Move coverage output dir for Jenkins.

* tox.ini: Set the coverage html output dir to {toxinidir}/cover so that
Jenkins can find it and upload the coverage to the log server.

Change-Id: I231485ce46b1ef91eb219e63552203b86d6d65c2
Fix token purging for memcache for user token index.

When issuing a new token, purge all expired tokens from the user's
token index list.

New Options:
* max_compare_and_set_retry:
        The number of retries that will be attempted when performing
        an update of the user_record or the revocation-list record.
        This is relevant due to the use of CAS (compare and set)
        function of the memcache client. This allows for multiple
        keystone processes/wsgi/etc to run without worry of race
        conditions clobbering the lists.

DocImpact - New Options.

Change-Id: I9441105b1e46982b0354bccbf8297daaaa1904b2
Fixes: bug #1171985
Remove how to contribute section in favor of CONTRIBUTING.rst

Change-Id: I5364d9d930ca0871bd839917b23ef3199eff3340
Allow request headers access in app context.

- Give extensions access to request headers in app context.
- Implements: blueprint allow-access-to-headers-for-extension.

Change-Id: I22bba172a8ceaba9260487666172586c45aa95d4
Correct the default name attribute for role

Fixes bug1172801

Change-Id: Id2cdc5775bd1b6da03da1e50e84cfe60ada00314
drop user and group constraints

Drop foreign keys that point to user and group tables from
other tables. This is required to be able to split up the backends.

Blueprint extract-projects-from-id

Change-Id: Iea78ddca4ef5ea5ca1bb542cba81da8aefa95b6b
Replace openstack-common with oslo in docs

Change-Id: Id4a8f285b380478705e5518440b7ed602e7757d4
Adds tests for XML version response

Adds tests for the version response when use
 Accept: application/xml

To share code, moved assertEqualXML from test_serializer
to keystone.test.

Change-Id: I92e28a9167d0c77fc7efbd1eda2893ec1128354f
Merge "Move coverage output dir for Jenkins."
Merge "Replace openstack-common with oslo in docs"
Add checks to test if enabled is bool

  fixes: bug #1167593

Change-Id: Ie18fa17f16383f31d8aa083e69fa501d80eb4553
LDAP get_project_users should not return password

Also with this fix no need to skip get_project_users for LDAP.

Fixes bug1190286

Change-Id: I6ab6b4179c36d49b8a2eab1ea67ce0d6339751f5
Force simple Bind for authentication

The authentication code was using a common code path with
other LDAP code that got an LDAP connection.  If the system
was configured to do Anonymous binding, users could by pass
the authentication check.

This patch forces the authentication code to do a simple_bind.

Change-Id: Id0c19f09d615446927db1ba074561b129329b5c8
Correct LDAP configuration doc

Correct the wrong naming used for domain controller in the configuration doc.

Fixes Bug1190647

Change-Id: I10b138f319b309db7c2747920ab5bd9e727a4557
Using sql as default driver for tokens

kvs driver for tokens is not a production quality storage method.
The shortcomings of using kvs as storage driver for tokens:
    1. It requires load balancer to persist connections to a single
keystone server by token.
    2. The memory will grow out of control until token_flush is run.
    3. At some point kvs lookups get very slow because there are millions
of keys in the dict.
    4. Process restart invalidates all tokens.

Fixes: bug #1188370
Change-Id: Ic726e12d798b843412158a7b92f5e3e3a654811f
Remove a stat warning log

If using load balancer before keystone and the port numbers was
different between load balancer and keystone, too many stat warning logs
could be found in logs. The root cause is the keystone servers' stat
logic getting the request host information which point to load balancer
ip address and port rather than the ips and ports of themselves.

Fixes bug #1189118
Change-Id: Ic837af77bc2509086c0e37194ba70b683f693ae5
Correct the resolving api logic in stat middleware

If the admin_port string is a substring of public_port string, all the
requests would be stated as 'admin' either their real dest port is
admin_port or public_port. It's due to the incorrect logic in stat
middleware.
For example, if public_port = 35000, admin_port = 5000, the first
judgement branch: "if str(CONF.admin_port) in host" in
StatsMiddleware::_resolve_api() would always return "True" either the
host port number equal to 5000 or 35000, so that the following judgement
branches would be incorrectly ignored.

Fixes bug #1189121
Change-Id: I1086b7d11f83dd218d66376f79747a1f720eb807
Merge "drop user and group constraints"
Merge "Allow request headers access in app context."
Merge "Fix token purging for memcache for user token index."