Add WWW-Authenticate header in 401 responses.

This review come from https://review.openstack.org/#/c/41707/, due to the
inactive in that.

Add the WWW-Authenticate in header when Keystone responds with 401 status
code. The format of the header is

WWW-Authenticate: Keystone uri="http://localhost:5000/"

as indicated in

http://docs.openstack.org/developer/keystone/middlewarearchitecture.html#exchanging-user-information .

Closes-Bug: #1153719
Change-Id: Iaa2291c66a9b126982b8aad0ddbfa9468dfc5d3e
Update mailmap for Joe Gordon

Update mailmap to reflect that I am committing from a new email address.

Change-Id: Id87601ce73ada6b6ac9763f381bdc28853818428
Fix issue deleting ec2-credentials as non-admin user

The ec2tokens controller incorrectly uses the access id, not the
hashed credential id in _assert_owner, which means that non-admin
users can't delete their ec2-credentials.  Adding the hashing, as
in _get_credentials fixes the problem.  Test added demonstrating
the issue.

Change-Id: Ifb6e3e10a50541cf21d25880bd74e9aeb6df4f26
Closes-Bug: #1245435
Enhance tests for assignment create_grant when no user or group

There were no tests that show the behavior of create_grant when
the user or group doesn't exist. Turns out the behavior is
different depending on the backend (sql vs kvs vs ldap).

Change-Id: I71c3e2b94aaa44e40c8a891b49cc2a9961cee16f
Related-Bug: #1239476
Fix KVS create_grant to not raise NotFound if no user/group

The KVS assigment backend would fail with NotFound if the user
or group didn't exist when calling create_grant while the SQL
assignment backend did not fail.

It's unreasonable to check if the user or group exists when
creating a grant, so the KVS assignment backend is changed to
not require the user or group to exist.

Closes-Bug: #1239476
Change-Id: I2d3b2fd82e7d4d33ac7158968d72cbfbe37528dc
Dependency cleanup

Clean up dependency usage.

a) If the class uses a dependency directly, make sure it's
included (getting from superclass isn't enough)

b) If the class doesn't use a dependency directly, make
sure it's NOT included (being a superclass isn't excuse)

Change-Id: Ifbd489f349ec019a41093a2814664e6d8c9f0069
don't rebind stdlib's os.chdir function

Change-Id: I07d5e8c58007cf716eecb922afb67abe3b53b981
Skip test_create_update_delete_unicode_project in _ldap_livetest

Live LDAP tests fail because this test doesn't work.

This failure occures on the same reason as it was with
test_create_unicode_user_name
(Ic01aa505d867c1de30e2a1ed7c79ff1478e213ef)

Related bug: 1172106

Change-Id: I0422d14c937030c39a17776e7d321bd629d50b31
Duplicate delete the user_project_metadata.

When assignment backend is sql,duplicate delete the user_project_metadata
filter with project_id when delete project.No need to do this.

This patch fix the bug.

Change-Id: Ic90798737b3f7f4418ce6ffbf1d9c945449798ca
Closes-Bug: #1248037
fix unparseable JSON

- use only double quotes
- remove trailing commas for last element
- add trailing newline

Change-Id: I3f47a25cdac429d95319ca80c6622b9cb1460446
Closes-Bug: #1249117
UserAuthInfo use dependency injection

UserAuthInfo didn't use dependency injection so the managers were
created multiple times.

The dependency injection doesn't happen until after __init__(),
so users can't call methods using the dependencies in __init__().

Change-Id: I3d649ec45d5d7ade740277334c32d9f76140fb34
Sync log module from oslo

This patch sync latest log module from oslo, bases on oslo-incubator
commit f06276bbdabd408549ecefa377b1349b57f5ac82.

DocImpact: Deprecate option log_config in favor of log_config_append.
Change option default_log_levels's default value.

Change-Id: Id2f7cf245499394554f6aa2c8d846cc9e2c2133a
Return an error when a non-existing tenant is added to a user

Currently, if a user is created without a tenantId, adding a
non-existing tenantId to that user succeeds.  This change
checks for whether the tenant exists in cases where the check
was previously skipped.

Closes-Bug: #1246473

Change-Id: I2a814c5df902a97297ad05950ae4205664ddf6e6
Fix newly discovered H302

Updating requirements failed because it now catches an import
of a non-module.

Change-Id: I7a56eaeefc695956c5ae57498a6a30c07f292d21
trusts raise validation error if expires_at is invalid

Raise an appropriate error when the evaluation of expires_at
fails, otherwise invalid user input results in a 500 response

Change-Id: Ibe5b2c5aaed5996e36a680dead85450e3eb9df31
Closes-Bug: #1246831
Add WSGI environment to context

The environment dictionary contains an unspecified set of variables
that contain information about the authentication and authorization
processes.  Not all of the values are known ahead of time.  The
two values for Kerberos (REMOTE_USER, AUTH_TYPE) are a subset.

Instead of making the WSGI layer know about a growing superset of
authentication attributes, the context contains a link to the wsgi
environment.  The environment is removed from the request dictionary
to prevent circular references and potential GC issues.

Fixed tests  to set environment in the context.  While this
changed many tests, the alternative was to make the check
for the environment optional in the controllers.  This is not a
realistic way to test.  If context['environment'] it missing, a test
will trigger a key_error.

Closes-Bug: #1241812

Change-Id: I234677547204e9ddc0ab33db3e6aa8b7d959a01a
Merge "Fix newly discovered H302"
Merge "Add WSGI environment to context"
Removes unused paste appserver instances from tests

Paste application servers were being created and never actually used.
The only thing that was used was the side effect of setting the public
and admin ports. This reduces the overall process footprint.

Change-Id: I8d5753cbc0970678baed7a873280bac06faa9a53
Partial-Bug: #1247443
Updated from global requirements

Change-Id: Ica7315effe308bd739e90f885849fac27a3c542b