LDAP Identity Driver does not call delete_user or delete_group on the LDAP assignment api

[Morgan Fainberg]

Likely the call to assignment_api.delete_user and assignment_api.delete_group should be moved to the identity manager to ensure it is called every time, the user_ref should also be passed to the assignment_api instead of just the user_id so that the assignment_api has no need to do a lookup via identity_api (if required).

The kvs identity driver does not call delete_user on assignment_api.
The kvs identity driver does not call delete_group on assignment_api.
The ldap identity driver does not call delete_group on assignment_api.

Tests should be added as well to confirm the assignment_api methods are called.

Related: Should delete_user called with the PAM identity driver still call assignment_api.delete_user? It would seem logical that it could be used to cleanup all assignments, and just handle the NotImplemented "deletion" from the identity store. If this is a valid use-case, the PAM identity driver does not call assignment_api.delete_user or delete_group when expected. This might also just warrant a deprecation of the PAM backend for a more feature-rich backend (such as SSSD/IPA) and ignore this shortcoming.

[Morgan Fainberg (mdrnstm)]

Looking into this further, KVS appears to be a non-issue as it (in most cases) shares a single in-memory DB. Though for correctness, it probably should still do so.

[Dolph Mathews (dolph)]

assignment_api.delete_user and assignment_api.delete_group are also not very intuitively named :( they handle the consequences of deleting users & groups, rather than actually deleting a user or group.

[Morgan Fainberg (mdrnstm)]

Yeah, that is sub-optimal as well. Likely, this should just be renamed when moved to the manager.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/80368

[OpenStack Infra (hudson-openstack)]

Change abandoned by Morgan Fainberg (<email address hidden>) on branch: master
Review: https://review.openstack.org/80368
Reason: Will come back to this change down the road.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/119629

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/119629
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=5e8845bc179e969d0e2bf38298dc2eef348e6393
Submitter: Jenkins
Branch: master

commit 5e8845bc179e969d0e2bf38298dc2eef348e6393
Author: Brant Knudson <email address hidden>
Date: Sun Sep 7 11:05:44 2014 -0500

    Fix using local ID to clean up user/group assignments

    When using ID mapping and a user or group is deleted, the mapped id
    was being passed to the assignment backend when it's told to clean up
    the role assignments for hte user or group. The role assignments are
    based on the external ID and not the mapped ID, so the role
    assignments wouldn't be cleaned up.

    With this change, the external ID is passed to the assignment backend
    methods.

    Change-Id: I4405329df509f81c9c1178e91092955b16cd586b
    Closes-Bug: #1222675