Remove roles from OS-TRUST list responses

According to the docs, the list responses should not contain
the roles, only the detailed response when you get a trust
explicitly by ID.  So remove the roles and modify the tests
appropriately.

Note it was also observed that expires_at is present in all
GET resonses, but not in the docs, but this has been agreed
as a docs error so will be addressed via a docs patch.

Change-Id: I5387021a53f3284add9e5e71e9e005c4dd31b76c
Closes-Bug: #1245590
replace "global" roles var names with "all" roles

I found this really confusing during in a code review.

Change-Id: I48695450a3271b561838853638024c5c8c00a4f3
Cleanup duplication in test_backend

There was some code duplicated in test_backend so this removes
the duplication by providing a function.

Change-Id: I6635f98932812fe2adae04feed9c07f3aa81eb5d
Updated from global requirements

Change-Id: I9aa24802741a3ee704b90c3c57aa65b10f6369e9
Move endpoint_filter extension documentation

Move the endpoint_filter extension configuration documentation to
the correct location and link it into the main configuration
documentation.

Change-Id: If208d1e349d05448ab107dac98013a77d3308d34
Uses oslo's deprecated decorator; removes ours

bp: deprecated-as-of-icehouse
Change-Id: Ideeaca14ccd8cbf7c37b096338324b5bc0e021d6
trustee unable to perform role based operations on trust

There was a typo in a conditional that checked the trustor twice, instead
of trustee and trustor. The typo was preventing a trustee from being
able to list or get or check roles that were delegated.

Also, removed the spurious check of is_admin from said conditional
(_is_trustor_trustee_admin), and renamed it to _is_trustor_trustee.

An additional check, to see if a trust existed, was removed since it
was repeated unnecessarily.

Added a test to cover the gap that was discovered in the bug report.

SecurityImpact

Change-Id: Id61e71cb3ea7c6bc51783af067fbbbe4c9bffafe
Closes-Bug: 1261104
Makes the test git checkout info more declaritive

This change is really to just simplify the test_keystoneclient tests.
Future commits will be expanding on these tests so removing the
unnecessary boilerplate is a good thing.

Change-Id: I838cadcf6c1f915b0d9fc9fcda452a669897b545
Moves keystoneclient master tests in a new class

This allows them to be reused with other versions of the client.

Change-Id: If71dcf9a5c07d8a9cdc4465fe63ce084085801f3
Policy based domain isolation can't be defined.

Policy based domain isolation is not possible on token
APIs due to lack of domain_id in policy_dict for API target

Closes-Bug: 1233874
Closes-Bug: 1251048

Change-Id: I855ec8ff4899ba3797a2e2bb23945ab4b23d2bea
Remove Identity and Assignment controller interdependancies

The DomainV3 controller explicitly instantiated the UserV3, GroupV3
and ProjectV3 controllers to call some delete methods. This makes it
very difficult to isolate the controllers from each other and
incorrectly implemented some logic that should exist in the
credential_api.

The code for deleting credentials by project and by user is now
implemented on the credential_api. This allows the controllers
to directly ask the credential_api to perform the deletes (and
in the case of the SQL backend, perform a more efficient delete
process).

The DomainV3 controller properly uses the identity_api to cleanup
users and groups when deletion occurs. Likewise, DomainV3 controller
now properly calls the assignment_api to perform project deletions.

These changes have been done to aid in clarifying explicit uses of
the per-domain-identity backend logic.

bp: assignment-controller-first-class
related-bug: #1218094
Change-Id: Ie8ed8bce556fe2f41cc7db61f04eefaf14f836f1
Move Assignment Controllers and Routers to be First Class

The assignment and identity controllers and routers have been intermixed
since they were the same subsystem. The split of Identity and Assignment
at the manager level has completed.

This change continues the process and makes the Assignment controllers
and router definitions part of the assignment subsystem instead of part
of Identity. In part, this is also a continuation of clarifying where domain
lookups (for per-domain-identity backend logic) occurs.

Identity maintains a simple subclass-proxy of each Controller that was
moved to maintain compatibility for clean deprecation until Icehouse
has been released and development opens up for J.

bp: assignment-controller-first-class
bp: deprecated-as-of-icehouse
related-bug: #1218094
Change-Id: If9a206692704005284e619679e1b6fe8b08bf8c9
Replace xrange in for loop with range

xrange is not supported in python 3, so replace it with six.moves.range

Closes-Bug: #1259978

Change-Id: I321380693d45f7d48f52da2d0f8e4c137763ab0c
Switch to oslo-incubator mask_password

oslo-incubator has a mask_password now, so use that rather than
keystone's.

Change-Id: I3d89fb844086b85598ad3fd7ae0daa7599a26a30
Merge "Uses oslo's deprecated decorator; removes ours"
Merge "Policy based domain isolation can't be defined."
Merge "trustee unable to perform role based operations on trust"
Merge "Cleanup duplication in test_backend"
Merge "Remove roles from OS-TRUST list responses"
Use oslo.db sessions

Keystone was using its own keystone.common.sql module for
database access. oslo-incubator's db.sqlalchemy module provides
the same or better functionality, so use that instead.

DocImpact
- The options that were in the [sql] section are deprecated and
  replaced by options in the [database] section. There are
  also several new options in this section. If database
  configuration is described for another project that uses
  oslo-incubator's db.sqlalchemy module the docs can be shared.

Part of bp use-common-oslo-db-code

Change-Id: I25b717d9616e9d31316441ae3671d2f86229c2bf