Update keystone wsgi httpd script for oslo logging

When updating to the oslo logging module, it appears that this script
was missed, and erroneously still references .DEBUG, which is not
available in the oslo logging module.  This commit corrects the issue
and updates the reference to oslo log module to not be aliased to
"logging".

The extra logic to set the debug on the instantiated logger is still
needed to ensure all logging is seen (startup config logging, etc).

fixes-bug: 1220012
Change-Id: If5b4f9f28cb9d05f914848cbdb54b10c2c5f3b2d
Move _generate_paste_config to tests.core

Seeing as how tests for oauth1 and endpoint filtering each have
their own private functions for creating a new paste-ini file,
I think it's best to move these to tests.core.
Future extensions will benefit from this too.

fixes bug: #1218720

Change-Id: Ic31b78dda0a66ddc4c4214bca4ba3b683d554886
Fix the code miss to show the correct error messages

In keystone/common/ldap/core.py I found the code like below:

 86 raise ValueError(_(
 87 'Invalid LDAP TLS certs option: %(option). '
 88 'Choose one of: %(options)s') % {

The code "%(option)" in line 87 should be fixed to "%(option)s" to
show the correct error messages when the exception happens.
This patch fixes this error.

Fixes bug #1220601

Change-Id: I87328080facd4d9b1349a677c00a93d118993538
Merge "Update keystone wsgi httpd script for oslo logging"
OAuth authorizing user should propose roles to delegate

Currently in the oauth1 extension the consumer specifies roles
instead of delegator. This is a design fault that should be fixed
by having the authorizing user provide a set of roles (ids)
during the authorize request token phase.

fixes bug: #1216408

Change-Id: I13e155cf04dd478d575c8d66216d0fde08875ba2
Merge "Fix the code miss to show the correct error messages"
Merge "Move _generate_paste_config to tests.core"
Imported Translations from Transifex

Change-Id: Ic3ae662ce418f2548006de27ae22941a31adcb8d
Merge "OAuth authorizing user should propose roles to delegate"
Support timezone in memcached token backend

This patch fixes bug #1221087.

Replaces time.mktime() to calendar.timegm() in utils.unixtime()
to get correct expiration time.

After this patch, Memcached token backend does not depend on timezone.
So remove the section "Memcached and System Time" in configuration manual.

DocImpact

Change-Id: I17233c8a79d01a37abdbd46934ad486ddc8caec9
Merge "Imported Translations from Transifex"
Merge "Support timezone in memcached token backend"
Changes template header for translation catalogs

New translation catalogs will be generated with the organization set to
'OpenStack Foundation' in the header.

Change-Id: I0da323113030c6a68b3c4bbdd94053639312c594
Partial-Bug: #1214176
Changed header from LLC to Foundation based on trademark policies

Fixes: Bug 1214176

Change-Id: Ie937081a53d377671b8b88f422642c8131002f88
Merge "Changed header from LLC to Foundation based on trademark policies"
Fix incorrect test for list_users

The current test would not fail if incorrect data was returned by
the driver.  The list_roles test also has the same issue.

Fixes bug 1222574

Change-Id: Icc5e76e9453436ac208c5f262d0dd4082b700d02
Import core.* in keystone.tests

This will allow us to 'from keystone import tests' to import core
test functions. This is consistent with other modules in Keystone.

Change-Id: I8c3044cad85fee37a237264da198465fcb3c0898
Remove CA key password from cert setup

Password protection in the current implementation is not actually
applied despite the presence of the ca_password config
option. Password protection is of marginal benefit because the
password must be stored in a file using the same protections afforded
to the key file. Password protection currently is not utilized with
externally provided keys.

Remove the ca_password config option and remove the use of the various
password related options to the OpenSSL commands whose net effect was
not actually accomplishing anything.

See the bug report for a thorough description of the issues.

Change-Id: Iaeb97f2338c4d3c6e770b410dee8f1b62778b561
Fixes: Bug #1214016
Close each LDAP connection after it is used,
following python-ldap docs

Fixes bug 1172164

Change-Id: If20e3c1cf3deac5ce4217ce0324f8c91c2e30f92
Fixes for user response with LDAP user_enabled_mask

This fixes a couple of problems with the returned user object
when the Keystone server when the LDAP Identity backend is
configured and the user_enabled_mask setting is not zero.

First, the returned user had the masked value (e.g., 512) when
a user was created rather than the actual enabled value (true
or false).

Second, the Keystone server was returning the enabled_nomask
attribute in the user entry when users were listed or updated.

This change makes it so that the server returns the enabled
value as a Boolean when a user is created. Also, the
enabled_nomask attribute is not returned when users are
listed or updated.

Change-Id: I8a22aec3377ffd335095e645c1b3d65008dd0cf2
Closes-bug: #1220945