Remove obsolete *page[_marker] methods from LDAP backend.

Change-Id: I87a75c9f1cd3f6cb3f233df6e54125f35ae4631c
keystone : Use Ec2Signer utility class from keystoneclient

The Ec2Signer class has been moved to python-keystoneclient,
so we can remove the internal implementation and import the
keystoneclient version

blueprint ec2signer-to-keystoneclient

Change-Id: I19d8575ab8b972467ce280a6197ae762da1ce790
Unpin pam dependency version

Fixes bug #1133240

keystone has always pinned the pam dependency to 0.1.4

  pam>=0.1.4

this version was released in November 2009 and there hasn't been a
release since. I can't even find a version control repo for the
project.

There's no particular reason to expect a future version would break us
and, indeed, we want to find out about it if it happens.

Change-Id: I2becf47c9d2566e2c3496ae15ca886b737006a92
Straighten out NotFound raising in LDAP backend.

Change-Id: If5914f34da318d960f5a2ae8e8b0592d1cbab946
Sync timeutils with oslo

Necessary for the microsecond precision changes

Change-Id: I2571af24b338a5245bc62944a891ed889cf30d4d
Merge "Unpin pam dependency version"
bug 1134802: fix inconsistent format for expires_at and issued_at

Notice we have to use fraction of second precision to prevent PKI token ID
overlap.

Change-Id: Icfc192c08ab5b4db02547ef6f077fa7f32210835
Trusts

Blueprint trusts

creates a trust.  Using a trust, one user (the trustee), can then
create tokens with a subset of another user's (the trustor) roles and
projects.
If the impersonate flag in the trust is set, the token user_id is set
to the trustor's user ID
If the impersonate flag is not set, the token's user_is is set to the
trustee's user ID

check that both trustor and trustee are enabled prior to creating
the trust token.

sql and kvs backends
sql upgrade scripts
unit tests for backends, auth and v3 api
modifications to the trust controller for creating tokens
Authenticates that only user can be trustor in create
Deleting a trust invalidates all tokens created from that trust
Adds the trust id and the id of the trustee to the header of the token
policy rules for trust

This version has a workaround for testing against the KVS version
of the Service catalog

Change-Id: I5745f4d9a4180b59671a143a55ed87019e98ec76
Expand v3 trust test coverage

Change-Id: Ie697e19c2fa0e4ac203ff24aa9efa23c25ea6ccd
Merge "Sync timeutils with oslo"
Merge "Remove obsolete *page[_marker] methods from LDAP backend."
Merge "bug 1134802: fix inconsistent format for expires_at and issued_at"
Merge "Trusts"
Merge "Expand v3 trust test coverage"
Merge "keystone : Use Ec2Signer utility class from keystoneclient"
ports should be ints in config (bug 1137696)

Change-Id: I26c0481f1f8987f310e3c3710be49d541418e3fd
remove unused import

Change-Id: I82f45c1dca4b96c43387640803a006ac2ab61689
Move auth plugins to 'keystone.auth.plugins' (bug 1136967)

Change-Id: I8c72ee99695b0c039a91f807a13a832ce2c3ff74
unable to load certificate should abort request

If openssl returns with a command line error (3), we assume
the PKI certificate is not properly installed.  Added
'try ... except' blocks to cms_sign_text and cms_sign_token
calls.

Fixes: bug #1103569
Change-Id: Iad98738e990d3ab1ec0d0015840d76cf948ae560
mark 2.0 API as stable

Bug 1135230

Change-Id: Icb0ae39b5ac4514c04220b846ebbe24d059ba6c1