Usage of application credentials through group membership does not work

[Jose Castro Leon]

If you have a user with a role assigned through group membership to a project, you are able to create an application credential for that project. But you can't use it later.

When you try to use it the authenticate method will throw 401 Unauthorized.

Checking a bit the code the issue seems to be in the token_model as it only checks for direct assignments of the user missing all the roles that can be inherited or coming through group membership.

https://github.com/openstack/keystone/blob/master/keystone/models/token_model.py#L409-L421

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/655166