Add system role functionality

This commit adds the necessary bits to expose system role
assignments to openstackclient via python-keystoneclient.

bp system-scope

Depends-On: Iecbcbf020a15f2bec777334c648d4477f89f3b2c
Change-Id: I261e84700b51e8715eaebdc3f8f8bc46b68542c2

3 files changed, 61 insertions, 13 deletions

diff --git a/openstackclient/identity/v3/role.py b/openstackclient/identity/v3/role.py
index 2828a349..58a76f8a 100644
--- a/openstackclient/identity/v3/role.py
+++ b/openstackclient/identity/v3/role.py
@@ -31,13 +31,18 @@ LOG = logging.getLogger(__name__)
 
 
 def _add_identity_and_resource_options_to_parser(parser):
-    domain_or_project = parser.add_mutually_exclusive_group()
-    domain_or_project.add_argument(
+    system_or_domain_or_project = parser.add_mutually_exclusive_group()
+    system_or_domain_or_project.add_argument(
+        '--system',
+        metavar='<system>',
+        help=_('Include <system> (all)'),
+    )
+    system_or_domain_or_project.add_argument(
         '--domain',
         metavar='<domain>',
         help=_('Include <domain> (name or ID)'),
     )
-    domain_or_project.add_argument(
+    system_or_domain_or_project.add_argument(
         '--project',
         metavar='<project>',
         help=_('Include <project> (name or ID)'),
@@ -62,7 +67,14 @@ def _add_identity_and_resource_options_to_parser(parser):
 def _process_identity_and_resource_options(parsed_args,
                                            identity_client_manager):
     kwargs = {}
-    if parsed_args.user and parsed_args.domain:
+    if parsed_args.user and parsed_args.system:
+        kwargs['user'] = common.find_user(
+            identity_client_manager,
+            parsed_args.user,
+            parsed_args.user_domain,
+        ).id
+        kwargs['system'] = parsed_args.system
+    elif parsed_args.user and parsed_args.domain:
         kwargs['user'] = common.find_user(
             identity_client_manager,
             parsed_args.user,
@@ -83,6 +95,13 @@ def _process_identity_and_resource_options(parsed_args,
             parsed_args.project,
             parsed_args.project_domain,
         ).id
+    elif parsed_args.group and parsed_args.system:
+        kwargs['group'] = common.find_group(
+            identity_client_manager,
+            parsed_args.group,
+            parsed_args.group_domain,
+        ).id
+        kwargs['system'] = parsed_args.system
     elif parsed_args.group and parsed_args.domain:
         kwargs['group'] = common.find_group(
             identity_client_manager,
@@ -109,8 +128,8 @@ def _process_identity_and_resource_options(parsed_args,
 
 
 class AddRole(command.Command):
-    _description = _("Adds a role assignment to a user or group on a domain "
-                     "or project")
+    _description = _("Adds a role assignment to a user or group on the "
+                     "system, a domain, or a project")
 
     def get_parser(self, prog_name):
         parser = super(AddRole, self).get_parser(prog_name)
@@ -381,7 +400,7 @@ class ListRole(command.Lister):
 
 
 class RemoveRole(command.Command):
-    _description = _("Removes a role assignment from domain/project : "
+    _description = _("Removes a role assignment from system/domain/project : "
                      "user/group")
 
     def get_parser(self, prog_name):
diff --git a/openstackclient/identity/v3/role_assignment.py b/openstackclient/identity/v3/role_assignment.py
index a362adb0..9c2f3d24 100644
--- a/openstackclient/identity/v3/role_assignment.py
+++ b/openstackclient/identity/v3/role_assignment.py
@@ -55,17 +55,22 @@ class ListRoleAssignment(command.Lister):
             help=_('Group to filter (name or ID)'),
         )
         common.add_group_domain_option_to_parser(parser)
-        domain_or_project = parser.add_mutually_exclusive_group()
-        domain_or_project.add_argument(
+        system_or_domain_or_project = parser.add_mutually_exclusive_group()
+        system_or_domain_or_project.add_argument(
             '--domain',
             metavar='<domain>',
             help=_('Domain to filter (name or ID)'),
         )
-        domain_or_project.add_argument(
+        system_or_domain_or_project.add_argument(
             '--project',
             metavar='<project>',
             help=_('Project to filter (name or ID)'),
         )
+        system_or_domain_or_project.add_argument(
+            '--system',
+            metavar='<system>',
+            help=_('Filter based on system role assignments'),
+        )
         common.add_project_domain_option_to_parser(parser)
         common.add_inherited_option_to_parser(parser)
         parser.add_argument(
@@ -85,7 +90,8 @@ class ListRoleAssignment(command.Lister):
 
     def _as_tuple(self, assignment):
         return (assignment.role, assignment.user, assignment.group,
-                assignment.project, assignment.domain, assignment.inherited)
+                assignment.project, assignment.domain, assignment.system,
+                assignment.inherited)
 
     def take_action(self, parsed_args):
         identity_client = self.app.client_manager.identity
@@ -117,6 +123,10 @@ class ListRoleAssignment(command.Lister):
                     auth_ref.user_id
                 )
 
+        system = None
+        if parsed_args.system:
+            system = parsed_args.system
+
         domain = None
         if parsed_args.domain:
             domain = common.find_domain(
@@ -149,7 +159,9 @@ class ListRoleAssignment(command.Lister):
 
         include_names = True if parsed_args.names else False
         effective = True if parsed_args.effective else False
-        columns = ('Role', 'User', 'Group', 'Project', 'Domain', 'Inherited')
+        columns = (
+            'Role', 'User', 'Group', 'Project', 'Domain', 'System', 'Inherited'
+        )
 
         inherited_to = 'projects' if parsed_args.inherited else None
         data = identity_client.role_assignments.list(
@@ -157,6 +169,7 @@ class ListRoleAssignment(command.Lister):
             user=user,
             group=group,
             project=project,
+            system=system,
             role=role,
             effective=effective,
             os_inherit_extension_inherited_to=inherited_to,
@@ -174,14 +187,24 @@ class ListRoleAssignment(command.Lister):
                 else:
                     setattr(assignment, 'project', scope['project']['id'])
                 assignment.domain = ''
+                assignment.system = ''
             elif 'domain' in scope:
                 if include_names:
                     setattr(assignment, 'domain', scope['domain']['name'])
                 else:
                     setattr(assignment, 'domain', scope['domain']['id'])
                 assignment.project = ''
-
+                assignment.system = ''
+            elif 'system' in scope:
+                # NOTE(lbragstad): If, or when, keystone supports role
+                # assignments on subsets of a system, this will have to evolve
+                # to handle that case instead of hardcoding to the entire
+                # system.
+                setattr(assignment, 'system', 'all')
+                assignment.domain = ''
+                assignment.project = ''
             else:
+                assignment.system = ''
                 assignment.domain = ''
                 assignment.project = ''
 
diff --git a/openstackclient/identity/v3/token.py b/openstackclient/identity/v3/token.py
index effb9e35..1933ecad 100644
--- a/openstackclient/identity/v3/token.py
+++ b/openstackclient/identity/v3/token.py
@@ -192,6 +192,12 @@ class IssueToken(command.ShowOne):
             data['user_id'] = auth_ref.user_id
         if auth_ref.domain_id:
             data['domain_id'] = auth_ref.domain_id
+        if auth_ref.system_scoped:
+            # NOTE(lbragstad): This could change in the future when, or if,
+            # keystone supports the ability to scope to a subset of the entire
+            # deployment system. When that happens, this will have to relay
+            # scope information and IDs like we do for projects and domains.
+            data['system'] = 'all'
         return zip(*sorted(six.iteritems(data)))