'GET /users/{id} (match target).
Test Plan:
- Update policy to protect api by domain_id
- Try and read a user who is in DomainB with a token scoped
to Domain A - this should fail
- Retry this for a user who is in Domain A, which should succeed.
- Finally, try getting a user that does not exist, which should
still return UserNotFound'

def test_get_user_protected_match_target(self):

    new_policy = {'identity:get_user': [['domain_id:%(target.user.domain_id)s']]}
    self._set_policy(new_policy)
    self.auth = self.build_authentication_request(user_id=self.user1['id'], password=self.user1['password'], domain_id=self.domainA['id'])
    url_by_name = ('/users/%s' % self.user2['id'])
    r = self.get(url_by_name, auth=self.auth, expected_status=exception.ForbiddenAction.code)
    url_by_name = ('/users/%s' % self.user1['id'])
    r = self.get(url_by_name, auth=self.auth)
    self.assertEqual(self.user1['id'], r.result['user']['id'])
    url_by_name = ('/users/%s' % uuid.uuid4().hex)
    r = self.get(url_by_name, auth=self.auth, expected_status=exception.UserNotFound.code)
