdk, sdk.connect(**cloud_config)
         else:
             return sdk, sdk.connect(
diff --git a/lib/ansible/modules/cloud/openstack/os_user.py b/lib/ansible/modules/cloud/openstack/os_user.py
--- a/lib/ansible/modules/cloud/openstack/os_user.py
+++ b/lib/ansible/modules/cloud/openstack/os_user.py
@@ -201,11 +201,12 @@ def main():
 
     sdk, cloud = openstack_cloud_from_module(module)
     try:
-        user = cloud.get_user(name)
-
         domain_id = None
         if domain:
             domain_id = _get_domain_id(cloud, domain)
+            user = cloud.get_user(name, domain_id=domain_id)
+        else:
+            user = cloud.get_user(name)
 
         if state == 'present':
             if update_password in ('always', 'on_create'):
@@ -271,7 +272,10 @@ def main():
             if user is None:
                 changed = False
             else:
-                cloud.delete_user(user['id'])
+                if domain:
+                    cloud.delete_user(user['id'], domain_id=domain_id)
+                else:
+                    cloud.delete_user(user['id'])
                 changed = True
             module.exit_json(changed=changed)
 


Test patch: