Fix the wrong infomation in keystone-manage.rst

Change-Id: I63d789b15361c74d11531646c30fd45f111e236c
Implementation of LDAP functions

implementations of delete_tenant, delete_user,
  remove_role_from_user_and_tenant, get_tenant_users
  role.delete_user and remove_role_from_user_and_tenant
  remove_user_from_tenant, change_ role

clean up LDAP sample data for live LDAP

properly check for existance of tenant_id in user.

Some tests expected the functions to be unimplemented.  Those hid the
failuers on the LDAP Identity provider and have been removed.

Make live tests extend the standard LDAP tests, so they test the same features.

Bug 1021315

Change-Id: I2866ff40fdc13040ba10d189ea2d95440eb4395c
Files for  Apache-HTTPD

files required for running Keystone in Apache-HTTPD and instructions to set it up

Change-Id: Ib3fdf873ea3816186e6bb63307028ba3aa2edaa9
Raise unauthorized if tenant disabled (bug 988920)

If the client attempts to explicitly authenticate against a disabled
tenant, keystone should return HTTP 401 Unauthorized.

Change-Id: I49fe56b6ef8d9f2fc6b9357472dae8964bb9cb9c
Debug output may include passwords (bug 1004114)

Change-Id: If0a7704ff578162d6b7fa8b68c0e0ed37e72cb73
Import ec2 credentials from old keystone db

Fix bug #1016056

Change-Id: Iebf31ccbdeff274b2c8f265911d3411963dd4844
Added user name validation. Fixes bug 966251.

1. Verified name length while creating/updating user.
2. Disallowed blank user name in create/update.
3. Added unit test coverage.

Change-Id: I55cd5daf34f4f57d4163be403a7a75c5d22baa62
Sync jsonutils from openstack-common

This makes keystone work with recent versions of anyjson.

Changes from openstack-common:

    commit ce3071437d1871f77c4d8573cbe5f4ea8c817650
    Author: Russell Bryant <rbryant@redhat.com>
    Date:   Mon Jul 16 10:30:25 2012 -0400

        Use strtime() in to_primitive() for datetime objs.

        This patch updates jsonutils.to_primitive() to use timeutils.strtime()
        to convert a datimetime object to a string instead of just using str().
        This ensures that we can easily convert the string back to a datetime
        using timeutils.parse_strtime().

        Required for the nova blueprint no-db-messaging.

        Change-Id: I725b333695930e12e2832378102514326fec639c

    commit 4c9d439ef24f5afdd74aa9153aa8fc772051e6cb
    Author: Tim Daly Jr <timjr@yahoo-inc.com>
    Date:   Tue Jun 26 02:48:42 2012 +0000

        Add 'filedecoder' method to the jsonutils wrapper module.

        Fixes bug #1017765

        After version 3.3.2, the anyjson library will throw a KeyError if
        filedecoder isn't present.  The filedecoder is just like the decoder
        except it takes a file instead of a string, like json.load() instead
        of json.loads().

        Change-Id: I7bd012a7b4afa9b1ec987c3e6393cc922b5dadff

Change-Id: Icfd5c39c322ed6e73148c7f5ae03f704a3aa160e
Merge "Debug output may include passwords (bug 1004114)"
Merge "Import ec2 credentials from old keystone db"
Merge "Fix the wrong infomation in keystone-manage.rst"
Merge "Sync jsonutils from openstack-common"
Merge "Files for  Apache-HTTPD"
Merge "Implementation of LDAP functions"
Merge "Raise unauthorized if tenant disabled (bug 988920)"
Cryptographically Signed tokens

Uses CMS to create tokens that can be verified without network calls.

Tokens encapsulate authorization information.
This includes user name and roles in JSON.
The JSON document info is cryptographically signed with a private key
from Keystone, in accordance with the Cryptographic Message Syntax (CMS)
in DER format and then Base64 encoded.  The header, footer, and line breaks
are stripped to minimize the size,  and slashes which are  invalid in Base64
are converted to hyphens.

Since signed tokens are not validated against the Keystone server,  they
continue to be valid until the expiration time.  This means that even if a user
has their roles revoked or their account disabled, those changes will not take
effect until their token times out.  The prototype for this is Kerberos, which
has the same limitation, and has funtioned sucessfully with it for decades.  It
is possible to set the token time out for much shorter than the default of 8
hours, but that may mean that users tokens will time out prior to completion
of long running tasks.

This should be a drop in replacement for the current token production code.
Although  the signed token is longer than the older format, the token is still
a unique stream of Alpha-Numeric characters.

The auth token middle_ware is capable of handling both uuid and signed tokens.

To start with, the PKI functionality is disabled.  This will keep from breaking
the existing deployments.  However,  it can be enabled with the config value:

[signing]
disable_pki = False

The 'id_hash' column is added to the SQL schema because SQL alchemy insists on
each table having a primary key.  However primary keys are limited to roughly
250 Characters (768 Bytes,  but there is more than 1 varchar per byte) so the
ID field cannot be used as the primary key anymore.  id_hash is a hash of the
id column, and should be used for lookups as it is indexed.

middleware/auth_token.py needs to stand alone in the other services, and uses
keystone.common.cms in order to verify tokens.
Token needs to have all of the data from the original authenticate code
contained in the signed document, as the authenticate RPC will no longer
be called in mand cases.

The datetime of expiry is signed in the token.

The certificates are accessible via web APIs.  On the remote service side,
certificates needed to authenitcate tokens are stored in /tmp/keystone-signing
by default.  Remote systems use Paste API to read configuration values.
Certificates are retrieved only if they are not on the local system.

When authenticating in Keystone systems, it still does the Database checks for
token presence.  This allows Keystone to continue to enforce Timeout and
disabled users.

The service catalog has been added to the  signed token.  Although this greatly
increases the size of the token,  it makes it consistant with what is fetched
during the token authenticate checks

This change also fixes time variations in expiry test.  Although unrelated to
the above changes, it was making testing very frustrating.

For the database Upgrade scripts, we now only  bring 'token' up to V1 in 001
script.  This makes it possible to use the same 002 script for both upgrade
and initializing a new database.

Upon upgrade, the current UUID tokens are retained in the id_hash and id fields.
The mechanisms to verify uuid tokens work the same as before.  On downgrade,
token_ids are dropped.

Takes into account changes for "Raise unauthorized if tenant disabled"

    Bug 1003962

Change-Id: I89b5aa609143bbe09a36bfaf64758c5306e86de7