The patch https://review.opendev.org/#/c/673389/ introduced a regression
by changing the osc-lib interface.

Two conflicting attempts to fix the regression were launched:

1) Reverting the patch.

2) The patch https://review.opendev.org/683119 changes the exception
   from the generic CommandError back to a specific Forbidden exception.

   The patch https://review.opendev.org/683118 catches this exception
   and passes on, i.e. re-implements the same behavior as before.

The first idea was implemented, the initial patch reverted. The second
idea was partially implemented. The change in python-openstackclient
(683118) was merged. The change in osc-lib was approved but failed to
merge because the initial change had been reverted.

Now we have again a situation where the exception produced in osc-lib
does not match the exception expected by the caller.

It is unclear if the osc-lib interface will ever get a rebased version
of https://review.opendev.org/683119 merged, so the safest way to
address the issue is to also catch the exception that used to be
thrown before the inital change and is again thrown after the inital
change has been reverted.

Change-Id: I2ea2def607ec5be112e42d53a1e660fef0cdd69c
(cherry picked from commit 0a8753dc3eaeda25554ccd769350de1e9792a62b)

The policies parameter has been replaced with the
policy parameter since Nova API version 2.64[1]

This commit adds a check to make sure the correct parameter is used.

[1]https://docs.openstack.org/nova/latest/reference/api-microversion-history.html#id59

Change-Id: Ia37beb7790884d6d15bec45074f446e64af1a2aa
Story: #2008041
Task: #40703
(cherry picked from commit ed6d8d941104c60f447de852582eb9388b9d2e73)

The policies field has been replaced with the
policy field since Nova API version 2.64[1]

This commit adds a check to make sure the correct field is used.

[1]https://docs.openstack.org/nova/latest/reference/api-microversion-history.html#id59

Change-Id: I06d3211937d822c26070b7f8ad757c365dcbb1bb
Story: #2007822
Task: #40101
(cherry picked from commit 51a1ea65f4d095b073381200e5268f909bf360de)

Keystone let's users remove role assignments that reference non-existent
users and groups. This is nice when keystone backs to an identity store
like LDAP and users or groups are removed.

Previously, openstackclient would validate the user and group existed in
keystone before sending the request to delete the role assignment. This
commit updates the code to bypass that validation so that users can use
IDs to forcibly cleanup role assignments.

Change-Id: I102b41677736bbe37a82abaa3c5b3e1faf2475d5
Story: 2006635
Task: 36848
(cherry picked from commit e24673267093de85beee753860cda1fb224ce4bc)

I was writing some additional functionality and noticed these tests were
missing. This commit adds tests for adding and removing system role
assignments for users and groups.

Change-Id: I30fdc6ec55e1eb1cfa55f4cbf92c3f001d89865f
(cherry picked from commit a8aad9fec80bcb6c9917d2dd076373f06467849f)

assertItemsEqual was removed from Python's unittest.TestCase in
Python 3.3 [1][2]. We have been able to use them since then, because
testtools required unittest2, which still included it. With testtools
removing Python 2.7 support [3][4], we will lose support for
assertItemsEqual, so we should switch to use assertCountEqual.

[1] - https://bugs.python.org/issue17866
[2] - https://hg.python.org/cpython/rev/d9921cb6e3cd
[3] - testing-cabal/testtools#286
[4] - testing-cabal/testtools#277

Change-Id: I1ad0da8deda3a8cbec384b5a9c88860a526eb48c
(cherry picked from commit a15b1addb41147415716417f385f8ee32aace64b)

When we use "--property" parameter, client get lists these the
value is string type, but the type of the value 'is_domain'
should be boolean, so we should judge it and parse it.
The patch parse string to boolean for value 'is_domain'.

Co-Authored-By: Lance Bragstad <lbragstad@gmail.com>

Conflict:
  Direct backports of this patch fail because the original tests
  proposed to the Victoria (master) branch included keystone
  ``options``. Support for ``options`` was added in:

    I9c3bdd741f28bf558267fb217818d947597ce13e

  This backport removes the ``options`` key from the expected values in
  the tests since feature support for ``options`` isn't going to be
  backported. Otherwise, the functionality of this change is fully
  tested like it is on later releases.

Change-Id: I37c9eb854524bde3a1530bfe2e3a03810fb1a676
Task: 30039
Story: 2005246
(cherry picked from commit 533af9f1b2de40d98f69e83cdf89ecf254cf3879)