Make user to nonlocal_user a 1:1 relationship

The table relationship between 'user' and 'nonlocal_user' should be
1 to 1, which is consistent with 'user' to 'local_user'. However, it's
mistakenly 1 to many. In fact, the backend code treats 'user' to
'nonlocal_user' as 1:1 and wouldn't allow duplicates, so this will have
zero impact on existing deployments. This patch fixes this by making the
user_id column unique.

Closes-Bug: #1649412
Partially-Implements: bp support-federated-attr
Change-Id: Ib371df18f3fb2c67e5421cf0bf4551183902cf00

keystone/identity/backends/sql_model.py

@@ -42,11 +42,12 @@ class User(sql.ModelBase, sql.DictBase):
                                        lazy='subquery',
                                        cascade='all,delete-orphan',
                                        backref='user')
-    nonlocal_users = orm.relationship('NonLocalUser',
-                                      single_parent=True,
-                                      lazy='subquery',
-                                      cascade='all,delete-orphan',
-                                      backref='user')
+    nonlocal_user = orm.relationship('NonLocalUser',
+                                     uselist=False,
+                                     single_parent=True,
+                                     lazy='subquery',
+                                     cascade='all,delete-orphan',
+                                     backref='user')
     created_at = sql.Column(sql.DateTime, nullable=True)
     last_active_at = sql.Column(sql.Date, nullable=True)
 
@@ -55,8 +56,8 @@ class User(sql.ModelBase, sql.DictBase):
     def name(self):
         if self.local_user:
             return self.local_user.name
-        elif self.nonlocal_users:
-            return self.nonlocal_users[0].name
+        elif self.nonlocal_user:
+            return self.nonlocal_user.name
         elif self.federated_users:
             return self.federated_users[0].display_name
         else:
@@ -140,8 +141,8 @@ class User(sql.ModelBase, sql.DictBase):
     def domain_id(self):
         if self.local_user:
             return self.local_user.domain_id
-        elif self.nonlocal_users:
-            return self.nonlocal_users[0].domain_id
+        elif self.nonlocal_user:
+            return self.nonlocal_user.domain_id
         else:
             return None
 
@@ -273,7 +274,7 @@ class NonLocalUser(sql.ModelBase, sql.ModelDictMixin):
     domain_id = sql.Column(sql.String(64), primary_key=True)
     name = sql.Column(sql.String(255), primary_key=True)
     user_id = sql.Column(sql.String(64), sql.ForeignKey('user.id',
-                                                        ondelete='CASCADE'))
+                         ondelete='CASCADE'), unique=True)
 
 
 class Group(sql.ModelBase, sql.DictBase):

keystone/identity/shadow_backends/sql.py

@@ -105,7 +105,7 @@ class ShadowUsers(base.ShadowUsersDriverBase):
                 new_nonlocal_user_dict)
             new_user_ref = model.User.from_dict(new_user_dict)
             new_user_ref.created_at = datetime.datetime.utcnow()
-            new_user_ref.nonlocal_users.append(new_nonlocal_user_ref)
+            new_user_ref.nonlocal_user = new_nonlocal_user_ref
             session.add(new_user_ref)
             return identity_base.filter_user(new_user_ref.to_dict())