filter in ldap list_groups_for_user

Bug 1177630

Change-Id: I46d393c5f21330c5ab13539f0358fc80b1588660
Remove enumerate calls

Refactor keystone/tests/test_v3_auth.py, remove all useless enumerate
calls in for loop. To make codes cleaner.

Change-Id: I16d6796fb37b543c1301c2f35129384f2e0ff782
Fix error where consumer is not deleted from sql

Looks like when the token sql backend was going through tokens
to delete, it didn't like if the token ref didn't have a token
field. I placed a guard in there now.

fixes bug: #1215493

Change-Id: Ia12f5e4d9af71c322c9230464ae39ec88303b600
Use correct filename for index & serial file when setting permissions

There was a cut-n-paste bug where self._set_permissions() was called
with the exact same filename, self.ssl_config_file_name, instead of
the index and serial filenames. This patch uses the index and serial
filenames as was the original intent.

Change-Id: I571c766ac746bbbc1bedfdf1ff2b1b86363a0af0
Fixes: bug #1206254
Implement Caching for Token Revocation List

Based upon the Keystone caching (using dogpile.cache) implementation
token revocation list caching is implemented in this patchset.

The following methods are cached:
    * token_api.list_revoked_tokens

Calls to token_api.delete_token and token_api.delete_tokens will
properly invalidate the cache for the revocation list.

Reworked some of the caching tests to allow for more in-depth
tests of the cache layer.

DocImpact

partial-blueprint: caching-layer-for-driver-calls
Change-Id: I2bc821fa68035884dfb885b17c051f3023e7a9f6
Refactor Token Provider to be aware of expired tokens.

The Token Provider was not aware of expired tokens, and would
not raise Unauthorized if a token was expired when asked
to "validate" (validate_token, validate_v2_token, validate_v3_token)
or "check" (check_v2_token, check_v3_token) it. The assumption was
that the Token driver would never return an expired token  from
the token_api.get_token method.  When token caching is implemented,
this assumption can no longer be made.

This patchset updates the provider to make it capable of inspecting
token data returned by the token validation methods on the driver.
If a token is expired it will properly raise Unauthorized.

Refactored the Token Provider to noi longer use a separate code-path
to "validate" or "check" tokens.  Check now benefits from the code
to ensure a token is still valid.

Since caching is implemented at the manager level, the expiration
check is done in the manager (above the driver), it is expected
that the manager needs to be expiration aware (responses from the
driver may be cached).

partial-blueprint: caching-layer-for-driver-calls
Change-Id: I2caa4cb47ba1d3a33746fc00f672a5b8fe319bd6
Implement API protection on target entities

API policy protection is currently limited to using the parameters
passed into the call. However, there are many cases where you want
to also check attributes of the entities an API is operating upon.  The
classic example is ensuring a domain administrator cannot get, update or
delete users, groups or projects outside of their domain.

This patch enables lines in the policy file to also refer to any field
in the target object of the API call. In addition, it includes a separate
sample policy file that shows how to use domains and the new protection
ability to provide domain segregation and administration delegation.
This sample file is also tested to ensure that such protection works
correctly.

DocImpact

Implements bp policy-on-api-target

Change-Id: Ie1a4e14a86d27e8b60e6c17e33dd6b9fa889660c
Merge "filter in ldap list_groups_for_user"
Drop support for diablo to essex migrations

This removes support for the following legacy-related commands:

    $ keystone-manage export_legacy_catalog
    $ keystone-manage import_legacy
    $ keystone-manage import_nova_auth

DocImpact

Change-Id: If7277e912f11c9bf3bec15f9addd848e0774f14f
Add notifications module

This adds notifications framework including a notifications
module and corresponding test cases.

blueprint notifications

Change-Id: Iad2391c98d7fb1f5283997159cc90eb093bb42bb
Merge "Implement API protection on target entities"
Merge "Fix error where consumer is not deleted from sql"
Merge "Implement Caching for Token Revocation List"
Merge "Refactor Token Provider to be aware of expired tokens."
Merge "Add notifications module"
Merge "Remove enumerate calls"
Merge "Drop support for diablo to essex migrations"
Merge "Use correct filename for index & serial file when setting permissions"