Base.get_engine honor allow_global_engine=False

This change makes it so that get_engine() in
keystone.common.sql.core.Base does not return the global engine
when allow_global_engine is False.

The behavior before could be described like:
If get_engine() has never been called with allow_global_engine=True,
then if you pass allow_global_engine=False returns a new engine.
Otherwise, you always get the global engine (even if
allow_global_engine=False)

The new behavior is:
If get_engine() is called with allow_global_engine=True then
it returns the global engine, otherwise it returns a new engine.

Change-Id: I756b54d9f3984733f56d09c11b2702c3451102f2
Pass on arguments on Base.get_session

This change makes it so that the arguments for the session
creation function get_session() get passed on when it calls the
function to create the session.

Change-Id: I2f889ab36bd3aa3bf4441a13eb2b610b54349cbb
Fix token purging for memcache for user token index.

When issuing a new token, purge all expired tokens from the user's
token index list.

New Options:
* max_compare_and_set_retry:
        The number of retries that will be attempted when performing
        an update of the user_record or the revocation-list record.
        This is relevant due to the use of CAS (compare and set)
        function of the memcache client. This allows for multiple
        keystone processes/wsgi/etc to run without worry of race
        conditions clobbering the lists.

DocImpact - New Options.

Change-Id: I9441105b1e46982b0354bccbf8297daaaa1904b2
Fixes: bug #1171985
Remove how to contribute section in favor of CONTRIBUTING.rst

Change-Id: I5364d9d930ca0871bd839917b23ef3199eff3340
Allow request headers access in app context.

- Give extensions access to request headers in app context.
- Implements: blueprint allow-access-to-headers-for-extension.

Change-Id: I22bba172a8ceaba9260487666172586c45aa95d4
Correct the default name attribute for role

Fixes bug1172801

Change-Id: Id2cdc5775bd1b6da03da1e50e84cfe60ada00314
drop user and group constraints

Drop foreign keys that point to user and group tables from
other tables. This is required to be able to split up the backends.

Blueprint extract-projects-from-id

Change-Id: Iea78ddca4ef5ea5ca1bb542cba81da8aefa95b6b
Adds tests for XML version response

Adds tests for the version response when use
 Accept: application/xml

To share code, moved assertEqualXML from test_serializer
to keystone.test.

Change-Id: I92e28a9167d0c77fc7efbd1eda2893ec1128354f
Version response compatible with Folsom

This change adds <link> elements to the <version id="v2.0">
element in the version response to be compatible with the
response given by the Keystone server in the Folsom release.

Fixes bug 1187101

Change-Id: Ida71e2dbe3cf432d429fb739e68a83d7e009ca40
Remove explicit distribute depend.

Causes issues with the recent re-merge with setuptools. Advice from
upstream is to stop doing explicit depends.

Change-Id: I5acb02230226d9842b8524d03f97857863f32932
python WebOb dependency made unpinned.

keystone declares python-webob dependency as ==,
which is not a good way of defining dependency.
So to support latest dependencies, WebOb is unpinned in
requirements.txt

Fixes: bug #1180033
Change-Id: I73042cf88baf378c8564abb2394963866082977e
Fix link typo in Sphinx doc

Change-Id: I00667ca171d1be5acdacb472561cbf74baf6a852
Add checks to test if enabled is bool

  fixes: bug #1167593

Change-Id: Ie18fa17f16383f31d8aa083e69fa501d80eb4553
LDAP get_project_users should not return password

Also with this fix no need to skip get_project_users for LDAP.

Fixes bug1190286

Change-Id: I6ab6b4179c36d49b8a2eab1ea67ce0d6339751f5
Initialize logging from HTTPD.

Fixes bug 1190324

Change-Id: I6031c26c4917bd526c5918d815bff3bd060301c8
Force simple Bind for authentication

The authentication code was using a common code path with
other LDAP code that got an LDAP connection.  If the system
was configured to do Anonymous binding, users could by pass
the authentication check.

This patch forces the authentication code to do a simple_bind.

Change-Id: Id0c19f09d615446927db1ba074561b129329b5c8
Correct LDAP configuration doc

Correct the wrong naming used for domain controller in the configuration doc.

Fixes Bug1190647

Change-Id: I10b138f319b309db7c2747920ab5bd9e727a4557
Using sql as default driver for tokens

kvs driver for tokens is not a production quality storage method.
The shortcomings of using kvs as storage driver for tokens:
    1. It requires load balancer to persist connections to a single
keystone server by token.
    2. The memory will grow out of control until token_flush is run.
    3. At some point kvs lookups get very slow because there are millions
of keys in the dict.
    4. Process restart invalidates all tokens.

Fixes: bug #1188370
Change-Id: Ic726e12d798b843412158a7b92f5e3e3a654811f
Remove a stat warning log

If using load balancer before keystone and the port numbers was
different between load balancer and keystone, too many stat warning logs
could be found in logs. The root cause is the keystone servers' stat
logic getting the request host information which point to load balancer
ip address and port rather than the ips and ports of themselves.

Fixes bug #1189118
Change-Id: Ic837af77bc2509086c0e37194ba70b683f693ae5
Correct the resolving api logic in stat middleware

If the admin_port string is a substring of public_port string, all the
requests would be stated as 'admin' either their real dest port is
admin_port or public_port. It's due to the incorrect logic in stat
middleware.
For example, if public_port = 35000, admin_port = 5000, the first
judgement branch: "if str(CONF.admin_port) in host" in
StatsMiddleware::_resolve_api() would always return "True" either the
host port number equal to 5000 or 35000, so that the following judgement
branches would be incorrectly ignored.

Fixes bug #1189121
Change-Id: I1086b7d11f83dd218d66376f79747a1f720eb807