Can't create both inherited and direct role assignment on same entities

[Samuel de Medeiros Queiroz]

This bug applies to backend SQL, since it is the only that supports inherited role assignments.

Given a role assignment (actor_id, target_id, role_id, inherited), it should be possible to grant it as both direct and inherited:
- (actor_id, target_id, role_id, inherited=False)
- (actor_id, target_id, role_id, inherited=True)

Currently, it isn't possible since the RoleAssignment table constraint does not include inherited column as primary key [1].

This bug affects inherited functionality on both domains and projects.

[1] https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/sql.py#L776-L777

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/142472

[Henry Nash (henry-nash)]

It's a fair cop, guv, I did it! Yep, this needs to be possible, as the bug describes.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/171596

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/171596
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=193bcfeaeb1a7827f6298a6267c4c6a4d88c6bcf
Submitter: Jenkins
Branch: master

commit 193bcfeaeb1a7827f6298a6267c4c6a4d88c6bcf
Author: Samuel de Medeiros Queiroz <email address hidden>
Date: Wed Apr 8 08:38:06 2015 -0300

    Exposes bug on role assignments creation

    It should be possible to add both inherited and
    non-inherited role assignments for the same actor
    and target with the same role.

    However, this is not currently possible. This
    patch exposes this bug.

    Related-Bug: #1403539

    Change-Id: I9ee82b490ca36e9b2d135ef9ead54a2a4c312657

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/142472
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=5a0811f355671c94e985aa888be5472a7920afa4
Submitter: Jenkins
Branch: master

commit 5a0811f355671c94e985aa888be5472a7920afa4
Author: Samuel de Medeiros Queiroz <email address hidden>
Date: Wed Dec 17 12:52:40 2014 -0300

    Adds inherited column to RoleAssignment PK

    It should be possible to add both inherited and
    non-inherited role assignments for the same actor
    and target with the same role.

    However, this was not currently possible since
    the inherited column was not part of the PK of
    the assignment table.

    This patch alters the table definition and adds a
    migration script and tests for it.

    Closes-Bug: #1403539

    Change-Id: I1ba4935934b0dc6b6077d18761023ad50462c8b8