Change the default LDAP mapping for description.

Change-Id: I361ec7fde2dde8b9a2091446d4d9f3b95d98f306
enabled attribute emulation support

Fixes bug 1063858
Implementation works as described in the second comment.

Change-Id: Ib0aa85f05244044c9f40fa9634b5ed3e8afa1f37
Correct SQL migration 017 column name

The user_project_membership still uses tenant_id and not project_id
as a column name, the migration code uses project_id for both tables.

Fixed bug 1130424

Change-Id: Id7c9f78235ad87103ecf469bea312e6291c0a327
Update oslo-config version.

Update the version of oslo-config in pip-requires.  This update includes
a fix for a bug that breaks oslo.config imports.

Change-Id: I2e31d3980c495b1fd16db5488c7d3c982ce069ac
v3 token API

Also implemented the following:

blueprint pluggable-identity-authentication-handlers
blueprint stop-ids-in-uris
blueprint multi-factor-authn (just the plumbing)

What's missing?

* domain scoping (will be implemented by Henry?)

Change-Id: I191c0b2cb3367b2a5f8a2dc674c284bb13ea97e3
Removed redundant assertion

Change-Id: Iba9f0a5bd713b21487471eb64ce931910b1ca912
Pass query filter attributes to policy engine

With the v3 api, there will be cases when a cloud provider will want
to be able to protect apis by matching items in the query filter
string.  A classic case would be:

GET /users?domain_id=mydomain

The change augments the v3 controller protection wrapper with one
that will also pass in filter parameters. Since this filter list
also equates to the filter_by_attribute code that the subsequent
api call will make, the filterprotection wrapper passes the filter
list into the api call, allowing the code body to not have to
re-specify the same list.  This also has the consequency of fixing
all the missing filter_by_attribute statements in the current code
base.

Some tests cannot yet be run due to dependency on completion of
v3/auth

Fixes Bug #1126048
Fixes Bug #1101240

Change-Id: Ibd9867f6eed585414671bbab774df95b8acdf6a5
Merge "enabled attribute emulation support"
Merge "v3 token API"
domain-scoping

Implement domain-scoping functionality for v3 auth API

Change-Id: Id5e935735a43fefee10a36d9d691578871ba7fcb
Merge "Pass query filter attributes to policy engine"
Merge "Removed redundant assertion"
Merge "Update oslo-config version."
Merge "domain-scoping"
Tests for domain-scoped tokens

- Fixes bug 1131292: catalog returned with unscoped tokens
- Fixes bug 1131294: X-Subject-Token not returned on token validation

Change-Id: I1808613f276354e2a37cf8c154b55509a2888d89
Fix id_to_dn for creating objects

Only do the lookup if the scope is not ONELEVEL
For ONELEVEL, there is no point in paying the price of the lookup.

If the object is not found for scoped queries, return the top level
DN so the object can be created.

Bug 1131265

Change-Id: I1ca41bf87c3bdea30fbdf607b19192f37dd0bfd6
Merge "Fix id_to_dn for creating objects"
Merge "Tests for domain-scoped tokens"
Merge "Change the default LDAP mapping for description."
Ensure keystone unittests do not leave CONF.policyfile in bad state

A few of the tests overwrite the name of the policy file (so they can
use a temp file instead).  However, if it is left that way, subsequent
tests that rely on it may fail.

A separate patch will look at doing a more comprehensive reset in the
setup of test_v3 - ensuring we always start from a completely clean
slate for all confirguration parameters.

Fixes Bug #1131819

Change-Id: Ibe5ee12f44310de00b12ddd405c83f59b2d840b7