Openstack Keystone groups not synced to ManageIQ #23624

Nirshal · 2025-10-13T08:10:11Z

Nirshal
Oct 13, 2025

Hello everyone,
we are writing from Sourcesense, a system integrator in Italy that is part of the Poste Italiane group.
For one customer in the telecom sector we are working on a cloud infrastructure that is based on ManageIQ and Openstack.
In our use case we would like to provision for the Tenant/Project and user groups directly on openstack, and see them synched on ManageIQ using the manageiq-providers-openstack.
In our understanding, this is managed by the file app/models/manageiq/providers/openstack/identity_sync_mixin.rband in particular by methods like def sync_users(admin_role_id, member_role_id, password_digest), def create_or_find_miq_group_and_add_user(user, tenant, role_name).
Unfortunately, our testing resulting in the groups not syncing, while this correctly happens for the tenants created on openstack.

We do not undestand if we misconfigured something in the interaction between Openstack and ManageIQ or if we misinterpreted the code in the manageiq-providers-openstack plugin, and the group sync is not meant to happen at all.

Can anyone provide help on this?

Answered by agrare

Oct 23, 2025

Thanks @mogui we don't currently support syncing Identity Groups from OpenStack just projects.
If you would like to help add that feature this is where that logic lives https://github.com/ManageIQ/manageiq/blob/master/app/models/manageiq/providers/cloud_manager.rb#L72-L78

View full answer

agrare · 2025-10-22T14:16:32Z

agrare
Oct 22, 2025
Maintainer

Hey @Nirshal do you have the Tenant Mapping Enabled switch on for the provider?

Here is the documentation: https://www.manageiq.org/docs/reference/latest/managing_infrastructure_and_inventory/#tenant-mapping

5 replies

agrare Oct 22, 2025
Maintainer

@Nirshal I turned this on and ran a refresh and I see the following in the logs:

[----] I, [2025-10-22T10:54:44.278237#1411820:a974]  INFO -- evm: MIQ(ManageIQ::Providers::Openstack::CloudManager#sync_tenants) Syncing CloudTenant with Tenants...
[----] I, [2025-10-22T10:54:44.281211#1411820:a974]  INFO -- evm: MIQ(ManageIQ::Providers::Openstack::CloudManager#sync_tenants) CloudTenant admin has no tenant
[----] I, [2025-10-22T10:54:44.281413#1411820:a974]  INFO -- evm: MIQ(ManageIQ::Providers::Openstack::CloudManager#sync_tenants) Creating Tenant with parameters: {:name=>"admin", :description=>"Bootstrap project for initializing the cloud.", :source=>#<ManageIQ::Providers::Openstack::CloudManager::CloudTenant id: 1, name: "admin", description: "Bootstrap project for initializing the cloud.", enabled: true, ems_ref: "835b029b88cf4183b9f42a84b3d93ac4", ems_id: 4, created_at: "2025-10-20 17:44:13.051137000 +0000", updated_at: "2025-10-20 17:44:13.051137000 +0000", type: "ManageIQ::Providers::Openstack::CloudManager::Clou...", parent_id: nil>}
[----] I, [2025-10-22T10:54:44.281481#1411820:a974]  INFO -- evm: MIQ(ManageIQ::Providers::Openstack::CloudManager#sync_tenants) and with parent OpenStack Cloud Provider openstack
[----] I, [2025-10-22T10:54:44.296382#1411820:a974]  INFO -- evm: MIQ(MiqQueue.put) Message id: [13664], Zone: [], Role: [], Server: [4d1eac9b-2522-4da0-96fd-9e060e61f7ee], MiqTask id: [], Handler id: [], Ident: [generic], Target id: [], Instance id: [], Task id: [], Command: [MiqProductFeature.invalidate_caches], Timeout: [600], Priority: [100], State: [ready], Deliver On: [], Data: [], Args: []
[----] I, [2025-10-22T10:54:44.298574#1411820:a974]  INFO -- evm: MIQ(ManageIQ::Providers::Openstack::CloudManager#sync_tenants) New Tenant admin created
[----] I, [2025-10-22T10:54:44.311750#1411820:a974]  INFO -- evm: MIQ(ManageIQ::Providers::Openstack::CloudManager#sync_tenants) CloudTenant admin saved

So the openstack admin project is created as a Tenant in MIQ

mogui Oct 23, 2025

Hi @agrare I'm a @Nirshal collegue,
Tenant are syncronized correctly,
our problem is that user groups are are not synced back to manageiq.

agrare Oct 23, 2025
Maintainer

Thanks @mogui we don't currently support syncing Identity Groups from OpenStack just projects.
If you would like to help add that feature this is where that logic lives https://github.com/ManageIQ/manageiq/blob/master/app/models/manageiq/providers/cloud_manager.rb#L72-L78

Answer selected by Nirshal

Nirshal Oct 24, 2025
Author

Thanks for the answer @agrare, we will evaluate the best course of action for our customer (either we open a PR with the feature for your review, or we find a workaround, probably manually provisioning the same groups on both MIQ and OpenStack), unfortunately the timing we have for the project delivery is quite strict so the decision should take that into account.

agrare Oct 24, 2025
Maintainer

Okay sounds good let us know if we can assist in any way if you decide to go the route of adding the feature

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ManageIQ

Openstack Keystone groups not synced to ManageIQ #23624

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

ManageIQ

Openstack Keystone groups not synced to ManageIQ #23624

Uh oh!

Nirshal Oct 13, 2025

Replies: 1 comment · 5 replies

Uh oh!

Uh oh!

agrare Oct 22, 2025 Maintainer

Uh oh!

agrare Oct 22, 2025 Maintainer

Uh oh!

mogui Oct 23, 2025

Uh oh!

agrare Oct 23, 2025 Maintainer

Uh oh!

Nirshal Oct 24, 2025 Author

Uh oh!

agrare Oct 24, 2025 Maintainer

Nirshal
Oct 13, 2025

Replies: 1 comment 5 replies

agrare
Oct 22, 2025
Maintainer

agrare Oct 22, 2025
Maintainer

agrare Oct 23, 2025
Maintainer

Nirshal Oct 24, 2025
Author

agrare Oct 24, 2025
Maintainer