LDAP list groups with missing member entry

Using the LDAP identity backend,
if a group member entry doesn't exist in the LDAP server anymore
and the group's members are listed using GET /v3/groups/{groupId}/users,
Keystone returns 404 Not Found.

The server should return all the group members that do exist
and ignore the missing members,
and probably log a warning message about the missing user.

Fixes bug 1174585

Change-Id: Idf7c8c7f87affc4a72c5fe5e18e09a0f362e2646
(cherry picked from commit 4eb8233d9c6b73cedf25ea66edaccbcd092e13aa)
Add rule for list_groups_for_user in policy.json

Providing an initial policy rule for the list_groups_for_user
operation in the sample policy.json file for the ease of
configuration.

Fixes bug #1167836

Change-Id: Id253729098a95d3b129babde1b3706f409a095dd
(cherry picked from commit 50073c5a0e00389518ee414e3ef1ef1f5db1676d)
Accept env variables to override default passwords

Preserves the default passwords corresponding to the OpenStack Install
and Deploy Manual while allowing environment variables to specify user
provided passwords. As well, a single common password for all the service
users can be specified using the SERVICE_PASSWORD environment variable.

This fix restores compatibility with the version of this script released
in Folsom where the environment variables could override default passwords.
It also preserves compatibility with the fix for bug 1073291 that brought
the script into line with the docs (but unfortunately broke backwards
compatibility).

There is no warning emited if the user does not override the default
passwords as was present in Folsom, but not in Grizzly. This makes the
fix output compatible with Grizzly only. Note that the logic for warnings
pre-Grizzly was unclear. The script is, however, clearly named "sample"
and warnings are present in the comments.

Change-Id: I927fcddf04dcb87e5c9252f0874939b17f3c4809
Fixes: bug #1166182
Merge "LDAP list groups with missing member entry" into stable/grizzly
Merge "Add rule for list_groups_for_user in policy.json" into stable/grizzly
Read-only default domain for LDAP (bug 1168726)

NOTE: this patch effectively *removes* a feature new in grizzly
(multi-domain support for LDAP) in favor of fixing our existing 99% use
case (proper read-only support for LDAP for a single domain).

A proper fix to the above was also blocked by bug 1117356, so that's
fixed here as well (updates properly return the resulting entities).

Change-Id: I672b90e67545cc1fe65b05ef7f8af5b42ca6afc3
remove_role_from_user_and_project affecting all users (bug 1170649)

Change-Id: I2333404991114e6985f3f2c4de4fb30dc3195b2d
Fix incorrect role assignment in migration.

In the case where a user has existing roles on a project running the
migration would assign those same roles to all the user's projects.

Change-Id: Ibd99bb7cf6cb84b577eca57f903abf9d48e908c1
Fixes: bug 1186128