'Build the authentication context.
The context is built from the attributes provided in the env,
such as certificate and scope attributes.'

def _build_tokenless_auth_context(self, request):

    tokenless_helper = tokenless_auth.TokenlessAuthHelper(request.environ)
    (domain_id, project_id, trust_ref, unscoped) = tokenless_helper.get_scope()
    user_ref = tokenless_helper.get_mapped_user(project_id, domain_id)
    if (user_ref['type'] == utils.UserType.EPHEMERAL):
        auth_context = {}
        auth_context['group_ids'] = user_ref['group_ids']
        auth_context[federation_constants.IDENTITY_PROVIDER] = user_ref[federation_constants.IDENTITY_PROVIDER]
        auth_context[federation_constants.PROTOCOL] = user_ref[federation_constants.PROTOCOL]
        if (domain_id and project_id):
            msg = _('Scoping    to    both    domain    and    project    is    not    allowed')
            raise ValueError(msg)
        if domain_id:
            auth_context['domain_id'] = domain_id
        if project_id:
            auth_context['project_id'] = project_id
        auth_context['roles'] = user_ref['roles']
    else:
        token_helper = common.V3TokenDataHelper()
        token_data = token_helper.get_token_data(user_id=user_ref['id'], method_names=[CONF.tokenless_auth.protocol], domain_id=domain_id, project_id=project_id)
        auth_context = {'user_id': user_ref['id']}
        auth_context['is_delegated_auth'] = False
        if domain_id:
            auth_context['domain_id'] = domain_id
        if project_id:
            auth_context['project_id'] = project_id
        auth_context['roles'] = [role['name'] for role in token_data['token']['roles']]
    return auth_context
