'Rescope a token.
An unscoped token can be requested, that token can be used to request a
scoped token. The scoped token can be revoked, and the original token
used to get a token in a different project.'

@decorators.idempotent_id('565fa210-1da1-4563-999b-f7b5b67cf112')
def test_rescope_token(self):

    user_password = data_utils.rand_password()
    user = self.create_test_user(password=user_password)
    project1_name = data_utils.rand_name(name='project')
    project1 = self.setup_test_project(name=project1_name)
    project2_name = data_utils.rand_name(name='project')
    project2 = self.setup_test_project(name=project2_name)
    self.addCleanup(self.projects_client.delete_project, project2['id'])
    role = self.setup_test_role()
    self.roles_client.create_user_role_on_project(project1['id'], user['id'], role['id'])
    self.roles_client.create_user_role_on_project(project2['id'], user['id'], role['id'])
    token_auth = self.token.auth(user_id=user['id'], password=user_password)
    token_id = token_auth.response['x-subject-token']
    orig_expires_at = token_auth['token']['expires_at']
    orig_user = token_auth['token']['user']
    self.assertIsInstance(token_auth['token']['expires_at'], six.text_type)
    self.assertIsInstance(token_auth['token']['issued_at'], six.text_type)
    self.assertEqual(['password'], token_auth['token']['methods'])
    self.assertEqual(user['id'], token_auth['token']['user']['id'])
    self.assertEqual(user['name'], token_auth['token']['user']['name'])
    self.assertEqual(CONF.identity.default_domain_id, token_auth['token']['user']['domain']['id'])
    self.assertIsNotNone(token_auth['token']['user']['domain']['name'])
    self.assertNotIn('catalog', token_auth['token'])
    self.assertNotIn('project', token_auth['token'])
    self.assertNotIn('roles', token_auth['token'])
    token_auth = self.token.auth(token=token_id, project_name=project1_name, project_domain_id=CONF.identity.default_domain_id)
    token1_id = token_auth.response['x-subject-token']
    self.assertEqual(orig_expires_at, token_auth['token']['expires_at'], 'Expiration    time    should    match    original    token')
    self.assertIsInstance(token_auth['token']['issued_at'], six.text_type)
    self.assertEqual(set(['password', 'token']), set(token_auth['token']['methods']))
    self.assertEqual(orig_user, token_auth['token']['user'], 'User    should    match    original    token')
    self.assertIsInstance(token_auth['token']['catalog'], list)
    self.assertEqual(project1['id'], token_auth['token']['project']['id'])
    self.assertEqual(project1['name'], token_auth['token']['project']['name'])
    self.assertEqual(CONF.identity.default_domain_id, token_auth['token']['project']['domain']['id'])
    self.assertIsNotNone(token_auth['token']['project']['domain']['name'])
    self.assertEqual(1, len(token_auth['token']['roles']))
    self.assertEqual(role['id'], token_auth['token']['roles'][0]['id'])
    self.assertEqual(role['name'], token_auth['token']['roles'][0]['name'])
    self.client.delete_token(token1_id)
    token_auth = self.token.auth(token=token_id, project_name=project2_name, project_domain_id=CONF.identity.default_domain_id)
    self.assertEqual(project2['id'], token_auth['token']['project']['id'])
    self.assertEqual(project2['name'], token_auth['token']['project']['name'])
