FIX Use trustee instead of trustor to validate trust token

CHANGES_NEXT_RELEASE

@@ -0,0 +1,2 @@
+- Use trustee instead of trustor to validate trust token (#250)
+

lib/services/keystoneAuth.js

@@ -116,7 +116,7 @@ function retrieveRoles(req, callback) {
         innerCb(null, cachedValue);
     }
 
-    function retrieveRequest(innerCb) {
+    function retrieveRolesForStandardUser(innerCb) {
         var options = {
             url: config.authentication.options.protocol + '://' + config.authentication.options.host + ':' +
             config.authentication.options.port + config.authentication.options.path,
@@ -159,6 +159,23 @@ function retrieveRoles(req, callback) {
         });
     }
 
+    function retrieveRolesForTrustToken(innerCb) {
+        var roles = req.trustRoles.map(function(i) {return i.id;});
+        cache.data.roles.set(cacheKey, roles);
+        cache.updating.roles = false;
+        logger.debug('Extracted roles: \n%j\n', roles);
+
+        innerCb(null, roles);
+    }
+
+    function retrieveRequest(innerCb) {
+        if (req.trustRoles) {
+            retrieveRolesForTrustToken(innerCb);
+        } else {
+            retrieveRolesForStandardUser(innerCb);
+        }
+    }
+
     cacheUtils.cacheAndHold(cache, 'roles', cacheKey, retrieveRequest, processValue, callback);
 }
 
@@ -227,10 +244,12 @@ function retrieveUser(req, callback) {
                 if (body.token['OS-TRUST:trust'] && body.token.project) {
                     req.trustData = body.token['OS-TRUST:trust'];
                     req.trustData.project = body.token.project;
+                    req.trustRoles = body.token.roles;
+
                     cachedValue = {
                         domainName: body.token.project.domain.name,
                         serviceId: body.token.project.domain.id,
-                        userId: body.token['OS-TRUST:trust'].trustor_user.id
+                        userId: body.token['OS-TRUST:trust'].trustee_user.id
                     };
                 } else {
                     cachedValue = {

test/unit/validate_user_action_test.js

@@ -912,7 +912,7 @@ describe('Validate action with Access Control', function() {
                 } else if (req.path === '/v3/projects' && req.method === 'GET') {
                     res.json(200, utils.readExampleFile('./test/keystoneResponses/getProjects.json'));
                 } else {
-                    req.query['user.id'].should.equal('5e817c5e0d624ee68dfb7a72d0d31ce4');
+                    req.query['user.id'].should.equal('d6809594b8794f23a8ec51f0c6b2c5d6');
                     req.headers['x-auth-token'].should.equal('092016b75474ea6b492e29fb69d23029');
                     res.json(200, utils.readExampleFile('./test/keystoneResponses/rolesOfUser.json'));
                 }
@@ -923,5 +923,39 @@ describe('Validate action with Access Control', function() {
                 done();
             });
         });
+
+        it('should extract the roles from the trust, not calling Keystone again', function(done) {
+            var getRolesCall = false,
+                xacmlRequest;
+
+            mockOAuthApp.handler = function(req, res) {
+                if (req.path === currentAuthentication.authPath && req.method === 'POST') {
+                    res.setHeader('X-Subject-Token', '092016b75474ea6b492e29fb69d23029');
+                    res.json(201, utils.readExampleFile('./test/keystoneResponses/authorize.json'));
+                } else if (req.path === currentAuthentication.authPath && req.method === 'GET') {
+                    res.json(200, utils.readExampleFile('./test/keystoneResponses/getUserWithTrust.json'));
+                } else if (req.path === '/v3/projects' && req.method === 'GET') {
+                    res.json(200, utils.readExampleFile('./test/keystoneResponses/getProjects.json'));
+                } else {
+                    req.query['user.id'].should.equal('d6809594b8794f23a8ec51f0c6b2c5d6');
+                    req.headers['x-auth-token'].should.equal('092016b75474ea6b492e29fb69d23029');
+                    getRolesCall = true;
+                    res.json(200, utils.readExampleFile('./test/keystoneResponses/rolesOfUser.json'));
+                }
+            };
+
+            mockAccessApp.handler = function(req, res) {
+                xacmlRequest = req.rawBody;
+                res.set('Content-Type', 'application/xml');
+                res.send(utils.readExampleFile('./test/accessControlResponses/permitResponse.xml', true));
+            };
+
+            request(options, function(error, response, body) {
+                response.statusCode.should.equal(200);
+                xacmlRequest.should.match(/d44ee9276cb64eefb98bec7e03776014/);
+                getRolesCall.should.equal(false);
+                done();
+            });
+        });
     });
 });