os_user_role: Include domain parameter in user lookup (#42913)

If a "domain" parameter is provided, use it in looking up the user ID.

Additionally, if both a domain and project parameter are provided, then
remove the domain ID from the list of filter criteria after having used
it to look up both the user and the project. OpenStack will not allow us
to apply both a project ID (which implies a domain) and a domain ID as a
search filter.

Fixes #42911

lib/ansible/modules/cloud/openstack/os_user_role.py

@@ -136,8 +136,17 @@ def main():
             module.fail_json(msg="Role %s is not valid" % role)
         filters['role'] = r['id']
 
+        if domain:
+            d = cloud.get_domain(domain)
+            if d is None:
+                module.fail_json(msg="Domain %s is not valid" % domain)
+            filters['domain'] = d['id']
         if user:
+            if domain:
+                u = cloud.get_user(user, domain_id=filters['domain'])
+            else:
                 u = cloud.get_user(user)
+
             if u is None:
                 module.fail_json(msg="User %s is not valid" % user)
             filters['user'] = u['id']
@@ -146,14 +155,14 @@ def main():
             if g is None:
                 module.fail_json(msg="Group %s is not valid" % group)
             filters['group'] = g['id']
-        if domain:
-            d = cloud.get_domain(domain)
-            if d is None:
-                module.fail_json(msg="Domain %s is not valid" % domain)
-            filters['domain'] = d['id']
         if project:
             if domain:
                 p = cloud.get_project(project, domain_id=filters['domain'])
+                # OpenStack won't allow us to use both a domain and project as
+                # filter. Once we identified the project (using the domain as
+                # a filter criteria), we need to remove the domain itself from
+                # the filters list.
+                filters.pop('domain')
             else:
                 p = cloud.get_project(project)