Fix role lookup for Active Directory

When using Keystone against an Active Directory server, assigned
roles weren't found for users.

When roles are added as DNs in the roleOccupant attribute, an LDAP
server can normalize the value so that when the entry is read later
the roleOccupant isn't exactly the same as it was when added.
Keystone should compare users by ID rather than by DN.
(Note that this is how the comparison is done in Grizzly.)

Keystone's fake LDAP is changed to muck with roleOccupant and
member DNs by uppercasing attribute names (like Active Directory).
The code is fixed to compare users by ID rather than DN.

Change-Id: Iaa41c3ef9febcabef0662f38b13d319a5b5583bc
Resolves-Bug: #1210675
Add 'cn' to attribute_list for enabled_users/tenants query

Fixes Bug: 1217447

Change-Id: I712b2fccc08d48487515491684ef8e6c9a91ee0a
Removes KVS references from the documentation

KVS backends are deprecated and removing references to them from the
documentation will discourage their use.

Change-Id: Iad2f9c39f9d92465ada5ecb6001cfc2b225cc01f
Related-Bug: #986980
Bump hacking to 0.7

Fixed H102 errors

Hacking 0.6 already pins down pep8, pyflakes and flake8 so they can be
removed from test-requirements as they are indirect dependencies.

Co-author: Joe Gordon <joe.gordon0@gmail.com>

Change-Id: If7e79c70fe44d7e42a14cd6c710fd9986f995446
Use testtools as base test class.

Minor tests refactoring due to use testtools:
 - added missed setUp() and tearDown() to call these functions in
   base test case.
 - removed some superfluous tearDown() calls.
 - moved test_crud_inherited_role_grants_failed_if_disabled() method
   to separate class.

Fixes for python 2.6 enviroment:
 - replaced `with self.assertRaises(Exception): foo()` to
   `self.assertRaises(Exception, foo)
 - added to safe_repr(), assertDictEqual() and assertRaisesRegexp() methods
   to TestCase() class in keystone/test.py

Fixes bug 1179009

Change-Id: Iea67ad10d02db82fc8ed79b1096ddb5233925bfd
Add common code from Oslo for work with database

Moved common code for work with database from Oslo.
It contains work around session, SQLAchemy engines, wrappers, etc.

blueprint use-common-oslo-db-code

Change-Id: Icac2ac963b3f3b8364f19c64c1189c3aadef9bf4
Use common db model class from Oslo

Modified DictBase class - added common `models.ModelBase` class as
base class instead of object and removed duplicated code.
Added new oslo.config version to requirements.

blueprint use-common-oslo-db-code

Change-Id: Ib1b8883d878a1c95d04dfab05bfe87ce37d0d6cb
Merge "Removes KVS references from the documentation"
Implement decorator-based notifications for users

Refactors the keystone.notifications module to use decorators, and
applies those new decorators to user CRUD operations at the manager
layer.

blueprint notifications

Change-Id: Ic7937657196a0ad19923153a5135b1451a533e81
Enable SQL tests for oauth

Enables testing of the SQL backend for oauth.
As a result of running the tests, I noticed that this also
fixes an update_consumer test cases too.

fixes bug: #1215483
fixes bug: #1216447

Change-Id: I206d164caa66c3211cfc216d13e3d0bab0e7d54a
Merge "Implement decorator-based notifications for users"
Add Memory Isolating Cache Proxy

Created a specialized dogpile.cache proxy to isolate in-memory data in the
cache region from modificaiton during tests using liberal application of
copy.deepcopy for get/set operations.

partial-blueprint: caching-layer-for-driver-calls
Change-Id: Id6d27219b75ea7e6709d220542dd31c4a6c7aa04
Add project CRUD to assignment_api Manager

Specifically, the "proxy" methods on identity_api for following methods
are removed in favor of assignment_api:

- create_project
- update_project
- delete_project

The majority of this change is a refactor in support of the incomplete
work done for bp split-identity in
https://review.openstack.org/#/c/33745/

Notification decorators are also added to these 3 methods in support of
bp notifications and bug 967832.

Change-Id: I81b4eca720615b38a38858aecd734af8ab383d91
Use joins instead of multiple lookups in groups sql

Currently to determine a user's groups (or vice versa) we do
- 1 lookup for the user.
- 1 lookup for the association table.
- n lookups for the n groups the user has.

The association and groups lookup are replaced with a join query.

Fixes: bug 1218675
Change-Id: I560659eda1a30635399829e1c86f06734c90f9e2
Merge "Add Memory Isolating Cache Proxy"
Merge "Add project CRUD to assignment_api Manager"
Merge "Enable SQL tests for oauth"
Merge "Add 'cn' to attribute_list for enabled_users/tenants query"
Merge "Fix role lookup for Active Directory"
Remove kvs backend from oauth1 extension

Suggest removing this backend, it's not production worthy.

Change-Id: I9b259fa553d8e5b94c0eb36bb5d1dc5b33508486