Don't test openstack_groups on stable branches

Without this patch, the stable keystone branches fail the K2K tests
because they don't support the assertion feature added in #1687593 and
we don't intend to backport it. This change allows the stable branches
to still be tested using a regular static group mapping.

Change-Id: Ie1be1cc0e961a1584c99247f0c1b0032576718d8

keystone_tempest_plugin/config.py

@@ -58,6 +58,12 @@ FedScenarioGroup = [
                default='federated_domain',
                help='The domain name where the "mapping_group_name" is '
                     'created.'),
+    # TODO(cmurphy): remove this option and set to true when all supported
+    # branches support the openstack_groups feature
+    cfg.BoolOpt('enable_k2k_groups_mapping',
+                default=False,
+                help='Whether to test support for openstack_groups in the K2K '
+                     'SAML assertion (lp#1687593)'),
 
     # Protocol
     cfg.StrOpt('protocol_id',

keystone_tempest_plugin/tests/scenario/test_federated_authentication.py

@@ -260,6 +260,9 @@ class TestK2KFederatedAuthentication(TestSaml2EcpFederatedAuthentication):
                                                             url.netloc)
 
     def _setup_mapping(self):
+        if not CONF.fed_scenario.enable_k2k_groups_mapping:
+            super(TestK2KFederatedAuthentication, self)._setup_mapping()
+            return
         self.mapping_id = data_utils.rand_uuid_hex()
         rules = [{
             'local': [