don't modify the passed in dict to from_dict

Fixes bug 1066851

Change-Id: Ic1f44ba1e319b9cd7e3f1da535f9d29ae7dc4030

3 files changed, 23 insertions, 9 deletions

diff --git a/keystone/identity/backends/kvs.py b/keystone/identity/backends/kvs.py
index 9e7062ee..cebf846d 100644
--- a/keystone/identity/backends/kvs.py
+++ b/keystone/identity/backends/kvs.py
@@ -205,7 +205,7 @@ class Identity(kvs.Base, identity.Driver):
         user_list = set(self.db.get('user_list', []))
         user_list.add(user_id)
         self.db.set('user_list', list(user_list))
-        return user
+        return identity.filter_user(user)
 
     def update_user(self, user_id, user):
         if 'name' in user:
diff --git a/keystone/identity/backends/sql.py b/keystone/identity/backends/sql.py
index 36f153cd..9b104e25 100644
--- a/keystone/identity/backends/sql.py
+++ b/keystone/identity/backends/sql.py
@@ -50,13 +50,15 @@ class User(sql.ModelBase, sql.DictBase):
     def from_dict(cls, user_dict):
         # shove any non-indexed properties into extra
         extra = {}
-        for k, v in user_dict.copy().iteritems():
+        user = {}
+        for k, v in user_dict.iteritems():
             # TODO(termie): infer this somehow
-            if k not in ['id', 'name', 'extra']:
-                extra[k] = user_dict.pop(k)
+            if k in ['id', 'name', 'extra']:
+                user[k] = v
+            else:
+                extra[k] = v
 
-        user_dict['extra'] = extra
-        return cls(**user_dict)
+        return cls(extra=extra, **user)
 
     def to_dict(self):
         extra_copy = self.extra.copy()
@@ -80,8 +82,7 @@ class Tenant(sql.ModelBase, sql.DictBase):
             if k not in ['id', 'name', 'extra']:
                 extra[k] = tenant_dict.pop(k)
 
-        tenant_dict['extra'] = extra
-        return cls(**tenant_dict)
+        return cls(extra=extra, **tenant_dict)
 
     def to_dict(self):
         extra_copy = copy.deepcopy(self.extra)
@@ -346,7 +347,7 @@ class Identity(sql.Base, identity.Driver):
             user_ref = User.from_dict(user)
             session.add(user_ref)
             session.flush()
-        return user_ref.to_dict()
+        return identity.filter_user(user_ref.to_dict())
 
     @handle_conflicts(type='user')
     def update_user(self, user_id, user):
diff --git a/tests/test_backend.py b/tests/test_backend.py
index 696e125d..c8b317d2 100644
--- a/tests/test_backend.py
+++ b/tests/test_backend.py
@@ -646,6 +646,19 @@ class IdentityTests(object):
             self.user_foo['id'], self.tenant_bar['id'])
         self.assertNotIn(role['id'], roles_ref)
 
+    def test_create_tenant_doesnt_modify_passed_in_dict(self):
+        new_tenant = {'id': 'tenant_id', 'name': 'new_tenant'}
+        original_tenant = new_tenant.copy()
+        self.identity_api.create_tenant('tenant_id', new_tenant)
+        self.assertDictEqual(original_tenant, new_tenant)
+
+    def test_create_user_doesnt_modify_passed_in_dict(self):
+        new_user = {'id': 'user_id', 'name': 'new_user',
+                    'password': 'secret'}
+        original_user = new_user.copy()
+        self.identity_api.create_user('user_id', new_user)
+        self.assertDictEqual(original_user, new_user)
+
 
 class TokenTests(object):
     def test_token_crud(self):