Updated openstack/openstack
Project: openstack/keystone  6d5a093aa66074bb439ba7094458cc5d7b729020

Improve testing of domain federation tokens for inherited roles.

Currently domain-scoped federation-generated tokens incorrectly
include group roles that are inherited projects within that domain.
This error is also exposed via the /auth/domains and
/OS-FEDERATION/domains API calls.

This patch enhances our testing to demonstrate the error - a follow-on
patch will fix it.

Partially implements: bug 1385533
Partially implements: bug 1385643

Change-Id: I54d1d1a38cb63208c626efa5e4ca4a69e1b234a1