Remove password validation logic from client

[Ron De Rose]

When updating a password, keystoneclient checks whether the old password matches the new password, and if so raises an exception:

if old_password == new_password:
   msg = _('Old password and new password must be different.')
   raise exceptions.ValidationError(msg)

https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/users.py#L220-L222

With the addition of PCI-DSS, keystone validates password history, so this check can now be removed and keystoneclient can rely on keystone to perform this validation.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/348464

[Brant Knudson (blk-u)]

keystoneclient needs to work with all versions of keystone, not just master (which hasn't been released yet).

[Steve Martinelli (stevemar)]

yeah, what brant said. also what if i didn't opt-into PCI support, this would still be nice to have in the client if someone isn't using PCI

[Henry Nash (henry-nash)]

and further, as to my comments on the server patch, if you pass in the old password into a user update, we treat it as a valid password change request, and put it in the password history...which I suspect means if you called that twice it would say "you've already used that password once". I still think the server needs to spot that the password being passed in is the same as the current one...

[Ron De Rose (ronald-de-rose)]

I'd argue that if the business logic belongs in the client, then it probably belongs in keystone. The validation should be handled in keystone regardless of the version. If v2 keystone doesn't have this check, then either it's a bug or expected behavior. But again, the validation should happen in keystone.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ron De Rose (<email address hidden>) on branch: master
Review: https://review.openstack.org/348464