Implements Pluggable V2 Token Provider

This patch implemented V2 token provider.

Abstract token provider backend to make token provider pluggable. It enables
deployers to customize token management to add their own capabilities.
Token provider is responsible for issuing, checking, validating, and
revoking tokens. Note the distinction between token 'driver' and 'provider'.
Token 'driver' simply provides token CRUD. It does not issue or interpret
tokens.

Token provider is specified by the 'provider' property in the '[token]'
section of the Keystone configuration file.

Change-Id: Ic418ec433bd9e3f2f70fa31c90e570e32c1ca687
Merge "Implements Pluggable V2 Token Provider"
Implement role assignment inheritance (OS-INHERIT extension)

This extension allows for project roles to be optionally
inherited from the owning domain.  The v3 grant APIs are extended
to take an inherited_to_projects flag.  The GET role_assignments
API will also include these roles in its response, either showing them
as inherited roles assigned to the domain or, if the 'effective'
query parameter is set, will interpret the inheritance and reflect
those role assignments on the projects.

The inherited_to_projects flag is encoded in the role list in
the metadata of the relevant entries in the grant tables. The
'roles' key in the metadata is now a list of dicts, as opposed
to a simple list, where each dict is either

{'id': role_id} for a regular role, or
{'id': role_id, 'inherited_to': 'projects'} for an inherited role

Remember that a previous patch had rationalized the way metadata is
handled so that its structure is entirely hidden within the driver
layer.

The extension can be enabled/disabled via a config setting.

Limitations:

- The extension is not yet discoverable via url, this will be added
  as a separate patch when the v3/extensions work is complete.

A separate issue has been discovered with the fact that the v2
calls of 'get_projects_for_user()' and 'list_user_projects()'
should be rationalized and also honor both group (and inherited)
role assignments.  This is being raised as a separate bug.

DocImpact

Implements bp inherited-domain-roles

Change-Id: I35b57ce0df668f12462e96b3467cef0239594e97
grammar fixes in error messages

Change-Id: Ie00e2e9040b6f71eff573b6f7d8dc12bd87b7c52
Pluggable Remote User

Select the code to handle REMOTE_USER based on a config file option

Fixes the REMOTE_USER logic to get the domain name from
REALM, which is the least surprise option.

Disregards the auth_data passed in, as we should be using REMOTE_USER
to get the user name.

External Plugin is now executed in conjunction with the auth methods,
as opposed to in place of them.

DocImpact

blueprint pluggable-remote-user

Change-Id: I9dda6dbe073f03806bdf539db6faa01644109f1c
Fix XML rendering with empty auth payload.

Just add some sensible defaults to places where XML parses for example
an empty dictionary as an empty string. Also 'access' shouldn't be
considered a plural.

Change-Id: I9fb2c4f5c32ed8c2ce8ba4038caaae39590f8c1a
Merge "Pluggable Remote User"
Merge "Fix XML rendering with empty auth payload."
Implemented token creation without catalog response.

Modified the token_factory to create token responses with
or without the catalog entry.

blueprint catalog-optional

Change-Id: Icdc4400f08f4619a19e44129c78240800a3a1e75
Implement Token Binding.

Brings token binding to keystone server. There are a number of places
where the location or hardcoding of binding checks are not optimal
however fixing them will require having a proper authentication plugin
scheme so just assume that they will be moved when that happens.

DocImpact
Implements: blueprint authentication-tied-to-token
Change-Id: Ib34e5e0b6bd83837f6addbd45d4c5b828ce2f3bd
Merge "grammar fixes in error messages"