Rationalize how we get roles after authentication in the controllers

Currently there is a mixture of strategies in the v2 and v3 controllers
for how to get the roles assigned for the scope of the requested
authentication.  This duplicates code, is hard to maintain and in at
least once case (where your only roles on a project are due to a group
membership) is not actually correct (for v2 tokens).

This change does the following:

- Standardizes on using the 'get_roles_for_user_and_project()', and its
  domain equivalent, for how roles are obtained to build a token.  This
  was already the case for v3 tokens.  The controllers no longer need
  to get metadata and extract the roles.
- Removes the driver level function to 'authorize_for_project' - this is
  now handled wihin the controller.  The driver simply supports the user
  authentication.

A nice (and planned for) sideffect of the above is that we now hide
the schema of how we store roles within the driver layer - i.e.
nothing outside of the driver (other than any specific-to-implementation
tests) have to know about how roles are stored in the metadata.  This paves
the way for a re-implementation of the grant tables in IceHouse.

This change also fills in missing function definitons in the assignment
driver.

Implements bp authenticate-role-rationalization

Change-Id: I75fc7f5f728649d40ab1c696b33bbcd88ea6edee

1 files changed, 4 insertions, 6 deletions

diff --git a/keystone/contrib/ec2/core.py b/keystone/contrib/ec2/core.py
index e8471ec6..5254b53f 100644
--- a/keystone/contrib/ec2/core.py
+++ b/keystone/contrib/ec2/core.py
@@ -153,16 +153,14 @@ class Ec2Controller(controller.V2Controller):
         token_id = uuid.uuid4().hex
         tenant_ref = self.identity_api.get_project(creds_ref['tenant_id'])
         user_ref = self.identity_api.get_user(creds_ref['user_id'])
-        metadata_ref = self.identity_api.get_metadata(
-            user_id=user_ref['id'],
-            tenant_id=tenant_ref['id'])
+        metadata_ref = {}
+        metadata_ref['roles'] = (
+            self.identity_api.get_roles_for_user_and_project(
+                user_ref['id'], tenant_ref['id']))
 
         # Validate that the auth info is valid and nothing is disabled
         token.validate_auth_info(self, user_ref, tenant_ref)
 
-        # TODO(termie): optimize this call at some point and put it into the
-        #               the return for metadata
-        # fill out the roles in the metadata
         roles = metadata_ref.get('roles', [])
         if not roles:
             raise exception.Unauthorized(message='User not valid for tenant.')