keystone-tempest-plugin — Errors

Errors — keystone-tempest-plugin — branch master

Branch master @ 41e16f7f319c — repository https://opendev.org/openstack/keystone-tempest-plugin — analysed on 2026-10-28 tempest: = Tempest 47.0.0, the version installed for the run

The plugin raises no error of its own. What matters for a rewrite is which errors it expects from Keystone, and how it recognises them.

1. How an error is recognised

• Tempest's RestClient turns each error status into an exception: 401 Unauthorized, 403 Forbidden, 404 NotFound, 409 Conflict… (tempest:tempest/lib/common/rest_client.py:864-897).
• An RBAC assertion do_request(method, expected_status=Forbidden) passes when the client method raises that exception (keystone_tempest_plugin/tests/rbac/v3/base.py:34-44).
• Only the status is checked: neither the body nor the message. A rewrite may word its messages differently, but it must return exactly 403 or 404 where the plugin expects them.

2. What the 4,372 RBAC assertions expect

Keystone stable/2026.2 returned the expected status in all 4,372 cases (_rewrite/rbac-assertions_master.json).

The 403s are all of the same form: You are not authorized to perform the requested action: identity:<policy>. The message names the policy that refused the call, which makes the RBAC matrix easy to check against the policy file.

404 rather than 403: the trap for a rewrite

For some operations, Keystone answers 404 to an allowed persona when the target is outside its reach. In that case, the tests expect NotFound, not Forbidden. Typical cases in _rewrite/rbac-matrix_master.md:

• GET /v3/users/{user_id} for the user id fakeuser:
  • 404 for the system personas, domain_admin and project_admin (keystone_tempest_plugin/tests/rbac/v3/test_user.py:125-137);
  • 403 for domain_manager, domain_member, domain_reader and the project personas (keystone_tempest_plugin/tests/rbac/v3/test_user.py:298-318). Their policy compares the user's domain with the token's domain, and an unknown user has no domain;
• endpoint groups, identity providers, mappings, service providers and OAuth1 consumers that do not exist: 404 for the personas allowed to read them.

The rule a rewrite must reproduce: a persona whose policy depends on the target (domain or owner) gets 403 for a target that does not exist. A persona whose policy does not depend on the target gets 404.

3. Other errors observed during the run

_rewrite/observed-errors_master.md lists 271 distinct (operation, status, message) combinations, with IDs templated:

4. Tests skipped by design (14)

• **8 × test_identity_create_application_credential**, for the 4 domain personas, the 3 system personas and project_admin. The plugin skips them because an application credential needs a project in the token (keystone_tempest_plugin/tests/rbac/v3/test_application_credential.py:156-161). ProjectAdminTests inherits this skip from SystemAdminTests.
• 6 federation scenarios (K2K, SAML2, OIDC): [identity-feature-enabled] federation = false because no external identity provider is available.

Source: reverse-spec-keystone-tempest-plugin/02-errors_master.md. The _rewrite/ and _inventory/ files are not published on the site.