If keystone is misconfigured, calling `openstack group contains user $group $user` may result in the response '$user not in $group' when the reality is that the keystone server experienced an error and returned a 500. In my case, pyldap was raising a DECODING_ERROR because I needed to [ldap]/ group_members_ are_ids, but openstackclient's error message was leading me to believe that I had misconfigured [ldap]/ group_member_ attribute or that in fact the user was not in the group.

In keystone, HEAD /v3/groups/ {group_ id}/users/ {user_id} returns a 404 if the given user is not in the given group. It may also return a 403 to indicate that the resources being compared have different backends, which would also indicate that the user is not in the group. Therefore openstackclient should interpret a 403 or a 404 as an acceptable negative response and any other 4XX or 5XX response as an error to which the user should be alerted.