Issue deprecation warning if domain_id not specified in create call

Due to a long-fixed bug in a heat tempest test, we failed to
raise a validation error if a domain_id was not specified in
a create call for a user, group or project. Instead, we tried
the default domain.  This is neither in the spec or what we
want.

Although we would like to remove this, in case any customers
have discovered this undocumented feature, for now we just
issue a deprecation warning, saying that we intend to remove
this is during the N release.

Closes-bug: #1482330
Change-Id: Ib3fe50c49063a64146709e57ddbec6665e64160b

keystone/common/controller.py

@@ -17,6 +17,7 @@ import uuid
 
 from oslo_config import cfg
 from oslo_log import log
+from oslo_log import versionutils
 from oslo_utils import strutils
 import six
 
@@ -736,6 +737,16 @@ class V3Controller(wsgi.Application):
             # the current tempest heat tests issue a v3 call without this.
             # This is raised as bug #1283539.  Once this is fixed, we
             # should remove the line below and replace it with an error.
+            #
+            # Ahead of actually changing the code to raise an exception, we
+            # issue a deprecation warning.
+            versionutils.report_deprecated_feature(
+                LOG,
+                _LW('Not specifying a domain during a create user, group or '
+                    'project call, and relying on falling back to the '
+                    'default domain, is deprecated as of Liberty and will be '
+                    'removed in the N release. Specify the domain explicitly '
+                    'or use a domain-scoped token'))
             return CONF.identity.default_domain_id
 
     def _normalize_domain_id(self, context, ref):

keystone/tests/unit/test_v3_identity.py

@@ -16,6 +16,7 @@ import logging
 import uuid
 
 import fixtures
+import mock
 from oslo_config import cfg
 from six.moves import http_client
 from testtools import matchers
@@ -97,11 +98,17 @@ class IdentityTestCase(test_v3.RestfulTestCase):
             user_id=self.user['id'],
             password=self.user['password'],
             project_id=self.project['id'])
-        r = self.post('/users', body={'user': ref_nd}, auth=auth)
+
         # TODO(henry-nash): Due to bug #1283539 we currently automatically
         # use the default domain_id if a domain scoped token is not being
-        # used. Change the code below to expect a failure once this bug is
+        # used. For now we just check that a deprecation warning has been
+        # issued. Change the code below to expect a failure once this bug is
         # fixed.
+        with mock.patch(
+                'oslo_log.versionutils.report_deprecated_feature') as mock_dep:
+            r = self.post('/users', body={'user': ref_nd}, auth=auth)
+            self.assertTrue(mock_dep.called)
+
         ref['domain_id'] = CONF.identity.default_domain_id
         return self.assertValidUserResponse(r, ref)