Handle json data when migrating role metadata.

Fixes bug 1206257

Change-Id: Ia522e023a2d66ec25bc909db12d358f7c0ee6952

2 files changed, 25 insertions, 3 deletions

diff --git a/keystone/common/sql/migrate_repo/versions/020_migrate_metadata_table_roles.py b/keystone/common/sql/migrate_repo/versions/020_migrate_metadata_table_roles.py
index 35110df4..a0c6ddbc 100644
--- a/keystone/common/sql/migrate_repo/versions/020_migrate_metadata_table_roles.py
+++ b/keystone/common/sql/migrate_repo/versions/020_migrate_metadata_table_roles.py
@@ -23,11 +23,9 @@ def upgrade(migrate_engine):
     session = sql.orm.sessionmaker(bind=migrate_engine)()
 
     for metadata in session.query(old_metadata_table):
+        data = json.loads(metadata.data)
         if config.CONF.member_role_id not in metadata.data:
-            data = json.loads(metadata.data)
             data['roles'].append(config.CONF.member_role_id)
-        else:
-            data = metadata.data
 
         r = session.query(new_metadata_table).filter_by(
             user_id=metadata.user_id,
diff --git a/tests/test_sql_upgrade.py b/tests/test_sql_upgrade.py
index ed00deae..cf82b814 100644
--- a/tests/test_sql_upgrade.py
+++ b/tests/test_sql_upgrade.py
@@ -594,6 +594,22 @@ class SqlUpgradeTests(test.TestCase):
                       'data': json.dumps({"roles": [role2['id']]})}
         session.execute(metadata_table.insert().values(role_grant))
 
+        # Create another user to test the case where member_role_id is already
+        # assigned.
+        user2 = {'id': uuid.uuid4().hex,
+                 'name': uuid.uuid4().hex,
+                 'domain_id': domain['id'],
+                 'password': uuid.uuid4().hex,
+                 'enabled': True,
+                 'extra': json.dumps({})}
+        session.execute(user_table.insert().values(user2))
+
+        # Grant CONF.member_role_id to User2
+        role_grant = {'user_id': user2['id'],
+                      'tenant_id': project['id'],
+                      'data': json.dumps({"roles": [CONF.member_role_id]})}
+        session.execute(metadata_table.insert().values(role_grant))
+
         session.commit()
 
         self.upgrade(17)
@@ -635,6 +651,14 @@ class SqlUpgradeTests(test.TestCase):
                       'data': data}
         cmd = user_project_metadata_table.insert().values(role_grant)
         self.engine.execute(cmd)
+
+        # Create another conflicting user-project for User2
+        data = json.dumps({"roles": [role2['id']]})
+        role_grant = {'user_id': user2['id'],
+                      'project_id': project['id'],
+                      'data': data}
+        cmd = user_project_metadata_table.insert().values(role_grant)
+        self.engine.execute(cmd)
         # End Scaffolding
 
         session.commit()