'Convert v3 token data into v2.0 token data.
This method expects a dictionary generated from
V3TokenDataHelper.get_token_data() and converts it to look like a v2.0
token dictionary.
:param v3_token_data: dictionary formatted for v3 tokens
:param token_id: ID of the token being converted
:returns: dictionary formatted for v2 tokens
:raises keystone.exception.Unauthorized: If a specific token type is
not supported in v2.'

def v3_to_v2_token(self, v3_token_data, token_id):

    token_data = {}
    v3_token = v3_token_data['token']
    domain_id = v3_token.get('domain', {}).get('id')
    if (domain_id and (CONF.identity.default_domain_id != domain_id)):
        msg = 'Unable    to    validate    domain-scoped    tokens    outside    of    the    default    domain'
        raise exception.Unauthorized(msg)
    token = {}
    token['expires'] = v3_token.get('expires_at')
    token['issued_at'] = v3_token.get('issued_at')
    token['audit_ids'] = v3_token.get('audit_ids')
    if v3_token.get('bind'):
        token['bind'] = v3_token['bind']
    token['id'] = token_id
    if ('project' in v3_token):
        tenant = self.resource_api.get_project(v3_token['project']['id'])
        token['tenant'] = controller.V2Controller.v3_to_v2_project(tenant)
    token_data['token'] = token
    v3_user = v3_token['user']
    user = controller.V2Controller.v3_to_v2_user(v3_user)
    if ('OS-TRUST:trust' in v3_token):
        v3_trust = v3_token['OS-TRUST:trust']
        msg = _('Non-default    domain    is    not    supported')
        if CONF.trust.enabled:
            try:
                trust_ref = self.trust_api.get_trust(v3_trust['id'])
            except exception.TrustNotFound:
                raise exception.TokenNotFound(token_id=token_id)
            trustee_user_ref = self.identity_api.get_user(trust_ref['trustee_user_id'])
            if (trustee_user_ref['domain_id'] != CONF.identity.default_domain_id):
                raise exception.Unauthorized(msg)
            trustor_user_ref = self.identity_api.get_user(trust_ref['trustor_user_id'])
            if (trustor_user_ref['domain_id'] != CONF.identity.default_domain_id):
                raise exception.Unauthorized(msg)
            if trust_ref.get('project_id'):
                project_ref = self.resource_api.get_project(trust_ref['project_id'])
                if (project_ref['domain_id'] != CONF.identity.default_domain_id):
                    raise exception.Unauthorized(msg)
        token_data['trust'] = {'impersonation': v3_trust['impersonation'], 'id': v3_trust['id'], 'trustee_user_id': v3_trust['trustee_user']['id'], 'trustor_user_id': v3_trust['trustor_user']['id']}
    if ('OS-OAUTH1' in v3_token):
        msg = 'Unable    to    validate    Oauth    tokens    using    the    version    v2.0    API.'
        raise exception.Unauthorized(msg)
    if ('OS-FEDERATION' in v3_token['user']):
        msg = _('Unable    to    validate    Federation    tokens    using    the    version    v2.0    API.')
        raise exception.Unauthorized(msg)
    user['roles'] = []
    role_ids = []
    for role in v3_token.get('roles', []):
        role_ids.append(role.pop('id'))
        user['roles'].append(role)
    user['roles_links'] = []
    token_data['user'] = user
    token_data['serviceCatalog'] = []
    if ('tenant' in token):
        catalog_ref = self.catalog_api.get_catalog(user['id'], token['tenant']['id'])
        if catalog_ref:
            token_data['serviceCatalog'] = self.format_catalog(catalog_ref)
    metadata = {}
    metadata['roles'] = role_ids
    metadata['is_admin'] = 0
    token_data['metadata'] = metadata
    return {'access': token_data}
