'Create a domain user defined as part of a stack.
The user is defined either via template or created internally by a
resource.  This user will be added to the heat_stack_user_role as
defined in the config, and created in the specified project (which is
expected to be in the stack_domain).
Returns the keystone ID of the resulting user.'

def create_stack_domain_user(self, username, project_id, password=None):

    if (not self.stack_domain):
        return self.create_stack_user(username=username, password=password)
    stack_user_role = self.domain_admin_client.roles.list(name=cfg.CONF.heat_stack_user_role)
    if (len(stack_user_role) == 1):
        role_id = stack_user_role[0].id
        user = self.domain_admin_client.users.create(name=self._get_username(username), password=password, default_project=project_id, domain=self.stack_domain_id)
        LOG.debug('Adding    user    %(user)s    to    role    %(role)s', {'user': user.id, 'role': role_id})
        self.domain_admin_client.roles.grant(role=role_id, user=user.id, project=project_id)
    else:
        LOG.error('Failed    to    add    user    %(user)s    to    role    %(role)s,    check    role    exists!', {'user': username, 'role': cfg.CONF.heat_stack_user_role})
        raise exception.Error((_("Can't    find    role    %s") % cfg.CONF.heat_stack_user_role))
    return user.id
