Add support for API message localization

Add support for doing language resolution for a request, based on the
Accept-Language HTTP header.

Using the lazy gettext functionality from oslo gettextutils, it is
possible to use the resolved language to translate an exception message
to the user requested language and return that translation from the API.

Co-authored-by: Luis A. Garcia <luis@linux.vnet.ibm.com>
Co-authored-by: Mathew Odden <mrodden@us.ibm.com>

Implements bp user-locale-api

Change-Id: Id8e92a42039d2f0b01d5c2dada733d068b2bdfeb
Implement domain specific Identity backends

A common scenario in shared clouds will be that a cloud provider will
want to be able to offer larger customers the ability to interface to
their chosen identity provider. In the base case, this might well be
their own corporate LDAP/AD directory.  A cloud provider might also
want smaller customers to have their identity managed solely
within the OpenStack cloud, perhaps in a shared SQL database.

This patch allows domain specific backends for identity objects
(namely user and groups), which are specified by creation of a domain
configuration file for each domain that requires its own backend.

A side benefit of this change is that it clearly separates the
backends into those that are domain-aware and those that are not,
allowing, for example, the removal of domain validation from the
LDAP identity backend.

Implements bp multiple-ldap-servers

DocImpact

Change-Id: I489e8e50035f88eca4235908ae8b1a532645daab
Merge "Implement domain specific Identity backends"
More validation in test_user_enable_attribute_mask

Validate the enabled attribute returned by create_user, update_user.
Also, validate that the enabled attribute in the LDAP server is
set.

Change-Id: I78d194528ad4fd67fc35ca4d124f2e031d02d9cc
Related-Bug: #1210175
Fix LDAP Identity with non-zero user_enabled_default

The LDAP Identity backend was not properly using the
user_enabled_default option as a string. This caused
operations to fail with

 TypeError: unsupported operand type(s) for &: 'str' and 'int'

Partial-Bug: #1210175

Change-Id: I54931e669186871d18dea088870945b9de40d573
Fix LDAP Identity get user with user_enabled_mask

Fetching users using the LDAP Identity backend would fail with

 KeyError: 'enabled'

from _ldap_res_to_model when user_enabled_mask is not 0.

Change-Id: I39a9606ba7210f0fea064abd6adad379218b432b
Closes-Bug: #1210175
Add delegated_auth support for keystone

Implements an OAuth 1.0a service provider.

blueprint: delegated-auth-via-oauth

DocImpact
SecurityImpact

Change-Id: Ib5561593ab608f3b22fbcd7196e2171f95b735e8
Merge "Add delegated_auth support for keystone"
Merge "Add support for API message localization"