'Check protection for role grant APIs.
The policy rule might want to inspect attributes of any of the entities
involved in the grant.  So we get these and pass them to the
check_protection() handler in the controller.'

def _check_grant_protection(self, request, protection, role_id=None, user_id=None, group_id=None, domain_id=None, project_id=None, allow_no_user=False):

    ref = {}
    if role_id:
        ref['role'] = self.role_api.get_role(role_id)
    if user_id:
        try:
            ref['user'] = self.identity_api.get_user(user_id)
        except exception.UserNotFound:
            if (not allow_no_user):
                raise
    else:
        ref['group'] = self.identity_api.get_group(group_id)
    if domain_id:
        ref['domain'] = self.resource_api.get_domain(domain_id)
    else:
        ref['project'] = self.resource_api.get_project(project_id)
    self.check_protection(request, protection, ref)
