'Ensure the current domain ID matches the reference one, if any.
Provided we want domain IDs to be immutable, check whether any
domain_id specified in the ref dictionary matches the existing
domain_id for this entity.
:param new_ref: the dictionary of new values proposed for this entity
:param orig_ref: the dictionary of original values proposed for this
entity
:raises: :class:`keystone.exception.ValidationError`'

def _require_matching_domain_id(self, new_ref, orig_ref):

    if ('domain_id' in new_ref):
        if (new_ref['domain_id'] != orig_ref['domain_id']):
            raise exception.ValidationError(_('Cannot    change    Domain    ID'))
