def _is_name_allowed_in_acl(self, req, path_parts, identity):
        if not self.allow_names_in_acls:
            return False
        user_domain_id = identity['user_domain'][0]
        if user_domain_id and user_domain_id != self.default_domain_id:
            return False

        proj_domain_id = identity['project_domain'][0]
        if proj_domain_id and proj_domain_id != self.default_domain_id:
            return False

        # request user and scoped project are both in default domain
        tenant_id, tenant_name = identity['tenant']
        version, account, container, obj = path_parts
        if self._account_matches_tenant(account, tenant_id):
            # account == scoped project, so account is also in default domain
            allow = True
        else:
            # retrieve account project domain id from account sysmeta
            exists, acc_domain_id = self._get_project_domain_id(req.environ)
            allow = exists or acc_domain_id in [self.default_domain_id, None]
        if allow:
            self.logger.debug("Names allowed in acls.")
        return allow
dataset/ETHPy150Open openstack/swift/swift/common/middleware/keystoneauth.py/KeystoneAuth._is_name_allowed_in_acl/operator `and` -> `or`