/auth/domains incorrectly includes domains with only group inherited roles

[Henry Nash]

The /auth/domains API call is meant to return list of domains for which the user could ask for a domain-scoped token - i.e. any domain on which they have a role. However, the code does not differentiate between inherited and non-inherited group roles - and hence might include domains for which the user has no effective role (a domain inherited role ONLY applies to the projects within that domain, not to the domain itself).

[Henry Nash (henry-nash)]

I found this doing a WIP code experiment for making assignments pluggable (see: https://review.openstack.org/#/c/129397/). It is clear that we have far too many ways of trying to work out what roles are effective on a given project or domain. Once we have improved the backend list_role_assignments() method (see: https://review.openstack.org/#/c/116682/), we should consider re-writing many of the these calls to be based on the common method.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/132872

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/132872
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=1f54bebe65897b57845e09bd4e8d12ccc9323139
Submitter: Jenkins
Branch: master

commit 1f54bebe65897b57845e09bd4e8d12ccc9323139
Author: Henry Nash <email address hidden>
Date: Wed Nov 5 15:09:54 2014 +0000

    Fix domain federation tokens for inherited roles.

    Currently domain-scoped federation-generated tokens incorrectly
    include group roles that are inherited to projects within that domain.
    This error is also exposed via the /auth/domains and
    /OS-FEDERATION/domains API calls. This patch fixes this.

    Change-Id: I2b5c1e3d695dd7b27bf3b15361fccb5c13bdd554
    Closes-bug: 1385533
    Closes-bug: 1385643

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: feature/hierarchical-multitenancy
Review: https://review.openstack.org/138182

[OpenStack Infra (hudson-openstack)]

Change abandoned by Morgan Fainberg (<email address hidden>) on branch: feature/hierarchical-multitenancy
Review: https://review.openstack.org/138182

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/142546

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/142546
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=5ec73571b7a1698f21c6c7d7ab95d42708d3d9e6
Submitter: Jenkins
Branch: stable/juno

commit 5ec73571b7a1698f21c6c7d7ab95d42708d3d9e6
Author: Henry Nash <email address hidden>
Date: Wed Nov 5 15:09:54 2014 +0000

    Fix domain federation tokens for inherited roles.

    Currently domain-scoped federation-generated tokens incorrectly
    include group roles that are inherited to projects within that domain.
    This error is also exposed via the /auth/domains and
    /OS-FEDERATION/domains API calls. This patch fixes this.

    (cherry picked from commit 1f54bebe65897b57845e09bd4e8d12ccc9323139)

    Backport note: New tests were added to test_backend_kvs.KVSIdentity
    because the KVS backend didn't support the function in Juno.

    Change-Id: I2b5c1e3d695dd7b27bf3b15361fccb5c13bdd554
    Closes-bug: 1385533
    Closes-bug: 1385643