Update Keystone code from official Github repository with branch Master on 09/01/2015.

Change-Id: I0ff6099e6e2580f87f502002a998bbfe12673498

1 files changed, 153 insertions, 33 deletions

diff --git a/keystone-moon/keystone/tests/unit/test_v3_protection.py b/keystone-moon/keystone/tests/unit/test_v3_protection.py
index 2b2c96d1..458c61de 100644
--- a/keystone-moon/keystone/tests/unit/test_v3_protection.py
+++ b/keystone-moon/keystone/tests/unit/test_v3_protection.py
@@ -391,23 +391,18 @@ class IdentityTestPolicySample(test_v3.RestfulTestCase):
         # Given a non-admin user token, the token can be used to validate
         # itself.
         # This is GET /v3/auth/tokens, with X-Auth-Token == X-Subject-Token
-        # FIXME(blk-u): This test fails, a user can't validate their own token,
-        # see bug 1421825.
 
         auth = self.build_authentication_request(
             user_id=self.just_a_user['id'],
             password=self.just_a_user['password'])
         token = self.get_requested_token(auth)
 
-        # FIXME(blk-u): remove expected_status=403.
         self.get('/auth/tokens', token=token,
-                 headers={'X-Subject-Token': token}, expected_status=403)
+                 headers={'X-Subject-Token': token})
 
     def test_user_validate_user_token(self):
         # A user can validate one of their own tokens.
         # This is GET /v3/auth/tokens
-        # FIXME(blk-u): This test fails, a user can't validate their own token,
-        # see bug 1421825.
 
         auth = self.build_authentication_request(
             user_id=self.just_a_user['id'],
@@ -415,9 +410,8 @@ class IdentityTestPolicySample(test_v3.RestfulTestCase):
         token1 = self.get_requested_token(auth)
         token2 = self.get_requested_token(auth)
 
-        # FIXME(blk-u): remove expected_status=403.
         self.get('/auth/tokens', token=token1,
-                 headers={'X-Subject-Token': token2}, expected_status=403)
+                 headers={'X-Subject-Token': token2})
 
     def test_user_validate_other_user_token_rejected(self):
         # A user cannot validate another user's token.
@@ -458,23 +452,18 @@ class IdentityTestPolicySample(test_v3.RestfulTestCase):
         # Given a non-admin user token, the token can be used to check
         # itself.
         # This is HEAD /v3/auth/tokens, with X-Auth-Token == X-Subject-Token
-        # FIXME(blk-u): This test fails, a user can't check the same token,
-        # see bug 1421825.
 
         auth = self.build_authentication_request(
             user_id=self.just_a_user['id'],
             password=self.just_a_user['password'])
         token = self.get_requested_token(auth)
 
-        # FIXME(blk-u): change to expected_status=200
         self.head('/auth/tokens', token=token,
-                  headers={'X-Subject-Token': token}, expected_status=403)
+                  headers={'X-Subject-Token': token}, expected_status=200)
 
     def test_user_check_user_token(self):
         # A user can check one of their own tokens.
         # This is HEAD /v3/auth/tokens
-        # FIXME(blk-u): This test fails, a user can't check the same token,
-        # see bug 1421825.
 
         auth = self.build_authentication_request(
             user_id=self.just_a_user['id'],
@@ -482,9 +471,8 @@ class IdentityTestPolicySample(test_v3.RestfulTestCase):
         token1 = self.get_requested_token(auth)
         token2 = self.get_requested_token(auth)
 
-        # FIXME(blk-u): change to expected_status=200
         self.head('/auth/tokens', token=token1,
-                  headers={'X-Subject-Token': token2}, expected_status=403)
+                  headers={'X-Subject-Token': token2}, expected_status=200)
 
     def test_user_check_other_user_token_rejected(self):
         # A user cannot check another user's token.
@@ -526,23 +514,18 @@ class IdentityTestPolicySample(test_v3.RestfulTestCase):
         # Given a non-admin user token, the token can be used to revoke
         # itself.
         # This is DELETE /v3/auth/tokens, with X-Auth-Token == X-Subject-Token
-        # FIXME(blk-u): This test fails, a user can't revoke the same token,
-        # see bug 1421825.
 
         auth = self.build_authentication_request(
             user_id=self.just_a_user['id'],
             password=self.just_a_user['password'])
         token = self.get_requested_token(auth)
 
-        # FIXME(blk-u): remove expected_status=403
         self.delete('/auth/tokens', token=token,
-                    headers={'X-Subject-Token': token}, expected_status=403)
+                    headers={'X-Subject-Token': token})
 
     def test_user_revoke_user_token(self):
         # A user can revoke one of their own tokens.
         # This is DELETE /v3/auth/tokens
-        # FIXME(blk-u): This test fails, a user can't revoke the same token,
-        # see bug 1421825.
 
         auth = self.build_authentication_request(
             user_id=self.just_a_user['id'],
@@ -550,9 +533,8 @@ class IdentityTestPolicySample(test_v3.RestfulTestCase):
         token1 = self.get_requested_token(auth)
         token2 = self.get_requested_token(auth)
 
-        # FIXME(blk-u): remove expected_status=403
         self.delete('/auth/tokens', token=token1,
-                    headers={'X-Subject-Token': token2}, expected_status=403)
+                    headers={'X-Subject-Token': token2})
 
     def test_user_revoke_other_user_token_rejected(self):
         # A user cannot revoke another user's token.
@@ -591,7 +573,8 @@ class IdentityTestPolicySample(test_v3.RestfulTestCase):
                     headers={'X-Subject-Token': user_token})
 
 
-class IdentityTestv3CloudPolicySample(test_v3.RestfulTestCase):
+class IdentityTestv3CloudPolicySample(test_v3.RestfulTestCase,
+                                      test_v3.AssignmentTestMixin):
     """Test policy enforcement of the sample v3 cloud policy file."""
 
     def setUp(self):
@@ -905,6 +888,141 @@ class IdentityTestv3CloudPolicySample(test_v3.RestfulTestCase):
 
         self._test_grants('projects', self.project['id'])
 
+    def test_cloud_admin_list_assignments_of_domain(self):
+        self.auth = self.build_authentication_request(
+            user_id=self.cloud_admin_user['id'],
+            password=self.cloud_admin_user['password'],
+            domain_id=self.admin_domain['id'])
+
+        collection_url = self.build_role_assignment_query_url(
+            domain_id=self.domainA['id'])
+        r = self.get(collection_url, auth=self.auth)
+        self.assertValidRoleAssignmentListResponse(
+            r, expected_length=2, resource_url=collection_url)
+
+        domainA_admin_entity = self.build_role_assignment_entity(
+            domain_id=self.domainA['id'],
+            user_id=self.domain_admin_user['id'],
+            role_id=self.admin_role['id'],
+            inherited_to_projects=False)
+        domainA_user_entity = self.build_role_assignment_entity(
+            domain_id=self.domainA['id'],
+            user_id=self.just_a_user['id'],
+            role_id=self.role['id'],
+            inherited_to_projects=False)
+
+        self.assertRoleAssignmentInListResponse(r, domainA_admin_entity)
+        self.assertRoleAssignmentInListResponse(r, domainA_user_entity)
+
+    def test_domain_admin_list_assignments_of_domain(self):
+        self.auth = self.build_authentication_request(
+            user_id=self.domain_admin_user['id'],
+            password=self.domain_admin_user['password'],
+            domain_id=self.domainA['id'])
+
+        collection_url = self.build_role_assignment_query_url(
+            domain_id=self.domainA['id'])
+        r = self.get(collection_url, auth=self.auth)
+        self.assertValidRoleAssignmentListResponse(
+            r, expected_length=2, resource_url=collection_url)
+
+        domainA_admin_entity = self.build_role_assignment_entity(
+            domain_id=self.domainA['id'],
+            user_id=self.domain_admin_user['id'],
+            role_id=self.admin_role['id'],
+            inherited_to_projects=False)
+        domainA_user_entity = self.build_role_assignment_entity(
+            domain_id=self.domainA['id'],
+            user_id=self.just_a_user['id'],
+            role_id=self.role['id'],
+            inherited_to_projects=False)
+
+        self.assertRoleAssignmentInListResponse(r, domainA_admin_entity)
+        self.assertRoleAssignmentInListResponse(r, domainA_user_entity)
+
+    def test_domain_admin_list_assignments_of_another_domain_failed(self):
+        self.auth = self.build_authentication_request(
+            user_id=self.domain_admin_user['id'],
+            password=self.domain_admin_user['password'],
+            domain_id=self.domainA['id'])
+
+        collection_url = self.build_role_assignment_query_url(
+            domain_id=self.domainB['id'])
+        self.get(collection_url, auth=self.auth, expected_status=403)
+
+    def test_domain_user_list_assignments_of_domain_failed(self):
+        self.auth = self.build_authentication_request(
+            user_id=self.just_a_user['id'],
+            password=self.just_a_user['password'],
+            domain_id=self.domainA['id'])
+
+        collection_url = self.build_role_assignment_query_url(
+            domain_id=self.domainA['id'])
+        self.get(collection_url, auth=self.auth, expected_status=403)
+
+    def test_cloud_admin_list_assignments_of_project(self):
+        self.auth = self.build_authentication_request(
+            user_id=self.cloud_admin_user['id'],
+            password=self.cloud_admin_user['password'],
+            domain_id=self.admin_domain['id'])
+
+        collection_url = self.build_role_assignment_query_url(
+            project_id=self.project['id'])
+        r = self.get(collection_url, auth=self.auth)
+        self.assertValidRoleAssignmentListResponse(
+            r, expected_length=2, resource_url=collection_url)
+
+        project_admin_entity = self.build_role_assignment_entity(
+            project_id=self.project['id'],
+            user_id=self.project_admin_user['id'],
+            role_id=self.admin_role['id'],
+            inherited_to_projects=False)
+        project_user_entity = self.build_role_assignment_entity(
+            project_id=self.project['id'],
+            user_id=self.just_a_user['id'],
+            role_id=self.role['id'],
+            inherited_to_projects=False)
+
+        self.assertRoleAssignmentInListResponse(r, project_admin_entity)
+        self.assertRoleAssignmentInListResponse(r, project_user_entity)
+
+    @tests.utils.wip('waiting on bug #1437407')
+    def test_domain_admin_list_assignments_of_project(self):
+        self.auth = self.build_authentication_request(
+            user_id=self.domain_admin_user['id'],
+            password=self.domain_admin_user['password'],
+            domain_id=self.domainA['id'])
+
+        collection_url = self.build_role_assignment_query_url(
+            project_id=self.project['id'])
+        r = self.get(collection_url, auth=self.auth)
+        self.assertValidRoleAssignmentListResponse(
+            r, expected_length=2, resource_url=collection_url)
+
+        project_admin_entity = self.build_role_assignment_entity(
+            project_id=self.project['id'],
+            user_id=self.project_admin_user['id'],
+            role_id=self.admin_role['id'],
+            inherited_to_projects=False)
+        project_user_entity = self.build_role_assignment_entity(
+            project_id=self.project['id'],
+            user_id=self.just_a_user['id'],
+            role_id=self.role['id'],
+            inherited_to_projects=False)
+
+        self.assertRoleAssignmentInListResponse(r, project_admin_entity)
+        self.assertRoleAssignmentInListResponse(r, project_user_entity)
+
+    def test_domain_user_list_assignments_of_project_failed(self):
+        self.auth = self.build_authentication_request(
+            user_id=self.just_a_user['id'],
+            password=self.just_a_user['password'],
+            domain_id=self.domainA['id'])
+
+        collection_url = self.build_role_assignment_query_url(
+            project_id=self.project['id'])
+        self.get(collection_url, auth=self.auth, expected_status=403)
+
     def test_cloud_admin(self):
         self.auth = self.build_authentication_request(
             user_id=self.domain_admin_user['id'],
@@ -921,6 +1039,14 @@ class IdentityTestv3CloudPolicySample(test_v3.RestfulTestCase):
 
         self._test_domain_management()
 
+    def test_domain_admin_get_domain(self):
+        self.auth = self.build_authentication_request(
+            user_id=self.domain_admin_user['id'],
+            password=self.domain_admin_user['password'],
+            domain_id=self.domainA['id'])
+        entity_url = '/domains/%s' % self.domainA['id']
+        self.get(entity_url, auth=self.auth, expected_status=200)
+
     def test_list_user_credentials(self):
         self.credential_user = self.new_credential_ref(self.just_a_user['id'])
         self.credential_api.create_credential(self.credential_user['id'],
@@ -982,23 +1108,18 @@ class IdentityTestv3CloudPolicySample(test_v3.RestfulTestCase):
         # Given a non-admin user token, the token can be used to validate
         # itself.
         # This is GET /v3/auth/tokens, with X-Auth-Token == X-Subject-Token
-        # FIXME(blk-u): This test fails, a user can't validate their own token,
-        # see bug 1421825.
 
         auth = self.build_authentication_request(
             user_id=self.just_a_user['id'],
             password=self.just_a_user['password'])
         token = self.get_requested_token(auth)
 
-        # FIXME(blk-u): remove expected_status=403.
         self.get('/auth/tokens', token=token,
-                 headers={'X-Subject-Token': token}, expected_status=403)
+                 headers={'X-Subject-Token': token})
 
     def test_user_validate_user_token(self):
         # A user can validate one of their own tokens.
         # This is GET /v3/auth/tokens
-        # FIXME(blk-u): This test fails, a user can't validate their own token,
-        # see bug 1421825.
 
         auth = self.build_authentication_request(
             user_id=self.just_a_user['id'],
@@ -1006,9 +1127,8 @@ class IdentityTestv3CloudPolicySample(test_v3.RestfulTestCase):
         token1 = self.get_requested_token(auth)
         token2 = self.get_requested_token(auth)
 
-        # FIXME(blk-u): remove expected_status=403.
         self.get('/auth/tokens', token=token1,
-                 headers={'X-Subject-Token': token2}, expected_status=403)
+                 headers={'X-Subject-Token': token2})
 
     def test_user_validate_other_user_token_rejected(self):
         # A user cannot validate another user's token.