Leaving this as Opinion for the moment, because this was actually by design (although, I personally disagree with the behavior illustrated above). Going to mention this at the Keystone meeting today.
** Changed in: keystone Status: New => Opinion -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1355655 Title: Attempt to assign a role to a non existent user should fail Status in OpenStack Identity (Keystone): Opinion Bug description: I use tempest tests get the following error: =========================================== StringException: Traceback (most recent call last): File "/usr/lib/python2.7/dist-packages/tempest/api/identity/admin/test_roles.py", line 143, in test_assign_user_role_for_non_existent_user tenant ['id'], 'junk-user-id-999', role ['id']) File "/usr/lib/python2.7/dist-packages/testtools/testcase.py", line 393, in assertRaises self.assertThat (our_callable, matcher) File "/usr/lib/python2.7/dist-packages/testtools/testcase.py", line 406, in assertThat raise mismatch_error MismatchError: <bound method IdentityClientJSON.assign_user_role of <tempest.services.identity.json.identity_client.IdentityClientJSON object at 0x7f9183c2f250 >> returned ({'status': '200', 'content-length': '78', 'vary' : 'X-Auth-Token', 'date': 'Tue, 12 Aug 2014 08:00:39 GMT', 'content-type': 'application / json', 'x-distribution': 'Ubuntu'}, {u'id ': u'd4a5fe216f92439789389f968c6e50d6', u'name ': u'role1552687157'}) ============================================ by testing found that "assign a role to a user that does not exist is a success." See attachment Screenshot by postman To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1355655/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp