don't modify the passed in dict to from_dict

Fixes bug 1066851

Change-Id: Ic1f44ba1e319b9cd7e3f1da535f9d29ae7dc4030

2 files changed, 10 insertions, 9 deletions

diff --git a/keystone/identity/backends/kvs.py b/keystone/identity/backends/kvs.py
index 9e7062ee..cebf846d 100644
--- a/keystone/identity/backends/kvs.py
+++ b/keystone/identity/backends/kvs.py
@@ -205,7 +205,7 @@ class Identity(kvs.Base, identity.Driver):
         user_list = set(self.db.get('user_list', []))
         user_list.add(user_id)
         self.db.set('user_list', list(user_list))
-        return user
+        return identity.filter_user(user)
 
     def update_user(self, user_id, user):
         if 'name' in user:
diff --git a/keystone/identity/backends/sql.py b/keystone/identity/backends/sql.py
index 36f153cd..9b104e25 100644
--- a/keystone/identity/backends/sql.py
+++ b/keystone/identity/backends/sql.py
@@ -50,13 +50,15 @@ class User(sql.ModelBase, sql.DictBase):
     def from_dict(cls, user_dict):
         # shove any non-indexed properties into extra
         extra = {}
-        for k, v in user_dict.copy().iteritems():
+        user = {}
+        for k, v in user_dict.iteritems():
             # TODO(termie): infer this somehow
-            if k not in ['id', 'name', 'extra']:
-                extra[k] = user_dict.pop(k)
+            if k in ['id', 'name', 'extra']:
+                user[k] = v
+            else:
+                extra[k] = v
 
-        user_dict['extra'] = extra
-        return cls(**user_dict)
+        return cls(extra=extra, **user)
 
     def to_dict(self):
         extra_copy = self.extra.copy()
@@ -80,8 +82,7 @@ class Tenant(sql.ModelBase, sql.DictBase):
             if k not in ['id', 'name', 'extra']:
                 extra[k] = tenant_dict.pop(k)
 
-        tenant_dict['extra'] = extra
-        return cls(**tenant_dict)
+        return cls(extra=extra, **tenant_dict)
 
     def to_dict(self):
         extra_copy = copy.deepcopy(self.extra)
@@ -346,7 +347,7 @@ class Identity(sql.Base, identity.Driver):
             user_ref = User.from_dict(user)
             session.add(user_ref)
             session.flush()
-        return user_ref.to_dict()
+        return identity.filter_user(user_ref.to_dict())
 
     @handle_conflicts(type='user')
     def update_user(self, user_id, user):