'DELETE /domains/{id}/users/{id}/roles/{id} (match target).
Test Plan:
- Update policy to protect api by domain_id of entities in
the grant
- Try and delete the existing grant that has a user who is
from a different domain - this should fail.
- Retry this for a user who is in Domain A, which should succeed.'

def test_revoke_grant_protected_match_target(self):

    new_policy = {'identity:revoke_grant': [['domain_id:%(target.user.domain_id)s']]}
    self._set_policy(new_policy)
    collection_url = ('/domains/%(domain_id)s/users/%(user_id)s/roles' % {'domain_id': self.domainA['id'], 'user_id': self.user2['id']})
    member_url = ('%(collection_url)s/%(role_id)s' % {'collection_url': collection_url, 'role_id': self.role['id']})
    self.auth = self.build_authentication_request(user_id=self.user1['id'], password=self.user1['password'], domain_id=self.domainA['id'])
    self.delete(member_url, auth=self.auth, expected_status=exception.ForbiddenAction.code)
    collection_url = ('/domains/%(domain_id)s/users/%(user_id)s/roles' % {'domain_id': self.domainA['id'], 'user_id': self.user1['id']})
    member_url = ('%(collection_url)s/%(role_id)s' % {'collection_url': collection_url, 'role_id': self.role1['id']})
    self.delete(member_url, auth=self.auth)
