Comment 2 for bug 1082973

There's is no problem with acl.parse_acl, and you get a 403 just because at that time, keystoneauth doesn't support 'tenant_name:user_name'.

Now this has been fixed by this patch: https://review.openstack.org/#/c/22820/, so this case is also fixed