'An authenticated user is going to authorize a request token.
As a security precaution, the requested roles must match those in
the request token. Because this is in a CLI-only world at the moment,
there is not another easy way to make sure the user knows which roles
are being requested before authorizing.'

@controller.protected()
def authorize_request_token(self, request, request_token_id, roles):

    if request.context.is_delegated_auth:
        raise exception.Forbidden(_('Cannot    authorize    a    request    token    with    a    token    issued    via    delegation.'))
    req_token = self.oauth_api.get_request_token(request_token_id)
    expires_at = req_token['expires_at']
    if expires_at:
        now = timeutils.utcnow()
        expires = timeutils.normalize_time(timeutils.parse_isotime(expires_at))
        if (now > expires):
            raise exception.Unauthorized(_('Request    token    is    expired'))
    authed_roles = set()
    for role in roles:
        authed_roles.add(role['id'])
    user_token = authorization.get_token_ref(request.context_dict)
    user_id = user_token.user_id
    project_id = req_token['requested_project_id']
    user_roles = self.assignment_api.get_roles_for_user_and_project(user_id, project_id)
    cred_set = set(user_roles)
    if (not cred_set.issuperset(authed_roles)):
        msg = _('authorizing    user    does    not    have    role    required')
        raise exception.Unauthorized(message=msg)
    role_ids = list(authed_roles)
    authed_token = self.oauth_api.authorize_request_token(request_token_id, user_id, role_ids)
    to_return = {'token': {'oauth_verifier': authed_token['verifier']}}
    return to_return
