'Ensure the provided user owns the credential.
:param user_id: expected credential owner
:param credential_id: id of credential object
:raises keystone.exception.Forbidden: on failure'

def _assert_owner(self, user_id, credential_id):

    ec2_credential_id = utils.hash_access_key(credential_id)
    cred_ref = self.credential_api.get_credential(ec2_credential_id)
    if (user_id != cred_ref['user_id']):
        raise exception.Forbidden(_('Credential    belongs    to    another    user'))
