Enable specifying domain for group and role commands

Many of the commands for the group and role resources were lacking an
option to specify the specific domain groups, projects or users belong
to. This commit fixes that.

Change-Id: I461d2bcfd01ad2dea970de38ec7ad6f4a631ceb1
Closes-bug: #1446546

doc/source/command-objects/group.rst

@@ -13,9 +13,25 @@ Add user to group
 .. code:: bash
 
     os group add user
+        [--group-domain <group-domain>]
+        [--user-domain <user-domain>]
         <group>
         <user>
 
+.. option:: --group-domain <group-domain>
+
+    Domain the group belongs to (name or ID). This can be
+    used in case collisions between group names exist.
+
+    .. versionadded:: 3
+
+.. option:: --user-domain <user-domain>
+
+    Domain the user belongs to (name or ID). This can be
+    used in case collisions between user names exist.
+
+    .. versionadded:: 3
+
 .. describe:: <group>
 
     Group to contain <user> (name or ID)
@@ -33,9 +49,25 @@ Check user membership in group
 .. code:: bash
 
     os group contains user
+        [--group-domain <group-domain>]
+        [--user-domain <user-domain>]
         <group>
         <user>
 
+.. option:: --group-domain <group-domain>
+
+    Domain the group belongs to (name or ID). This can be
+    used in case collisions between group names exist.
+
+    .. versionadded:: 3
+
+.. option:: --user-domain <user-domain>
+
+    Domain the user belongs to (name or ID). This can be
+    used in case collisions between user names exist.
+
+    .. versionadded:: 3
+
 .. describe:: <group>
 
     Group to check (name or ID)
@@ -106,7 +138,7 @@ List groups
 
     os group list
         [--domain <domain>]
-        [--user <user>]
+        [--user <user> [--user-domain <user-domain>]]
         [--long]
 
 .. option:: --domain <domain>
@@ -117,6 +149,13 @@ List groups
 
     Filter group list by <user> (name or ID)
 
+.. option:: --user-domain <user-domain>
+
+    Domain the user belongs to (name or ID). This can be
+    used in case collisions between user names exist.
+
+    .. versionadded:: 3
+
 .. option:: --long
 
     List additional fields in output
@@ -130,9 +169,25 @@ Remove user from group
 .. code:: bash
 
     os group remove user
+        [--group-domain <group-domain>]
+        [--user-domain <user-domain>]
         <group>
         <user>
 
+.. option:: --group-domain <group-domain>
+
+    Domain the group belongs to (name or ID). This can be
+    used in case collisions between group names exist.
+
+    .. versionadded:: 3
+
+.. option:: --user-domain <user-domain>
+
+    Domain the user belongs to (name or ID). This can be
+    used in case collisions between user names exist.
+
+    .. versionadded:: 3
+
 .. describe:: <group>
 
     Group containing <user> (name or ID)
@@ -150,10 +205,15 @@ Set group properties
 .. code:: bash
 
     os group set
+        [--domain <domain>]
         [--name <name>]
         [--description <description>]
         <group>
 
+.. option:: --domain <domain>
+
+    Domain containing <group> (name or ID)
+
 .. option:: --name <name>
 
     New group name

doc/source/command-objects/role.rst

@@ -101,8 +101,8 @@ List roles
 .. code:: bash
 
     os role list
-        [--domain <domain> | --project <project]
+        --domain <domain> | --project <project> [--project-domain <project-domain>]
-        [--user <user> | --group <group>]
+        --user <user> [--user-domain <user-domain>] | --group <group> [--group-domain <group-domain>]
 
 .. option:: --domain <domain>
 
@@ -128,6 +128,27 @@ List roles
 
     .. versionadded:: 3
 
+.. option:: --user-domain <user-domain>
+
+    Domain the user belongs to (name or ID).
+    This can be used in case collisions between user names exist.
+
+    .. versionadded:: 3
+
+.. option:: --group-domain <group-domain>
+
+    Domain the group belongs to (name or ID).
+    This can be used in case collisions between group names exist.
+
+    .. versionadded:: 3
+
+.. option:: --project-domain <project-domain>
+
+    Domain the project belongs to (name or ID).
+    This can be used in case collisions between project names exist.
+
+    .. versionadded:: 3
+
 role remove
 -----------
 
@@ -137,8 +158,8 @@ Remove role from domain/project : user/group
 .. code:: bash
 
     os role remove
-        [--domain <domain> | --project <project]
+        --domain <domain> | --project <project> [--project-domain <project-domain>]
-        [--user <user> | --group <group>]
+        --user <user> [--user-domain <user-domain>] | --group <group> [--group-domain <group-domain>]
         <role>
 
 .. option:: --domain <domain>
@@ -161,6 +182,27 @@ Remove role from domain/project : user/group
 
     .. versionadded:: 3
 
+.. option:: --user-domain <user-domain>
+
+    Domain the user belongs to (name or ID).
+    This can be used in case collisions between user names exist.
+
+    .. versionadded:: 3
+
+.. option:: --group-domain <group-domain>
+
+    Domain the group belongs to (name or ID).
+    This can be used in case collisions between group names exist.
+
+    .. versionadded:: 3
+
+.. option:: --project-domain <project-domain>
+
+    Domain the project belongs to (name or ID).
+    This can be used in case collisions between project names exist.
+
+    .. versionadded:: 3
+
 .. describe:: <role>
 
     Role to remove (name or ID)

openstackclient/identity/common.py

@@ -43,22 +43,32 @@ def find_service(identity_client, name_type_or_id):
             raise exceptions.CommandError(msg)
 
 
+def _get_domain_id_if_requested(identity_client, domain_name_or_id):
+    if not domain_name_or_id:
+        return None
+    domain = find_domain(identity_client, domain_name_or_id)
+    return domain.id
+
+
 def find_domain(identity_client, name_or_id):
     return _find_identity_resource(identity_client.domains, name_or_id,
                                    domains.Domain)
 
 
-def find_group(identity_client, name_or_id, domain_id=None):
+def find_group(identity_client, name_or_id, domain_name_or_id=None):
+    domain_id = _get_domain_id_if_requested(identity_client, domain_name_or_id)
     return _find_identity_resource(identity_client.groups, name_or_id,
                                    groups.Group, domain_id=domain_id)
 
 
-def find_project(identity_client, name_or_id, domain_id=None):
+def find_project(identity_client, name_or_id, domain_name_or_id=None):
+    domain_id = _get_domain_id_if_requested(identity_client, domain_name_or_id)
     return _find_identity_resource(identity_client.projects, name_or_id,
                                    projects.Project, domain_id=domain_id)
 
 
-def find_user(identity_client, name_or_id, domain_id=None):
+def find_user(identity_client, name_or_id, domain_name_or_id=None):
+    domain_id = _get_domain_id_if_requested(identity_client, domain_name_or_id)
     return _find_identity_resource(identity_client.users, name_or_id,
                                    users.User, domain_id=domain_id)
 

openstackclient/identity/v3/group.py

@@ -46,16 +46,32 @@ class AddUserToGroup(command.Command):
             metavar='<user>',
             help='User to add to <group> (name or ID)',
         )
+        parser.add_argument(
+            '--group-domain',
+            metavar='<group-domain>',
+            help=('Domain the group belongs to (name or ID). '
+                  'This can be used in case collisions between group names '
+                  'exist.')
+        )
+        parser.add_argument(
+            '--user-domain',
+            metavar='<user-domain>',
+            help=('Domain the user belongs to (name or ID). '
+                  'This can be used in case collisions between user names '
+                  'exist.')
+        )
         return parser
 
     def take_action(self, parsed_args):
         self.log.debug('take_action(%s)', parsed_args)
         identity_client = self.app.client_manager.identity
 
-        user_id = utils.find_resource(identity_client.users,
+        user_id = common.find_user(identity_client,
-                                      parsed_args.user).id
+                                   parsed_args.user,
-        group_id = utils.find_resource(identity_client.groups,
+                                   parsed_args.user_domain).id
-                                       parsed_args.group).id
+        group_id = common.find_group(identity_client,
+                                     parsed_args.group,
+                                     parsed_args.group_domain).id
 
         try:
             identity_client.users.add_to_group(user_id, group_id)
@@ -84,16 +100,32 @@ class CheckUserInGroup(command.Command):
             metavar='<user>',
             help='User to check (name or ID)',
         )
+        parser.add_argument(
+            '--group-domain',
+            metavar='<group-domain>',
+            help=('Domain the group belongs to (name or ID). '
+                  'This can be used in case collisions between group names '
+                  'exist.')
+        )
+        parser.add_argument(
+            '--user-domain',
+            metavar='<user-domain>',
+            help=('Domain the user belongs to (name or ID). '
+                  'This can be used in case collisions between user names '
+                  'exist.')
+        )
         return parser
 
     def take_action(self, parsed_args):
         self.log.debug('take_action(%s)', parsed_args)
         identity_client = self.app.client_manager.identity
 
-        user_id = utils.find_resource(identity_client.users,
+        user_id = common.find_user(identity_client,
-                                      parsed_args.user).id
+                                   parsed_args.user,
-        group_id = utils.find_resource(identity_client.groups,
+                                   parsed_args.user_domain).id
-                                       parsed_args.group).id
+        group_id = common.find_group(identity_client,
+                                     parsed_args.group,
+                                     parsed_args.group_domain).id
 
         try:
             identity_client.users.check_in_group(user_id, group_id)
@@ -184,17 +216,10 @@ class DeleteGroup(command.Command):
         self.log.debug('take_action(%s)', parsed_args)
         identity_client = self.app.client_manager.identity
 
-        domain = None
-        if parsed_args.domain:
-            domain = common.find_domain(identity_client, parsed_args.domain)
         for group in parsed_args.groups:
-            if domain is not None:
+            group_obj = common.find_group(identity_client,
-                group_obj = utils.find_resource(identity_client.groups,
+                                          group,
-                                                group,
+                                          parsed_args.domain)
-                                                domain_id=domain.id)
-            else:
-                group_obj = utils.find_resource(identity_client.groups,
-                                                group)
             identity_client.groups.delete(group_obj.id)
         return
 
@@ -216,6 +241,13 @@ class ListGroup(lister.Lister):
             metavar='<user>',
             help='Filter group list by <user> (name or ID)',
         )
+        parser.add_argument(
+            '--user-domain',
+            metavar='<user-domain>',
+            help=('Domain the user belongs to (name or ID). '
+                  'This can be used in case collisions between user names '
+                  'exist.')
+        )
         parser.add_argument(
             '--long',
             action='store_true',
@@ -234,9 +266,10 @@ class ListGroup(lister.Lister):
                                         parsed_args.domain).id
 
         if parsed_args.user:
-            user = utils.find_resource(
+            user = common.find_user(
-                identity_client.users,
+                identity_client,
                 parsed_args.user,
+                parsed_args.user_domain,
             ).id
         else:
             user = None
@@ -277,16 +310,32 @@ class RemoveUserFromGroup(command.Command):
             metavar='<user>',
             help='User to remove from <group> (name or ID)',
         )
+        parser.add_argument(
+            '--group-domain',
+            metavar='<group-domain>',
+            help=('Domain the group belongs to (name or ID). '
+                  'This can be used in case collisions between group names '
+                  'exist.')
+        )
+        parser.add_argument(
+            '--user-domain',
+            metavar='<user-domain>',
+            help=('Domain the user belongs to (name or ID). '
+                  'This can be used in case collisions between user names '
+                  'exist.')
+        )
         return parser
 
     def take_action(self, parsed_args):
         self.log.debug('take_action(%s)', parsed_args)
         identity_client = self.app.client_manager.identity
 
-        user_id = utils.find_resource(identity_client.users,
+        user_id = common.find_user(identity_client,
-                                      parsed_args.user).id
+                                   parsed_args.user,
-        group_id = utils.find_resource(identity_client.groups,
+                                   parsed_args.user_domain).id
-                                       parsed_args.group).id
+        group_id = common.find_group(identity_client,
+                                     parsed_args.group,
+                                     parsed_args.group_domain).id
 
         try:
             identity_client.users.remove_from_group(user_id, group_id)
@@ -309,6 +358,11 @@ class SetGroup(command.Command):
             'group',
             metavar='<group>',
             help='Group to modify (name or ID)')
+        parser.add_argument(
+            '--domain',
+            metavar='<domain>',
+            help='Domain containing <group> (name or ID)',
+        )
         parser.add_argument(
             '--name',
             metavar='<name>',
@@ -322,7 +376,8 @@ class SetGroup(command.Command):
     def take_action(self, parsed_args):
         self.log.debug('take_action(%s)', parsed_args)
         identity_client = self.app.client_manager.identity
-        group = utils.find_resource(identity_client.groups, parsed_args.group)
+        group = common.find_group(identity_client, parsed_args.group,
+                                  parsed_args.domain)
         kwargs = {}
         if parsed_args.name:
             kwargs['name'] = parsed_args.name
@@ -359,14 +414,9 @@ class ShowGroup(show.ShowOne):
         self.log.debug('take_action(%s)', parsed_args)
         identity_client = self.app.client_manager.identity
 
-        if parsed_args.domain:
+        group = common.find_group(identity_client,
-            domain = common.find_domain(identity_client, parsed_args.domain)
+                                  parsed_args.group,
-            group = utils.find_resource(identity_client.groups,
+                                  domain_name_or_id=parsed_args.domain)
-                                        parsed_args.group,
-                                        domain_id=domain.id)
-        else:
-            group = utils.find_resource(identity_client.groups,
-                                        parsed_args.group)
 
         group._info.pop('links')
         return zip(*sorted(six.iteritems(group._info)))

openstackclient/identity/v3/role.py

@@ -29,6 +29,100 @@ from openstackclient.i18n import _  # noqa
 from openstackclient.identity import common
 
 
+def _add_identity_and_resource_options_to_parser(parser):
+    domain_or_project = parser.add_mutually_exclusive_group()
+    domain_or_project.add_argument(
+        '--domain',
+        metavar='<domain>',
+        help='Include <domain> (name or ID)',
+    )
+    domain_or_project.add_argument(
+        '--project',
+        metavar='<project>',
+        help='Include `<project>` (name or ID)',
+    )
+    user_or_group = parser.add_mutually_exclusive_group()
+    user_or_group.add_argument(
+        '--user',
+        metavar='<user>',
+        help='Include <user> (name or ID)',
+    )
+    user_or_group.add_argument(
+        '--group',
+        metavar='<group>',
+        help='Include <group> (name or ID)',
+    )
+    parser.add_argument(
+        '--user-domain',
+        metavar='<user-domain>',
+        help=('Domain the user belongs to (name or ID). '
+              'This can be used in case collisions between user names '
+              'exist.')
+    )
+    parser.add_argument(
+        '--group-domain',
+        metavar='<group-domain>',
+        help=('Domain the group belongs to (name or ID). '
+              'This can be used in case collisions between group names '
+              'exist.')
+    )
+    parser.add_argument(
+        '--project-domain',
+        metavar='<project-domain>',
+        help=('Domain the project belongs to (name or ID). '
+              'This can be used in case collisions between project names '
+              'exist.')
+    )
+
+
+def _process_identity_and_resource_options(parsed_args,
+                                           identity_client_manager):
+    kwargs = {}
+    if parsed_args.user and parsed_args.domain:
+        kwargs['user'] = common.find_user(
+            identity_client_manager,
+            parsed_args.user,
+            parsed_args.user_domain,
+        ).id
+        kwargs['domain'] = common.find_domain(
+            identity_client_manager,
+            parsed_args.domain,
+        ).id
+    elif parsed_args.user and parsed_args.project:
+        kwargs['user'] = common.find_user(
+            identity_client_manager,
+            parsed_args.user,
+            parsed_args.user_domain,
+        ).id
+        kwargs['project'] = common.find_project(
+            identity_client_manager,
+            parsed_args.project,
+            parsed_args.project_domain,
+        ).id
+    elif parsed_args.group and parsed_args.domain:
+        kwargs['group'] = common.find_group(
+            identity_client_manager,
+            parsed_args.group,
+            parsed_args.group_domain,
+        ).id
+        kwargs['domain'] = common.find_domain(
+            identity_client_manager,
+            parsed_args.domain,
+        ).id
+    elif parsed_args.group and parsed_args.project:
+        kwargs['group'] = common.find_group(
+            identity_client_manager,
+            parsed_args.group,
+            parsed_args.group_domain,
+        ).id
+        kwargs['project'] = common.find_project(
+            identity_client_manager,
+            parsed_args.project,
+            parsed_args.group_domain,
+        ).id
+    return kwargs
+
+
 class AddRole(command.Command):
     """Adds a role to a user or group on a domain or project"""
 
@@ -41,49 +135,7 @@ class AddRole(command.Command):
             metavar='<role>',
             help='Role to add to <user> (name or ID)',
         )
-        domain_or_project = parser.add_mutually_exclusive_group()
+        _add_identity_and_resource_options_to_parser(parser)
-        domain_or_project.add_argument(
-            '--domain',
-            metavar='<domain>',
-            help='Include <domain> (name or ID)',
-        )
-        domain_or_project.add_argument(
-            '--project',
-            metavar='<project>',
-            help='Include `<project>` (name or ID)',
-        )
-        user_or_group = parser.add_mutually_exclusive_group()
-        user_or_group.add_argument(
-            '--user',
-            metavar='<user>',
-            help='Include <user> (name or ID)',
-        )
-        user_or_group.add_argument(
-            '--group',
-            metavar='<group>',
-            help='Include <group> (name or ID)',
-        )
-        parser.add_argument(
-            '--user-domain',
-            metavar='<user-domain>',
-            help=('Domain the user belongs to (name or ID). '
-                  'This can be used in case collisions between user names '
-                  'exist.')
-        )
-        parser.add_argument(
-            '--group-domain',
-            metavar='<group-domain>',
-            help=('Domain the group belongs to (name or ID). '
-                  'This can be used in case collisions between group names '
-                  'exist.')
-        )
-        parser.add_argument(
-            '--project-domain',
-            metavar='<project-domain>',
-            help=('Domain the project belongs to (name or ID). '
-                  'This can be used in case collisions between project names '
-                  'exist.')
-        )
         return parser
 
     def take_action(self, parsed_args):
@@ -99,76 +151,17 @@ class AddRole(command.Command):
             parsed_args.role,
         )
 
-        kwargs = {}
+        kwargs = _process_identity_and_resource_options(
-        if parsed_args.user and parsed_args.domain:
+            parsed_args, self.app.client_manager.identity)
-            user_domain_id = self._get_domain_id_if_requested(
+        if not kwargs:
-                parsed_args.user_domain)
+            sys.stderr.write("Role not added, incorrect set of arguments "
-            kwargs['user'] = common.find_user(
+                             "provided. See openstack --help for more "
-                identity_client,
+                             "details\n")
-                parsed_args.user,
-                user_domain_id,
-            ).id
-            kwargs['domain'] = common.find_domain(
-                identity_client,
-                parsed_args.domain,
-            ).id
-        elif parsed_args.user and parsed_args.project:
-            user_domain_id = self._get_domain_id_if_requested(
-                parsed_args.user_domain)
-            kwargs['user'] = common.find_user(
-                identity_client,
-                parsed_args.user,
-                user_domain_id,
-            ).id
-            project_domain_id = self._get_domain_id_if_requested(
-                parsed_args.project_domain)
-            kwargs['project'] = common.find_project(
-                identity_client,
-                parsed_args.project,
-                project_domain_id,
-            ).id
-        elif parsed_args.group and parsed_args.domain:
-            group_domain_id = self._get_domain_id_if_requested(
-                parsed_args.group_domain)
-            kwargs['group'] = common.find_group(
-                identity_client,
-                parsed_args.group,
-                group_domain_id,
-            ).id
-            kwargs['domain'] = common.find_domain(
-                identity_client,
-                parsed_args.domain,
-            ).id
-        elif parsed_args.group and parsed_args.project:
-            group_domain_id = self._get_domain_id_if_requested(
-                parsed_args.group_domain)
-            kwargs['group'] = common.find_group(
-                identity_client,
-                parsed_args.group,
-                group_domain_id,
-            ).id
-            project_domain_id = self._get_domain_id_if_requested(
-                parsed_args.project_domain)
-            kwargs['project'] = common.find_project(
-                identity_client,
-                parsed_args.project,
-                project_domain_id,
-            ).id
-        else:
-            sys.stderr.write("Role not added, incorrect set of arguments \
-            provided. See openstack --help for more details\n")
             return
 
         identity_client.roles.grant(role.id, **kwargs)
         return
 
-    def _get_domain_id_if_requested(self, domain_name_or_id):
-        if domain_name_or_id is None:
-            return None
-        domain = common.find_domain(self.app.client_manager.identity,
-                                    domain_name_or_id)
-        return domain.id
-
 
 class CreateRole(show.ShowOne):
     """Create new role"""
@@ -242,28 +235,7 @@ class ListRole(lister.Lister):
 
     def get_parser(self, prog_name):
         parser = super(ListRole, self).get_parser(prog_name)
-        domain_or_project = parser.add_mutually_exclusive_group()
+        _add_identity_and_resource_options_to_parser(parser)
-        domain_or_project.add_argument(
-            '--domain',
-            metavar='<domain>',
-            help='Filter roles by <domain> (name or ID)',
-        )
-        domain_or_project.add_argument(
-            '--project',
-            metavar='<project>',
-            help='Filter roles by <project> (name or ID)',
-        )
-        user_or_group = parser.add_mutually_exclusive_group()
-        user_or_group.add_argument(
-            '--user',
-            metavar='<user>',
-            help='Filter roles by <user> (name or ID)',
-        )
-        user_or_group.add_argument(
-            '--group',
-            metavar='<group>',
-            help='Filter roles by <group> (name or ID)',
-        )
         return parser
 
     def take_action(self, parsed_args):
@@ -274,11 +246,13 @@ class ListRole(lister.Lister):
             user = common.find_user(
                 identity_client,
                 parsed_args.user,
+                parsed_args.user_domain,
             )
         elif parsed_args.group:
             group = common.find_group(
                 identity_client,
                 parsed_args.group,
+                parsed_args.group_domain,
             )
 
         if parsed_args.domain:
@@ -290,6 +264,7 @@ class ListRole(lister.Lister):
             project = common.find_project(
                 identity_client,
                 parsed_args.project,
+                parsed_args.project_domain,
             )
 
         # no user or group specified, list all roles in the system
@@ -363,28 +338,7 @@ class RemoveRole(command.Command):
             metavar='<role>',
             help='Role to remove (name or ID)',
         )
-        domain_or_project = parser.add_mutually_exclusive_group()
+        _add_identity_and_resource_options_to_parser(parser)
-        domain_or_project.add_argument(
-            '--domain',
-            metavar='<domain>',
-            help='Include <domain> (name or ID)',
-        )
-        domain_or_project.add_argument(
-            '--project',
-            metavar='<project>',
-            help='Include <project> (name or ID)',
-        )
-        user_or_group = parser.add_mutually_exclusive_group()
-        user_or_group.add_argument(
-            '--user',
-            metavar='<user>',
-            help='Include <user> (name or ID)',
-        )
-        user_or_group.add_argument(
-            '--group',
-            metavar='<group>',
-            help='Include <group> (name or ID)',
-        )
         return parser
 
     def take_action(self, parsed_args):
@@ -400,65 +354,14 @@ class RemoveRole(command.Command):
             parsed_args.role,
         )
 
-        if parsed_args.user and parsed_args.domain:
+        kwargs = _process_identity_and_resource_options(
-            user = common.find_user(
+            parsed_args, self.app.client_manager.identity)
-                identity_client,
+        if not kwargs:
-                parsed_args.user,
-            )
-            domain = common.find_domain(
-                identity_client,
-                parsed_args.domain,
-            )
-            identity_client.roles.revoke(
-                role.id,
-                user=user.id,
-                domain=domain.id,
-            )
-        elif parsed_args.user and parsed_args.project:
-            user = common.find_user(
-                identity_client,
-                parsed_args.user,
-            )
-            project = common.find_project(
-                identity_client,
-                parsed_args.project,
-            )
-            identity_client.roles.revoke(
-                role.id,
-                user=user.id,
-                project=project.id,
-            )
-        elif parsed_args.group and parsed_args.domain:
-            group = common.find_group(
-                identity_client,
-                parsed_args.group,
-            )
-            domain = common.find_domain(
-                identity_client,
-                parsed_args.domain,
-            )
-            identity_client.roles.revoke(
-                role.id,
-                group=group.id,
-                domain=domain.id,
-            )
-        elif parsed_args.group and parsed_args.project:
-            group = common.find_group(
-                identity_client,
-                parsed_args.group,
-            )
-            project = common.find_project(
-                identity_client,
-                parsed_args.project,
-            )
-            identity_client.roles.revoke(
-                role.id,
-                group=group.id,
-                project=project.id,
-            )
-        else:
             sys.stderr.write("Role not removed, incorrect set of arguments \
             provided. See openstack --help for more details\n")
+            return
+
+        identity_client.roles.revoke(role.id, **kwargs)
         return