'GET /groups?domain_id=mydomain (protected).
Test Plan:
- Update policy to protect api by domain_id
- List groups using a token scoped to domainA and make sure
we only get back the two groups that are in domainA
- Try and read the groups from domainB - this should fail since
we don\'t have a token scoped for domainB'

def test_list_groups_protected_by_domain(self):

    new_policy = {'identity:list_groups': ['domain_id:%(domain_id)s']}
    self._set_policy(new_policy)
    self.auth = self.build_authentication_request(user_id=self.user1['id'], password=self.user1['password'], domain_id=self.domainA['id'])
    url_by_name = ('/groups?domain_id=%s' % self.domainA['id'])
    r = self.get(url_by_name, auth=self.auth)
    id_list = self._get_id_list_from_ref_list(r.result.get('groups'))
    self.assertEqual(2, len(id_list))
    self.assertIn(self.group1['id'], id_list)
    self.assertIn(self.group2['id'], id_list)
    url_by_name = ('/groups?domain_id=%s' % self.domainB['id'])
    r = self.get(url_by_name, auth=self.auth, expected_status=exception.ForbiddenAction.code)
