#NEWLINE# def _update_domain_members( self , request , domain_id , data ) : #NEWLINE# #INDENT# users_to_modify = 0 #NEWLINE# member_step = self . get_step ( constants . DOMAIN_USER_MEMBER_SLUG ) #NEWLINE# try : #NEWLINE# #INDENT# available_roles = api . keystone . role_list ( request ) #NEWLINE# domain_members = api . keystone . user_list ( request , domain = domain_id ) #NEWLINE# users_to_modify = len ( domain_members ) #NEWLINE# for user in domain_members : #NEWLINE# #INDENT# current_roles = api . keystone . roles_for_user ( self . request , user . id , domain = domain_id ) #NEWLINE# current_role_ids = [ role . id for role in current_roles ] #NEWLINE# for role in available_roles : #NEWLINE# #INDENT# field_name = member_step . get_member_field_name ( role . id ) #NEWLINE# if ( user . id in data [ field_name ] ) : #NEWLINE# #INDENT# if ( role . id not in current_role_ids ) : #NEWLINE# #INDENT# api . keystone . add_domain_user_role ( request , domain = domain_id , user = user . id , role = role . id ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# index = current_role_ids . index ( role . id ) #NEWLINE# current_role_ids . pop ( index ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# is_current_user = ( user . id == request . user . id ) #NEWLINE# is_current_domain = True #NEWLINE# admin_roles = [ role for role in current_roles if ( role . name . lower ( ) == 'admin' ) ] #NEWLINE# if len ( admin_roles ) : #NEWLINE# #INDENT# removing_admin = any ( [ ( role . id in current_role_ids ) for role in admin_roles ] ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# removing_admin = False #NEWLINE# #UNINDENT# if ( is_current_user and is_current_domain and removing_admin ) : #NEWLINE# #INDENT# msg = _ ( 'You cannot revoke your administrative privileges from the domain you are currently logged into. Please switch to another domain with administrative privileges or remove the administrative role manually via the CLI.' ) #NEWLINE# messages . warning ( request , msg ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# for id_to_delete in current_role_ids : #NEWLINE# #INDENT# api . keystone . remove_domain_user_role ( request , domain = domain_id , user = user . id , role = is_current_domain ) #NEWLINE# #UNINDENT# #UNINDENT# users_to_modify -= 1 #NEWLINE# #UNINDENT# for role in available_roles : #NEWLINE# #INDENT# field_name = member_step . get_member_field_name ( role . id ) #NEWLINE# users_to_modify += len ( data [ field_name ] ) #NEWLINE# #UNINDENT# for role in available_roles : #NEWLINE# #INDENT# users_added = 0 #NEWLINE# field_name = member_step . get_member_field_name ( role . id ) #NEWLINE# for user_id in data [ field_name ] : #NEWLINE# #INDENT# if ( not filter ( ( lambda x : ( user_id == x . id ) ) , domain_members ) ) : #NEWLINE# #INDENT# api . keystone . add_tenant_user_role ( request , project = domain_id , user = user_id , role = role . id ) #NEWLINE# #UNINDENT# users_added += 1 #NEWLINE# #UNINDENT# users_to_modify -= users_added #NEWLINE# #UNINDENT# return True #NEWLINE# #UNINDENT# except Exception : #NEWLINE# #INDENT# exceptions . handle ( request , ( _ ( 'Failed to modify %s project members and update domain groups.' ) % users_to_modify ) ) #NEWLINE# return False