$ python3 manage.py shell
>>> from striker.tools.models import Tool
>>> ducttape = Tool.objects.get(cn='tools.ducttape')
>>> ducttape.maintainer_ids()
['kindrobot']
>>> ducttape.maintainers()
<QuerySet []>
>>> from striker.tools.models import Maintainer
>>> Maintainer.objects.get(uid='kindrobot')
Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/opt/lib/python/site-packages/django/db/models/manager.py", line 82, in manager_method
    return getattr(self.get_queryset(), name)(*args, **kwargs)
  File "/opt/lib/python/site-packages/django/db/models/query.py", line 408, in get
    self.model._meta.object_name
striker.tools.models.Maintainer.DoesNotExist: Maintainer matching query does not exist.
>>> Maintainer.objects.get(uid='bd808')
<Maintainer: BryanDavis>

$ ldap uid=kindrobot cn objectClass
dn: uid=kindrobot,ou=people,dc=wikimedia,dc=org
cn: Stef Dunlap
objectClass: inetOrgPerson
objectClass: person
objectClass: ldapPublicKey
objectClass: posixAccount
objectClass: shadowAccount

class MaintainerManager(models.Manager):
    def _get_tool_users(self):
        if settings.TEST_MODE:
            # Hack to keep from trying to talk to openstack API from django
            # test harness
            return []
        users = cache.get_openstack_users()
        return (
            users[settings.OPENSTACK_USER_ROLE] +
            users[settings.OPENSTACK_ADMIN_ROLE]
        )

    def get_queryset(self):
        return super(MaintainerManager, self).get_queryset().filter(
            uid__in=self._get_tool_users()).order_by('cn')

>>> from striker.tools import cache
>>> users = cache.get_openstack_users()
>>> users.keys()
dict_keys(['glanceadmin', 'heat_stack_owner', 'admin', 'member', 'projectadmin', 'designateadmin', 'heat_stack_user', 'keystonevalidate', 'user', 'reader'])
>>> for role in users.keys():
...     print(role, len(users[role]))
...
glanceadmin 0
heat_stack_owner 0
admin 0
member 26
projectadmin 0
designateadmin 1
heat_stack_user 0
keystonevalidate 0
user 2406
reader 0

[22:42]  <    bd808> kindrobot: I think you should be able to create a phab board with Striker now.
[22:42]  <    bd808> I can see you listed on https://toolsadmin.wikimedia.org/tools/id/ducttape at least
[22:52]  <kindrobot> It worked! :D

taavi@cloudcontrol1006 ~ $ os role assignment list --user kindrobot --project tools --names
+--------+---------------------+-------+---------------+--------+--------+-----------+
| Role   | User                | Group | Project       | Domain | System | Inherited |
+--------+---------------------+-------+---------------+--------+--------+-----------+
| user   | Stef Dunlap@Default |       | tools@Default |        |        | False     |
| reader | Stef Dunlap@Default |       | tools@Default |        |        | False     |
+--------+---------------------+-------+---------------+--------+--------+-----------+
taavi@cloudcontrol1006 ~ $ os role assignment list --user taavi --project tools --names
+--------------+-----------------+-------+---------------+--------+--------+-----------+
| Role         | User            | Group | Project       | Domain | System | Inherited |
+--------------+-----------------+-------+---------------+--------+--------+-----------+
| member       | Majavah@Default |       | tools@Default |        |        | False     |
| projectadmin | Majavah@Default |       | tools@Default |        |        | False     |
| user         | Majavah@Default |       | tools@Default |        |        | False     |
| reader       | Majavah@Default |       | tools@Default |        |        | False     |
+--------------+-----------------+-------+---------------+--------+--------+-----------+

[16:37]  <    bd808> ah! I think my code is to blame!
[16:38]  <    bd808> It seems to memoize and assume that each user only has one role!
[16:38]  <andrewbogott> that would do it :)
[16:38]  <    taavi> oh of course, I even had the exact same issue with openstack-browser :D
[16:38]  <    bd808> yeah, I think this is the bug. it's in Striker's openstack.py and the users_by_role() method
[16:39]  <    bd808> because the client was copied from striker taavi :)
[16:40]  <andrewbogott> welp, I tried to provide a graceful transition by leaving the old roles in place and that just made it worse :)