'Test that empty whitelist blocks all the values.
Not adding a ``whitelist`` keyword to the mapping value is different
than adding empty whitelist.  The former case will simply pass all the
values, whereas the latter would discard all the values.
This test checks scenario where an empty whitelist was specified.
The expected result is that no groups are matched.
The test scenario is as follows:
- Create group ``EXISTS``
- Set mapping rules for existing IdP with an empty whitelist
that whould discard any values from the assertion
- Try issuing unscoped token, no groups were matched and that the
federated user does not have any group assigned.'

def test_empty_whitelist_discards_all_values(self):

    domain_id = self.domainA['id']
    domain_name = self.domainA['name']
    group = unit.new_group_ref(domain_id=domain_id, name='EXISTS')
    group = self.identity_api.create_group(group)
    rules = {'rules': [{'local': [{'user': {'name': '{0}', 'id': '{0}'}}], 'remote': [{'type': 'REMOTE_USER'}]}, {'local': [{'groups': '{0}', 'domain': {'name': domain_name}}], 'remote': [{'type': 'REMOTE_USER_GROUPS', 'whitelist': []}]}]}
    self.federation_api.update_mapping(self.mapping['id'], rules)
    r = self._issue_unscoped_token(assertion='UNMATCHED_GROUP_ASSERTION')
    assigned_groups = r.json['token']['user']['OS-FEDERATION']['groups']
    self.assertEqual(len(assigned_groups), 0)
