Lack of federated token user object validation

[Marek Denis]

In our tests it would be better to add a validation of federated user structure in the token.
The check should ensure there are required attributes as well some of them are meeting specified criteria (like user_id should be always url safe).

[Lance Bragstad (lbragstad)]

This review should close this bug; but it wasn't linked in the report..

https://review.openstack.org/#/c/217049/

[Dolph Mathews (dolph)]

Raised this from Wishlist to Low because there's no featureful impact for end users.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/217049
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=f19860fcd9a15e91d579b3138777e791c246b594
Submitter: Jenkins
Branch: master

commit f19860fcd9a15e91d579b3138777e791c246b594
Author: Marek Denis <email address hidden>
Date: Wed Aug 26 11:09:02 2015 +0200

    Validate Mapped User object.

    Provide a method for checking whether required attributes identifying
    ephemeral user are present in the token response.

    Proposed checks include:

    - ensure 'id' is present
    - ensure 'name' is present
    - ensure 'domain' is present
    - ensure 'identity_provider' is present in user['OS-FEDERATION']
    - ensure 'groups' is present in user['OS-FEDERATION']
    - ensure 'protocol' is present in user['OS-FEDERATION']

    additionally ensure that 'user_id' is url safe

    Closes-Bug: #1489474
    Change-Id: I5289fdc4ea4e4f0a682d31121913a828d283eb0d