Move auth_token middleware from admin user to an RBAC policy

Before this patch auth_token middleware required admin user credentials
stored in assorted config files. With this patch only non-admin user
credentials are needed. The revocation_list and validate_token commands
use an policy.json rule, to only allow these commands if you are in have the
service role.

Rule used:
    "service_role": [["role:service"]],
    "service_or_admin": [["rule:admin_required"], ["rule:service_role"]],

Added the policy wrapper on the validate functions.

Fixes bug 1153789

Change-Id: I43986e26b16aa5213ad2536a0d07d942bf3dbbbb
Add missing space to error msg

Change-Id: I782045e4ec58a4ff69be70256e57ab474243113d
Test 403 error title

Change-Id: I0e2079e485e6e668186cb477027573d9b0adb161
   Rename requires files to standard names.

    Rename tools/pip-requires to requirements.txt and tools/test-requires
    to test-requirements.txt. These are standard files, and tools in the
    general world are growing intelligence about them.

Fixes: bug #1179008
Change-Id: I1a19f0c73ab48987e2ff0dade1a57a68b65f0a22
Convert openstack-common.conf to the nicer multiline format.

No functional changes.

Change-Id: If197e1f3b3c794e342aaf7d260c107ee04687f82
Add missing oslo module.

Policy was being used, and there was a copy in openstack.common,
but it didn't appear in the openstack-common.conf config file. Fix
that.

Resolves bug 1181893.

Change-Id: Ib62bec4fcfc6c04d8f53ef503b028c287c4d1c63
Require keystone-user/-group for pki_setup

If pki_setup is run as root, require the keystone-user
and keystone-group parameter to be set, to enforce
the proper permissions to be created on the files.

This follows a suggestion in the Bugreport.

Fixes LP Bug #1031372

Change-Id: I00d9e0499d16716af3267914b6b78841f1ad1e0f
fix error default policy for create_project

change `admin_or_owner` to `admin_required`

bug #1188457

Change-Id: I26b1617eadf12fcf1572bb382f4cdfbcbb275cc4
Add <version> arg to keystone-manage db_sync

This optional <version> argument allows a client of db_sync to indicate to
which database version to upgrade or downgrade.

Change-Id: I3ccf45eb572a3897e5d3bc5bd17566493a55f393
Add KEYSTONE_LOCALEDIR env variable

Part of fixing bug #995287

Syncs these two commits from oslo-incubator:

  Support overriding oslo localedir too
  Add a gettextutils.install() helper function

to get a new gettextutils.install() function which allows the default
localedir to be overwritten via an environment variable.

A few things to note:

 - the gettext.install() call is moved from common.config to the
   toplevel scripts to fix cases (e.g. the legacy auth_token middleware)
   where keystone code might be imported by a program who's default
   translation domain is not 'keystone'.

 - we add a gettext.install() call in keystone.test so that tests have
   the _() builtin installed.

Change-Id: I86562b3a65d371673bb21f7179eecc7602bc0775
Add index on valid column of the SQL token Backend

Add migration script to add the index

Change-Id: I0d7e231b32040dfb57c2e8023a7f45d65416763c
Fixes: bug #1168399
Merge "Add missing space to error msg"
Document size limits

Change-Id: I4327593fc970bd977d9fb2c48ab9eafd5586f1d0
Fix the debug statement.

Fixes bug1185555

Change-Id: Ia3932bd4ca6cc786e9cc8bdac48f5313c915b228
Disable eventlet monkey-patching of DNS

This change avoids eventlet's monkey-patching of DNS resolution.
eventlet's doesn't support IPv6, for example.

The way to avoid eventlet's DNS is to set an environment
variable. The trick is the environment variable needs to be set
before eventlet is imported.

A similar change was made in nova, so this is just copying that
code and technique to Keystone.

This allows re-enabling the IPv6 tests, too.

Change-Id: I1e4d4bbfea374d386796d1505a602fd187e75c67
Revert "Set EVENTLET_NO_GREENDNS=yes in tox.ini."

We don't need this since EVENTLET_NO_GREENDNS=yes is set in
keystone.common.wsgi_server .

This reverts commit 46b224abf1c6f7c9bd579806f202a019e2695b29.

Change-Id: I96c2c567f68cdd509425245c7772196918b44b44
Merge "Move auth_token middleware from admin user to an RBAC policy"
Improve the performance of tokens deletion for user

Provide new delete the tokens api 'delete_tokens' to support
delete all the tokens for user in one session in the sql backend. For
the kvs and memcache, I also provide the corresponding implementation.

Fix bug 1178063

Change-Id: I986a583e5900ea04e26cbdb7c49638a33818bca7
Imported Translations from Transifex

Change-Id: Icfaf58f9c2b503f3c664dc67c512de2b96ebb3ee
Fixes a typo

Change-Id: Ie5c5fd482312e44b4253076e9d8ebfe75abed378