Unmatched Groups in Federation Mapping raise errors

[Adam Young]

Mapping groups from REMOTE_USER_GROUPS (or comparable) via the rule:

"local": [
                    {
                        "group": {
                            "name": "{0}",
                            "domain": {"name": "Default"}
                        }
                    }
                ],
                "remote": [
                    {
                        "type": "REMOTE_USER_GROUPS"
                    }
                ]

{"error": {"message": "Group {0} returned by mapping kerberos_mapping was not found in the backend. (Disable debug mode to suppress these details.)", "code": 500, "title": "Internal Server Error"}}[

Will throw an error if a group in the assertion does not exist in the Groups list. This means that all groups from all user smust exist. Much more expected is for unmatched groups to be dropped.

This should not throw a 500 error.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/162788

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/162788
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=f4708ec55b7ffe252a21414346c1930da19af8b5
Submitter: Jenkins
Branch: master

commit f4708ec55b7ffe252a21414346c1930da19af8b5
Author: Adam Young <email address hidden>
Date: Mon Mar 9 18:43:41 2015 -0400

    Ignore unknown groups in lists for Federation

    Ignore groups that don't match ones in the backend.
    For Federation this will be the norm;
    groups may pass the blacklist but Keystone doesn't know about them.
    Otherwise, any in additional groups sent by the external IdP will
    break the mapping

    Change-Id: Ic1729da8606f50458db2fd163cd90bc5d89e24fa
    Closes-Bug: 1429334