Updated openstack/openstack
Project: openstack/keystone  d906f5774845d23ab517a263b8d4e7d0ceb949f5
null
Provide option to make domain_id immutable

Currently, a user, group or project entity can be moved between
domains by updating their domain_id. There are situations where
this is not desirable (and in fact could create a potential security
hole) - for example when creating a domain admin persona, using an
appropriate policy file (such as policy.v3cloudsample).

For backward compatibility, the option to make the domain_id immutable
is controlled by a config option, with the default being no change
to existing functionality.

Change-Id: Idd847f471beae7387d6cc59af0a960a923da799f
Closes-Bug: 1291393