Remove CA key password from cert setup

Password protection in the current implementation is not actually
applied despite the presence of the ca_password config
option. Password protection is of marginal benefit because the
password must be stored in a file using the same protections afforded
to the key file. Password protection currently is not utilized with
externally provided keys.

Remove the ca_password config option and remove the use of the various
password related options to the OpenSSL commands whose net effect was
not actually accomplishing anything.

See the bug report for a thorough description of the issues.

Change-Id: Iaeb97f2338c4d3c6e770b410dee8f1b62778b561
Fixes: Bug #1214016
Fixes for user response with LDAP user_enabled_mask

This fixes a couple of problems with the returned user object
when the Keystone server when the LDAP Identity backend is
configured and the user_enabled_mask setting is not zero.

First, the returned user had the masked value (e.g., 512) when
a user was created rather than the actual enabled value (true
or false).

Second, the Keystone server was returning the enabled_nomask
attribute in the user entry when users were listed or updated.

This change makes it so that the server returns the enabled
value as a Boolean when a user is created. Also, the
enabled_nomask attribute is not returned when users are
listed or updated.

Change-Id: I8a22aec3377ffd335095e645c1b3d65008dd0cf2
Closes-bug: #1220945
Cleanup tests imports so not relative

This change cleans up the imports in tests packages by changing
relative local imports to absolute imports per OpenStack hacking
guidelines.

Change-Id: I63c493b6a263e896f92479996c4fa4f783adff9a
Move gettextutils installation in tests to core

gettextutils.install was done in tests/__init__.py, but this was
not consistent with how test environment setup is done. We have
code to set up the environment in core.py, so other environment
setup should be there. Also, this makes tests/__init__.py cleaner.

Change-Id: I762c8fa715e9c6ec26722fcd9b0ba0f9d613cb43
gate on H304: no relative imports

Change-Id: I7c69325fe5adbc983eb12f85dbdac958ea27676b
Imported Translations from Transifex

Change-Id: I83db86a0da805b38e05bb9742fd72dfc43e2e400
test token revocation list API (bug 1202952)

Change-Id: Idd2c19607be56e49c97321a69feb36933e393aa4
Merge "test token revocation list API (bug 1202952)"
Merge "Remove CA key password from cert setup"
Merge "Cleanup tests imports so not relative"
Merge "Fixes for user response with LDAP user_enabled_mask"
Test upgrade migration 16->17

This test covers the use case described in bug 1131590, where a
user_project_membership record cannot be upgraded past migration 16.

Closes-Bug: 1224320
Change-Id: Ia1bd03d0e07de316631140d55231abe74decaac1
Merge "Test upgrade migration 16->17"
Merge "gate on H304: no relative imports"
Ignore H803 from Hacking.

H803 checks for the absence of a period in commit messages, something
the community clearly rejected as a sensible check: periods in commit
messages should neither be rejected or required.

Change-Id: I49c981a089bc7f41450e58d193ca4b609d092df3
Merge "Move gettextutils installation in tests to core"
fix rst syntax in database schema migrations docs

Change-Id: Idde4cf9b472663da63b1cf16bcec83a3100fab5e
Merge "Ignore H803 from Hacking."
Include new notification options in sample config

Some new configuration options were added with the change to add
notifications to Keystone, but these new options weren't added
to the sample config file.

This change adds the new options to the sample configuration
file along with the descriptions from
keystone.openstack.common.notifier.api.

Also, if the Keystone server uses the RPC options from
keystone/openstack/common/rpc/__init__.py if using the RPC
notification driver, so these options are also added to the
sample config file.

Having these options in the config file will make it easier for
administrators to update the configuration values.

DocImpact
Change-Id: I85f2450a6fb68d51453adbb5413ad48fe00ca17e
Optional dependency injection

This adds support for optional dependencies using Keystone
dependency injection.

A new decorator for classes is provided.

 @dependency.optional('optional_api_1', 'optional_api_2')

If there's a provider for the dependency, the attribute
will be set to the provider instance, otherwise the attribute
will be set to None.

This can be used in combination with required dependencies.

Related-bug: #1223524
Change-Id: I2b987f10a7bc85efab136ae9e84606e666494246