domain-scoping

Implement domain-scoping functionality for v3 auth API

Change-Id: Id5e935735a43fefee10a36d9d691578871ba7fcb

1 files changed, 16 insertions, 2 deletions

diff --git a/keystone/auth/token_factory.py b/keystone/auth/token_factory.py
index e803ae79..fdd33d12 100644
--- a/keystone/auth/token_factory.py
+++ b/keystone/auth/token_factory.py
@@ -77,11 +77,25 @@ class TokenDataHelper(object):
             raise exception.Unauthorized(msg)
         return roles_ref
 
+    def _get_domain_roles_for_user(self, user_id, domain_id):
+        roles = self.identity_api.get_roles_for_user_and_domain(
+            self.context, user_id, domain_id)
+        roles_ref = []
+        for role_id in roles:
+            role_ref = self.identity_api.get_role(self.context, role_id)
+            role_ref.setdefault('domain_id', domain_id)
+            roles_ref.append(role_ref)
+        # user have no domain roles, therefore access denied
+        if len(roles_ref) == 0:
+            msg = _('User have no access to domain')
+            LOG.debug(msg)
+            raise exception.Unauthorized(msg)
+        return roles_ref
+
     def _get_roles_for_user(self, user_id, domain_id, project_id):
         roles = []
         if domain_id:
-            # TODO(gyee): get domain roles
-            pass
+            roles = self._get_domain_roles_for_user(user_id, domain_id)
         if project_id:
             roles = self._get_project_roles_for_user(user_id, project_id)
         return roles