Move CA key from certs directory to private directory

Unlike certs which are public keys are private. The CA key file was
improperly located in the certs directory with the public certs. It's
vital to protect the CA key, it's one of the most security sensitive
files in the system. We already had a private directory for keys,
/etc/keystone/ssl/private where the signing key is located. This fix
moves the CA key into /etc/keystone/ssl/private from
/etc/keystone/ssl/certs.

We also update all relevant files to note the change. During so it was
observered etc/keystone.conf.sample used the wrong parent directory
/etc/keystone/pki, the directory /etc/keystone/ssl is the directory in
actual use.

Fixes: bug #1206254

Change-Id: I014e9f79093a6aa59cd5b3bb6cefa4c6dced67a6
Fixes broken doc references

The references in configuringservices.rst did not resolve to
html addresses and were not referenced correctly in the browser.
This new fix will use the preferred way to cross reference documents.
Has the disadvantage that if the reference changes, it need to be
updated at severeal places in the document.

Change-Id: I3b8f71a95e66266b569aa1141985e47f1f4554c3
Closes-Bug: 1232878
Catch the socket exception and log it.

Closes-Bug: #1186394
Change-Id: I8aefe54deaa44427c6bb92cf439545e94902fb52
remove the nova dependency in the ec2_token middleware

Change-Id: I34812522b55e38d3ea030638bbae75d65f507c90
Closes-Bug: #1178740
Use abstract base class for identity driver

Use the abc module for managing abstract base classes in the driver
layer.

bp abstract-base-class-drivers

Change-Id: Ifc3b7c158a3a26ca0295e5e133d0108a357b1e37
Use abstract base class for trust driver

Use the abc module for managing abstract base classes in the driver
layer.

bp abstract-base-class-drivers

Change-Id: I84fa24bf636e13d39544c2a811f92f62c538b100
Use abstract base class for assignment driver

Use the abc module for managing abstract base classes in the driver
layer and add missing methods to concrete classes.

bp abstract-base-class-drivers

Change-Id: I91b20ff2f7fd591ea51da619a76044907a7f0c76
Use abstract base class for credential driver

Use the abc module for managing abstract base classes in the driver
layer.

bp abstract-base-class-drivers

Change-Id: Iae65d406bdb65f5ae0fc08f0c1d4b48890eca889
Use abstract base class for catalog driver

Use the abc module for managing abstract base classes in the driver
layer and add missing methods to concrete classes.

bp abstract-base-class-drivers

Change-Id: If66b9bd3ebcfc3a59151b52a46407a36d2a9352b
Use abstract base class for auth handler

Use the abc module for managing abstract base classes in the driver
layer.

bp abstract-base-class-drivers

Change-Id: I302a9bf0ac3aea2a2f687e0ceda7e107c0c11539
Adds more uniformity to identity update_user calls

 * It was not possible to change a user's name using the KVS driver.
 * The KVS driver was not filtering the user dict before handing it
   back to that caller.
 * Adds a test to the LDAP driver to explicitly show that changing a
   user's name is not allowed.

Related-Bug: #1214686
Change-Id: Ia0951a58ef09833849d3eb5e714c7efbd901f5c5
Treats OS-KSADM:password as password in v2 APIs

The OS-KSADM Extension documentation uses OS-KSADM:password
instead of password in some of its examples.  This makes
those examples work.

Change-Id: Ibdfab0b9f085548a86eb391e7dc3b279dfc7b420
Fixes-Bug: #1226466
Adds identity v2 tests to show extra behavior

The v2 API uses name instead of username for the user entity.  This will
change soon to match the spec.  Theses tests will ensure the existing
behavior isn't broken.

Change-Id: Ic6830976f246f707c8b7ef8e92a1697d19fdfe67
Related-Bug: #1214686
Adds tests for user extra attribute behavior

Extra attributes (not directly defined on the model) are stashed away
in a JSON blob.  When returning a user entity they are pulled from the
blob and added directly to the entity.

Change-Id: Ic85b692dda2530efa2ef9833a8a8eed0b12bc7fb
Related-Bug: #1214686
Remove unused member

keystone.assignment.backends.ldap:Assignment._identity_api was not
used, so remove it.

Change-Id: If4dc5a47c87e9aaf97e3db20a9b813ba32754bea
Remove unused config option auth_admin_prefix

The auth_admin_prefix was registered but never used. This change
removes it.

Change-Id: I22dd8454f10b79c57819e64bf0a274ce25b66d18
Remove unused DEFAULT_DOMAIN variable

The keystone.identity.backends.ldap.DEFAULT_DOMAIN
variable wasn't used.

The keystone.assignment.backends.ldap.DEFAULT_DOMAIN
was used, but should not have been, because we've
got a keystone.assignment.core.DEFAULT_DOMAIN.

Change-Id: I0f4bb0bd953a9ced8c3dfc46ea44ff0e377db082
set user_update policy to admin_required

This changes the default policy.json to prevent users from changing
their own attributes such as password, name, or default_project_id.

Closes-Bug: 1237989
Change-Id: I7de5fff3d72a76b78113e289c57a9fac2096395f
Handle unicode at the caching layer more elegantly

This patchset resolves an issue where in some cases unicode would
cause the cache key generator to raise a UnicodeEncodeError due to
the name/value being outside of the standard ascii character set.
Included is a fix to the cache backend debug code to utilize repr
for passing the keys/values to the logger.

Tests in test_backend provided by chenxiao <chenxiao@cn.ibm.com>

Closes-bug: 1237892
Change-Id: I4df1c9eb6b4a1367defdbb6bcbcd1f1f992348e5
Fixes error messaging

guang-yee mentioned these changes in the original review:
  https://review.openstack.org/49272

Change-Id: I044f54813a35c131b907ea37fb32ecb8c802a711