'Check cross-tenant ACLs.
Match tenant:user, tenant and user could be its id, name or \'*\'
:param user_id: The user id from the identity token.
:param user_name: The user name from the identity token.
:param tenant_id: The tenant ID from the identity token.
:param tenant_name: The tenant name from the identity token.
:param roles: The given container ACL.
:param allow_names: If True then attempt to match tenant and user names
as well as id\'s.
:returns: matched string if tenant(name/id/*):user(name/id/*) matches
the given ACL.
None otherwise.'

def _authorize_cross_tenant(self, user_id, user_name, tenant_id, tenant_name, roles, allow_names=True):

    tenant_match = [tenant_id, '*']
    user_match = [user_id, '*']
    if allow_names:
        tenant_match = (tenant_match + [tenant_name])
        user_match = (user_match + [user_name])
    for tenant in tenant_match:
        for user in user_match:
            s = ('%s:%s' % (tenant, user))
            if (s in roles):
                return s
    return None
