Enforce scope mutual exclusion for trusts

We already warn if you try to scope a domain and project together. This
should be extended to trust scoping rather than clobbering the existing
scope.

Change-Id: I9d8fe001b65588b1c21e58f38a47456fdad85ee1
Related-Bug: #1288223
Split sample PKI token generation

Splits the file that generates the sample data into two.
One part is the set of individual functions.  The second
is a script that calls each of the functions in turn.  By
splitting them, it becomes easier to regenerate just a subset
of the sample data.  The use-case that prompted this change
was the need to regenerate the signed tokens based on a different
algorithm.  Without this change, all of thecertificates would
need to be regenerated, and that has nothing to do with the
actual change required.

Change-Id: I53b6cfde98a52f0a59b06ad8abbe0d2f1251f796
Add 'methods' to all v3 test tokens

methods is a required field of v3 tokens but none of the sample tokens
have them. This field is required for determining the difference between
a v2 and a v3 AccessInfo object.

Change-Id: I4d45e90f24eeb2f35451549771ad999628619c20
Use AccessInfo in auth_token middleware

auth_token middleware parses the token and extracts the data manually.
We have this parsing ability in AccessInfo now so we should use that
instead.

Change-Id: I23c6e33d327c3d3669fb977d9623b788324c4785
Discover should support other services

Most services don't provide a 'values' element for their version
definitions, however are otherwise similar. Discovery should allow that
case and continue on otherwise.

Change-Id: I878377a779da5c96c47603842c024059920423fd
Reference docstring for auth_token fields

The documented variables that the auth_token middleware sets for
the request was out of date with the code. Rather than maintain
the documentation for the fields in 2 places we'll now link to the
auth_token module docs.

Change-Id: Id4ca1843f749c1ed0b515c8860764add3ec4a3da
use v3 api to get certificates

Let Token signing and ca certificates can be accessible at
/v3/OS-SIMPLE-CERT/{ca,certificates}.

Change-Id: I6c82d1f78ba1ff2ab110474623982542610b4d2d
Closes-Bug: #1206345
Add a positional decorator

This decorator allow us to define that certain parameters are strictly
keyword arguments only, without sacrificing the convenience of having
those arguments listed in the function definition.

This will mean that we are no longer trapped maintaining backwards
compatibility for the order of keyword arguments.

The enforcement levels should allow us to start putting warnings on
existing functions and strict enforcement on new functions.

Partial-Bug: #1295881
Change-Id: Ic0a196874930e7be8362df50594471ab8037c5b2
Sync config fixture object from oslo.incubator

Specify the config file directly otherwise we end up with a lot of new
dependencies.

Change-Id: Id39f5c039d5d0d68ab6e4008a1212868396eda3e
Merge "Enforce scope mutual exclusion for trusts"
Fix passing get_token kwargs to get_access

get_token takes kwargs so that a different plugin implementation might
make use of them. It is not expected that token arguments would be
passed to the code that is doing the token fetching.

Change-Id: I28aa2b8070feec76f225601069c92c535334f4d4
Start using positional decorator

Apply the positional decorator to functions. It has been added as I
think best practice would dictate, though in some places it has been
added in a way that doesn't break existing tests.

Closes-Bug: #1295881
Change-Id: I4f7ddbede4cba4ab79d144ad1f9dc83ea76f204a
Merge "Add a positional decorator"
sanity check memcached availability before running tests against it

Change-Id: I40fff70cbf395e7fe42530155074f75dd116034c
Closes-Bug: 1296794
Add a method for changing a user's password in v3

The new Identity API v3 resource for changing a user's password in
keystone can be utilized with:

  c.users.update_password(old_password, new_password)

Change-Id: Ia887d853140a18ba75d6eb1bfde4ce2d64b7af60
Closes-Bug: 1239757
Co-Authored-By: Dolph Mathews <dolph.mathews@gmail.com>
DocImpact
Handle URLs via the session and auth_plugins

In the future clients will simply pass the service they expect to talk
to and the path. This will prevent every service trying to get their own
base urls from the service catalog individually.

This can later be extended to have the auth plugin actually contact the
URL from the service catalog which will let us have unversioned
endpoints in the catalog handled from a single location.

Change-Id: I80f0b5b1dbb45565fec09d1cb2c0552cfb9a72f5
blueprint: auth-plugin-endpoints
Improve language in update_password() validation error

Change-Id: I728af11c6d652c2937e6da80b96a5c3f337bae76
Related-Bug: 1239757
Merge "Start using positional decorator"
Merge "Fix passing get_token kwargs to get_access"
Merge "Add a method for changing a user's password in v3"