openstack client role doesn't treat case insensitive users correctly starting v7.3.0

Bug #2125429 reported by Alexey
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
python-openstackclient
New
Undecided
Unassigned

Bug Description

Historically Openstack treated some types of users, e.g. LDAP users as case-insensitive.
Starting release 2025.1 openstack client stopped doing so.

e.g. I have a LDAP user M012345.
Before 2025.1 it was possible to use the commands below and they both would work interchangeably:
`
openstack role add --user m012345 --user-domain somedomain --domain somedomain somegroup
openstack role add --user M012345 --user-domain somedomain --domain somedomain somegroup
`

but starting 2025.1 when openstack switched for that command from keystone-client to openstacksdk, e.g. [1],
it doesn't work for m012345, but works for M012345.
here is the part of the logs with trace [2] of the command with smaller letter and --debug.
It can be seen that Keystone still returns the user M012345 even though m012345 was requested, but it's just this version of openstack client can't find the user.

[1]
https://review.opendev.org/c/openstack/python-openstackclient/+/929712

[2]
GET call to identity for https://<keystone-url>/v3/users/m012345?domain_id=13a78af2e7e044afbf841a299c0cb98b used request id req-660f005f-0c55-4f96-a0de-9b85410ce04b

REQ: curl -g -i -X GET "https://<keystone-url>/v3/users?domain_id=13a78af2e7e044afbf841a299c0cb98b&name=m012345" -H "Accpt: application/json" -H "User-Agent: openstacksdk/4.4.0 keystoneauth1/5.10.1 python-reuests/2.32.3 CPython/3.12.3" -H "X-Auth-Token: {SHA256}<removed>"

https://<keystone-url>:443 "GET /v3/users?domain_id=13a78af2e7e044afbf841a299c0cb98b&name=m012345 HTTP/1.1" 200 498

RESP: [200] Connection: keep-alive Content-Length: 498 Content-Security-Policy: script-src 'self'; object-src 'self' Content-Type: application/json Date: Fri, 12 Sep 2025 17:50:45 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: X-Auth-Token X-Content-Type-Options: nosniff X-Frame-Options: deny X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block x-openstack-request-id: req-f35700ac-a6ee-44e1-ac2a-b24ab4ddf709

RESP BODY: {"users": [{"id": "39a0b83de97a944ada3395a3adc1b677281076b4fa9562f60ac26059b8497bb5", "name": "M012345", "enabled": true, "options": {}, "password_expires_at": null, "domain_id": "13a78af2e7e044afbf841a299c0cb98b", "links": {"self": "https://<keystone-url>/v3/users/39a0b83de97a944ada3395a3adc1b677281076b4fa9562f60ac26059b8497bb5}}], "links": {"next": null, "self": "https://<keystone-url>/v3/users?domain_id=13a78af2e7e044aff841a299c0cb98b&name=m012345", "previus": null}}

GET call to identity for https://<keystone-url>/v3/users?domain_id=13a78afe7e044afbf841a299c0cb98b&name=m012345 used request id req-f35700ac-a6ee-44e1-ac2a-b24ab4ddf709

Traceback (most recent call last):

  File "/var/lib/openstack/lib/python3.12/site-packages/openstackclient/identity/v3/role.py", line 89, in _find_sdk_id

    resource = find_command(

               ^^^^^^^^^^^^^

  File "/var/lib/openstack/lib/python3.12/site-packages/openstack/identity/v3/_proxy.py", line 922, in find_user

    return self._find(

           ^^^^^^^^^^^

  File "/var/lib/openstack/lib/python3.12/site-packages/openstack/proxy.py", line 544, in _find

    return resource_type.find(

           ^^^^^^^^^^^^^^^^^^^

  File "/var/lib/openstack/lib/python3.12/site-packages/openstack/resource.py", line 2280, in find

    raise exceptions.NotFoundException(

openstack.exceptions.NotFoundException: No User found for m012345

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.