Add user objects to mapping rules examples in OS-FEDERATION docs

[Marek Denis]

All the mapping rules should produce not only a set of Keystone group ids but also a user_id. It's is also required by mapping engine (https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py#L224). Unfortunately not all examples in the OS-FEDERATION extension include. This should be fixed, as well as docs should clearly state that all the rules should map the user name.

[Dolph Mathews (dolph)]

Isn't the actual bug that the role processor requires a name in the output?

[Marek Denis (marek-denis)]

I think we had couple of discussions whether we should require user mapping and eventually one of the major requirement for that was accounting/auditing. That's why a special condition checking whether user was mapped was added. Also note, that the term "user mapping" doesn't mean "mapping to an existing user". It's just an user_id that may help trace who and when did certain operations. I also think a good practive would be mapping one single atribute from SAML assertion as an user_id. Since different IdPs issue different assertions (parameter names) you cannot make a general rule for that.

[Dolph Mathews (dolph)]

The intermixed use of user "id" and user "name" here had me confused - IIRC, the name is arbitrarily owned by the IdP, and we generate an ID based on that name.

I'm still lost on which "examples" this is referring to - in documentation or elsewhere?

[Marek Denis (marek-denis)]

If { user" {name: [...] } } is missing in the 'local' object in the rulees Keystone will raise exceptions.Unauthorized(). I was refering to rule examples in OS-FEDERATION extension documentation. See https://review.openstack.org/#/c/90121/ .

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/90121
Committed: https://git.openstack.org/cgit/openstack/identity-api/commit/?id=d88942944ed01dd5aba7519a817fafdaed73aa99
Submitter: Jenkins
Branch: master

commit d88942944ed01dd5aba7519a817fafdaed73aa99
Author: Marek Denis <email address hidden>
Date: Thu Apr 24 17:36:45 2014 +0200

    Add ``user`` object to the mapping rules examples.

    Every rule should have a local ``user`` object that is used to
    produce a unique user_id of the federated user. Not all examples of the
    OS-FEDERATION extension included such object.

    Change-Id: Ib1a2a956cb3638402b283ad13841f48d31814240
    Closes-Bug: #1312221