Updated openstack/openstack
Project: openstack/heat  c7ae4e88f6dabee0cd4444355cba8860d782856d

Cleanup trust on delete with stored context if needed

On delete, it's possible that someone other than the user who
created the stack may do the delete, e.g if there are a group
of heat users in a project who share responsibility for stacks.

Currently this causes an error if the user is not an admin,
because keystone default policy means only the trustor user (e.g
the user who originally delegated to heat via the trust on create)
or an admin may delete the trust.

So we check if the context user_id matches the user_creds trustor,
and if it doesn't we switch to the stored context to do the trust
cleanup so we avoid the delete failure.

I've avoided switching to the stored context unconditionally because
of the non-trivial overhead of creating a new keystoneclient object,
getting a new trust-scoped token etc.

Closes-Bug: #1308834
Change-Id: If408534ac7164e9d281dfbb6d4d39da97992f322