keystone/keystone/token
Henry Nash a270766eb9 Modify implied roles to honor domain specific roles
The logic for processing domain specific roles is the same as
regular implied roles, except for the fact that domain specifc
roles themselves should not be returned by the manager level
list_role_assignments() in effective mode, hence ensuring that
the won't be placed in the token.

This patch makes the above changes, and adds tests to ensure this.

A follow-on patch will update the policy rules for domain specific
role assignment as well as provide release notes.

Partially implements: blueprint domain-specific-roles

Change-Id: I8c5d0dfd329a84a0525d625dc3b0c2c9325ab6bb
2016-02-16 18:29:30 +00:00
..
persistence Mark memcache and memcache_pool token deprecated 2016-01-19 21:45:48 -05:00
providers Modify implied roles to honor domain specific roles 2016-02-16 18:29:30 +00:00
__init__.py Remove exposure of routers at package level 2015-12-03 15:06:56 -03:00
_simple_cert.py Deprecate simple_cert extension 2016-02-02 15:43:02 -08:00
controllers.py Merge "Deprecating API v2.0" 2016-01-21 00:57:30 +00:00
provider.py Consolidate the fernet provider validate_v2_token() 2016-02-10 17:28:32 +00:00
routers.py HEAD responses should return same status as GET 2014-07-08 22:37:44 -07:00
utils.py Refactor: extract and rename unique_id method 2015-03-24 14:38:49 +00:00