Move CA key from certs directory to private directory

Unlike certs which are public keys are private. The CA key file was
improperly located in the certs directory with the public certs. It's
vital to protect the CA key, it's one of the most security sensitive
files in the system. We already had a private directory for keys,
/etc/keystone/ssl/private where the signing key is located. This fix
moves the CA key into /etc/keystone/ssl/private from
/etc/keystone/ssl/certs.

We also update all relevant files to note the change. During so it was
observered etc/keystone.conf.sample used the wrong parent directory
/etc/keystone/pki, the directory /etc/keystone/ssl is the directory in
actual use.

Fixes: bug #1206254

Change-Id: I014e9f79093a6aa59cd5b3bb6cefa4c6dced67a6
Fixes broken doc references

The references in configuringservices.rst did not resolve to
html addresses and were not referenced correctly in the browser.
This new fix will use the preferred way to cross reference documents.
Has the disadvantage that if the reference changes, it need to be
updated at severeal places in the document.

Change-Id: I3b8f71a95e66266b569aa1141985e47f1f4554c3
Closes-Bug: 1232878
remove the nova dependency in the ec2_token middleware

Change-Id: I34812522b55e38d3ea030638bbae75d65f507c90
Closes-Bug: #1178740
Use abstract base class for catalog driver

Use the abc module for managing abstract base classes in the driver
layer and add missing methods to concrete classes.

bp abstract-base-class-drivers

Change-Id: If66b9bd3ebcfc3a59151b52a46407a36d2a9352b
Use abstract base class for auth handler

Use the abc module for managing abstract base classes in the driver
layer.

bp abstract-base-class-drivers

Change-Id: I302a9bf0ac3aea2a2f687e0ceda7e107c0c11539
Adds more uniformity to identity update_user calls

 * It was not possible to change a user's name using the KVS driver.
 * The KVS driver was not filtering the user dict before handing it
   back to that caller.
 * Adds a test to the LDAP driver to explicitly show that changing a
   user's name is not allowed.

Related-Bug: #1214686
Change-Id: Ia0951a58ef09833849d3eb5e714c7efbd901f5c5
Fixes error messaging

guang-yee mentioned these changes in the original review:
  https://review.openstack.org/49272

Change-Id: I044f54813a35c131b907ea37fb32ecb8c802a711
Changes to testr as the test runner

run_tests.sh has also been deprecated.

Fixes-Bug: #1177924
Change-Id: I15c1707eb6a62c74a0021a48b89ae15f03fcfea8
Add python-six to requirements

missing python-six minimum version from the requirements.txt
set the min version to 1.4.1, without six recent versions of
keystone fail to start with a critical 'module' object has no
attribute 'add_metaclass' error

Change-Id: Ibfe2c9ec2457d3131dc9b6760e343c36ab8a3c38
Closes-Bug: #1237089
add IRC channel & wiki link to README

Change-Id: I03404978af83784e9ffe35319410eb59559c9630
Merge "Use abstract base class for catalog driver"
Merge "Adds more uniformity to identity update_user calls"
Merge "Fixes broken doc references"
Merge "remove the nova dependency in the ec2_token middleware"
Merge "Use abstract base class for auth handler"
Add notifications for groups and roles

Currently, we only issue notifications for projects, users and
domains. This patch will add support to issue notifications for
groups and roles. Notifications will be sent on create, update
and delete.

I've also updated tests to include tests for projects and users.

DocImpact
Change-Id: I23eac9afb2a227e5739dc25395705597a92eb23c
fixes: bug 1231220
Merge "Fixes error messaging"
Merge "Add notifications for groups and roles"
Merge "Changes to testr as the test runner"
Merge "Move CA key from certs directory to private directory"