'Test that inherited roles on the domain are excluded.
Test Plan:
- Create two domains, one user, group and role
- Domain1 is given an inherited user role, Domain2 an inherited
group role (for a group of which the user is a member)
- When listing domains for user, neither domain should be returned'

def test_list_domains_for_user_with_inherited_grants(self):

    domain1 = unit.new_domain_ref()
    domain1 = self.resource_api.create_domain(domain1['id'], domain1)
    domain2 = unit.new_domain_ref()
    domain2 = self.resource_api.create_domain(domain2['id'], domain2)
    user = unit.new_user_ref(domain_id=domain1['id'])
    user = self.identity_api.create_user(user)
    group = unit.new_group_ref(domain_id=domain1['id'])
    group = self.identity_api.create_group(group)
    self.identity_api.add_user_to_group(user['id'], group['id'])
    role = unit.new_role_ref()
    self.role_api.create_role(role['id'], role)
    self.assignment_api.create_grant(user_id=user['id'], domain_id=domain1['id'], role_id=role['id'], inherited_to_projects=True)
    self.assignment_api.create_grant(group_id=group['id'], domain_id=domain2['id'], role_id=role['id'], inherited_to_projects=True)
    user_domains = self.assignment_api.list_domains_for_user(user['id'])
    self.assertThat(user_domains, matchers.HasLength(0))
