User 'admin' loses its permissions in current tenant after removing 'admin' role for itself in another tenant

Seems like problem related to the fact that Keystone invalidates every token for a user after changing its roles within one tenant.
Related MOS Keystone bug: https://bugs.launchpad.net/mos/+bug/1393732.

Since keystone invalidates every token for a User after changing it's roles within one tenant, this bug should be fixed in keystone.
Here is theMOS Keystone bug for it: https://bugs.launchpad.net/mos/+bug/1393732
Here is the upstream fix from Alexander Makarov (on review at this moment): https://review.openstack.org/#/c/141854/

The root case of the problem is wrong implementation of revocation mecanism.
This issue is to be resolved in L cycle - community postponed the fix: https://review.openstack.org/#/c/141854/

The issue is not targeted to 6.1 because it requires thorough fix and it is rather improbable that it will be finished in 6.1 timeframe.

Unfortunately it's a trade-off accepted by Community: in order to avoid revocation by user, which is too heavy

To be more specific: I'm about token revocations

Looks like https://review.openstack.org/#/c/141854/ landed in master on the first week of July

Back port on upstream is here - https://review.openstack.org/#/c/216354/

I am not sure whether we should backport it, so I'm assigning MOS Maintenance team so that they could decide. The link to the patch is posted above on 2015-08-26.

Fix proposed to branch: openstack-ci/fuel-7.0/2015.1.0
Change author: Alexander Makarov <email address hidden>
Review: https://review.fuel-infra.org/16788

Verified on MOS 8.0 #569,

Steps To Verify:
1. Login to Horizon dashboard as admin user
2. Create a new project 'test'
3. Give admin member and admin role to this new project
4. Save the project
5. Remove the admin role for this project
6. Check different tabs in Horizon and verify that user have admin access and can see another projects / users and VMs in different tenanats.

Reviewed: https://review.fuel-infra.org/16788
Submitter: Denis V. Meltsaykin <email address hidden>
Branch: openstack-ci/fuel-7.0/2015.1.0

Commit: 6df500d47e898a0744475122b6c80b069432c1f1
Author: Alexander Makarov <email address hidden>
Date: Tue Feb 9 13:17:56 2016

Group role revocation invalidates all user tokens

Keystone invalidates every token for a user after revoking one group role
within one project.

This patch replaces 'invalidate user's everything' logic with revocation by
grant via notifications for delete_grant assignment operation.

Change-Id: If9d0fefe43da96ba5e6b6ffc809b9f15e8d732f7
Closes-Bug: 1386696
(cherry picked from commit 369d08d1c6f1c30abb09440b3ed06e7e5266b1ec)

Verified on MOS 7.0 mu3 updates.

Steps To Verify:
As described above.