Adds support for username to match the v2 spec

The v2.0 API spec uses username for the user's name, whereas the v3 API
just uses name. The v2.0 implementaion incorrectly used name instead of
username, but did allow a username to be specified and stored in the
extras.

This patch makes the implementation more closely conform to the API
without breaking backward compatibility. Anyone using name in the v2.0
API can continue to do so. They can even specify a username that will
still get stored in the extras. Users can now use the documented
username instead of name and the API will work for them as well.

Both name and username will always be returned for the v2 API calls.

DocImpact
Change-Id: Ia95aa5d442a8311925399fa59e5022d31f68d374
Closes-Bug: #1214686
Sync several modules from oslo-incubator

This change syncronizes excutils,lockutils,log, and
db.sqlalchemy.session modules from oslo-incubator
commit 19e0a51204df247dc38de880d08e6d66e89e6572 .

 $ python update.py --nodeps --base keystone --dest-dir ../keystone \
     --modules  excutils,lockutils,log,db.sqlalchemy.session

This includes fixes for 2 problems:

"keystone=INFO" was in the default_log_levels. This made it
more difficult than necessary to debug the Keystone server,
since you can set debug=True but then the keystone logging
level is overridden and you get no debug output for keystone.

"keystone=INFO" may have been in the default_log_levels because
of the auth_token middleware, but this has been moved to
python-keystoneclient now and the logging config for the
python APIs is done differently.

Closes-Bug: 1245629

Also, fixes some warnings and errors when docs are generated.

Change-Id: I53868bef975f73b4aee35695b6387b718c4179f9
Synchronized with oslo db and db.sqlalchemy

In most cases Oslo-incubator contains the most relevant code.
Furthermore in certain cases exists bugs which can be fixed by
synchronization with Oslo. Thus regular sync is required.

                        Changes from oslo-incubator
==============================================================================
8b2b0b7 Use hacking import_exceptions for gettextutils._
9bc593e Add docstring for exception handlers of session
855644a Removal of _REPOSITORY global variable.
ea6caf9 Remove string.lowercase usage
a33989e Remove eventlet tpool from common db.api
e40903b Database hook enabling traditional mode at MySQL
f2115a0 Replace xrange in for loop with range
c802fa6 SQLAlchemy error patterns improved
1c1f199 Remove unused import
6d0a6c3 Correct invalid docstrings
fb0e86a Use six.moves.configparser instead of ConfigParser
6603e8f Remove sqlalchemy-migrate 0.7.3 patching
97d8cf4 Remove lazy loading of database backend
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Synced from Oslo-Incubator commit: 517c4cc65969f93b4b758a568725a1625abfd24d

Change-Id: Ida6b38b8e41c73c67170e4ec43943e661f014629
Remove unused code in contrib/ec2/controllers.py

"token_id = uuid.uuid4().hex" is unused code, remove it

Change-Id: I4362f99e6119699328ba112d5106148669d405a2
Closes-Bug: #1264946
Fix typo in test

A single-char typo in test_auth caused a value that should have
been a simple string into a tuple of strings. This made the test
generate what's actually invalid input data since the username
is supposed to be a simple string.

Change-Id: I7a477bb8e5504c1c7982cf56ffe69e1c5294cadf
Related-bug: #1265108
Remove unused imports

Remove unused imports in doc/ext/apidoc.py

Change-Id: I379ab62564631e7c5a9b616b6eabcc6b4d9e966c
Closes-Bug: #1265332
Remove noop code

All these lines of code did was get a logger. Getting a logger is
a noop.

The comment says that this code was supposed to change the logging
configuration but it doesn't do that. Also, this isn't the correct
way to change the logging configuration, see
https://review.openstack.org/#/c/62068/

Change-Id: Ie03a9164a5f4e9b1aa5622eb44bbe891015a26be
Enhance list_group_users in GroupApi.

If there is no member in the group.
When get the group users, the varible "member" is an empty dictionary.
It will crash at "member[self.member_attribute]".
This commit add a judgment to determine the member is empty or not.

Closes-Bug: #1259426
Change-Id: Ic20549204bcc35f71464b858f5ca900a4bbfe049
Cleanup of new credential_api delete methods

Based upon the feedback on the credential_api.delete_credentials_for_user
and credential_api.delete_credentials_for_project implementations, apply
some cleaner default logic and comments/docstrings.

Change-Id: I6d1abe71931bce82c122d6cce9a94beccd8ffcfb
bp: assignment-controller-first-class
Do not update password when updating grants in Assignment KVS

Assignment KVS backend no longer performs an update that causes
the user's password to be updated when updating grants. This
potentially would have caused any/all grant updates to set the
user's password to the current password hash, effectively making
it impossible to login with the user. The longer-term fix
should ensure that the backend does not need to update the user
itself from the driver level.

Change-Id: I74ffc643020fa077c39a0cf16847e397a0c24139
Closes-bug: #1265887
Move deletion business logic out of controllers

Based upon the feedback on the credential_api deletion changes,
the deletion code should be moved down to the managers from the
controllers. This means the business logic to delete / modify
associated resources based upon a given action no longer resides
in the controller. The changes include (but are not limited to)
mass token deletion (delete_tokens_for_(user|trust|project|domain),
domain content deletion, credential deletion, etc.

This change also moves around the use of @dependency decorator
to ensure the *_api managers are added to the correct objects.

The token_api has been expanded to handle the token revocations
for users, projects, and domains directly (public methods). This
allows the managers to handle deletions rather than the
logic residing in the controllers; it was previously not clean
to issue a `delete_tokens_for_user` outside of the controller.

A few minor test changes and additions were needed to handle the
moving of business logic. Notably, the keystoneclient tests
(test_keystoneclient) CompatTestCase needs to setup SQL for the
credential_api to be able to perform delete logic.

bp: assignment-controller-first-class
Change-Id: I721e49258c10830b3c44f301e8c9e5f954262388
Break dependency of base V3Controller on V2Controller

With the cleanup that has occured, it is now possible to make the
V3Controller to stand on its own with out needing to inherit from
the V2Controller. To accomodate this change, `_require_attribute`
has been moved from V2Controller to keystone.common.wsgi.Application.

Change-Id: Id5cd5384a100a5d3de6beac2ba445854a2e8e6fd
bp: assignment-controller-first-class
Remove 'disable user' logic from _delete_domain_contents

Bug 1130236 has been marked as completed and fix released. This
commit removes the logic in `_delete_domain_contents` that disabled
the users prior to cleaning up the contents of the domain due to the
bug.

Change-Id: I0b1fba429cf45baae88a629e1629ce704dad4246
Remove unused test function

The appconfig function in keystone.tests.TestCase wasn't used.
This change removes it.

Change-Id: I5377b7a3a42df1d111736f9cce0e2f74fa5931e2
Clean up docstrings in contrib.oauth1.core

The docstrings were using the wrong parameter name.

Change-Id: I237b2b137fa8c8f6138a4a7eacf6140843517225
Remove unnecessary line in test_auth

TestCase sets up the kvs identity backend already, by using
test_overrides.conf, so this line doesn't do anything and is going
to lead to confusion if test_overrides.conf changes to a different
backend.

Change-Id: I3f62e70a0dd7a27b675a29a56bfbccffa1b9be50
Flush tokens in batches with DB2

When there is a very large number of expired tokens to be flushed,
keystone-manage token_flush will fail with DB2 because it fills
the transaction log. This fix causes tokens to be flushed with DB2 in
batches of 100 at a time to prevent the transaction log from
filling up.

Closes-Bug: #1257323
Change-Id: Ic57d8795a995462fc277ec9655eca9b460ffcbee
initialize eventlet for tests

Some tests are succeededing but should not be.
Running individual tests fails if the tests
exercise code that needs to be initialized by
keystone/common/environment

Change-Id: Ia392d0273fd8a5d12cdf43fb6ff55f1819d8f3f2
races cause 404 when removing user from project

When removing a user from a project, the assignment manager retrieves a
list of all roles the user has on the project, then removes each role.
Each (user, role, project) tuple is removed with a separate call into
the driver. If, before a particular role has been removed, that role is
deleted by another request calling into the manager (i.e., via
delete_role), the call into the driver by the user removal request will
raise a RoleNotFound exception and the request will return an HTTP 404
error. Furthermore, any roles in the list after the exceptional role
will not be deleted.
This patch add try-except around the
driver.remove_role_from_user_and_project calls to catch the RoleNotFound
exceptions, so that roles after the exceptional role will be deleted as
expected, and a 404 is not returned.

Closes-Bug: #1257390

Change-Id: Ic48d869711d0275d402616c550fc0e7444b0a0d0
Don't need session.flush in context managed by session

Within the scope of a single method, keeping all the reads and writes within
the context managed by a single session. In this way, the session's __exit__
handler will take care of calling flush() and commit() for you.
If using this approach, you should not explicitly call flush() or commit().
See http://docs.sqlalchemy.org/en/rel_0_7/orm/session.html#committing

Closes-Bug: #1258044
Change-Id: I1125c72712203f1594ef245761dbfc25ed31eab2