rackerlabs/repose — pull request #642 by dimtruck (2013-08-20 13:12:17+00:00)
Title: B 52709 - Client-Auth-n remove tenant validation

This pull request takes care of client-auth-n remove tenant validation story, essentially removing "belongsTo?" query parameter from the code. In detail, it does the following:

1. removes belongsTo query parameter
2. adds support for service-admin roles in client auth configuration
3. if, upon authentication, tenant's role matches a role in the service-admin roles list, no tenant validation is made (basically, the verification that the auth token belongs to the tenant in request)
4. if tenant's role does not match any roles in the service-admin role list, tenant validation is performed as usual
5. caching strategy is updated as such.

Tests are written to stress this new behavior for both tenanted and delegable versions of client-auth-n.