Project tokens issued from a saml2 auth are missing inherited group roles

[Henry Nash]

When building the roles in a Keystone token from a saml2 token, we call assignment_api.get_roles_for_groups() to add in any group roles. This appears to ignore the inheritance flag on the assignment - and puts in all group roles whether inherited or not. This means the wrong roles can end up in the resulting Keystone token.

The implication is that project scoped tokens would not get any group roles that should be inherited from the domain.

[Henry Nash (henry-nash)]

This is the "project" equivalent of https://bugs.launchpad.net/keystone/+bug/1385533, separated out so we can fix them separately.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/133299

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/133299
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=bfbe1ee96c871163e4af0eca7568e13be72b8fde
Submitter: Jenkins
Branch: master

commit bfbe1ee96c871163e4af0eca7568e13be72b8fde
Author: Henry Nash <email address hidden>
Date: Fri Nov 7 17:27:46 2014 +0000

    Fix project federation tokens for inherited roles.

    Currently project-scoped federation-generated tokens fail to include
    group roles that are inherited to the project from the owning domain.
    This error is also exposed via the /auth/projects and
    /OS-FEDERATION/projects API calls. This patch patch fixes this.

    Change-Id: I1ce5007984938365208630ad901c7c508c57fcd4
    Closes-bug: 1389752
    Closes-bug: 1385694

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: feature/hierarchical-multitenancy
Review: https://review.openstack.org/138182

[OpenStack Infra (hudson-openstack)]

Change abandoned by Morgan Fainberg (<email address hidden>) on branch: feature/hierarchical-multitenancy
Review: https://review.openstack.org/138182

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/142548

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/142548
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=e5b660e170170fe193e8e650a0c0f6c8e2f7a7db
Submitter: Jenkins
Branch: stable/juno

commit e5b660e170170fe193e8e650a0c0f6c8e2f7a7db
Author: Henry Nash <email address hidden>
Date: Fri Nov 7 17:27:46 2014 +0000

    Fix project federation tokens for inherited roles.

    Currently project-scoped federation-generated tokens fail to include
    group roles that are inherited to the project from the owning domain.
    This error is also exposed via the /auth/projects and
    /OS-FEDERATION/projects API calls. This patch patch fixes this.

    (cherry picked from commit bfbe1ee96c871163e4af0eca7568e13be72b8fde)

    Backport note: New tests added to test_backend_kvs.KVSIdentity
    because the KVS backend didn't support the function in Juno.

    Change-Id: I1ce5007984938365208630ad901c7c508c57fcd4
    Closes-bug: 1389752
    Closes-bug: 1385694