Allow LDAP lock attributes to be used as enable attributes

Some LDAP servers support disabling accounts via a boolean "lock"
attribute. For these servers, a value in LDAP of "True" means that
the account is locked, while a value of "False" means the account
is active. When the "user_enabled_mask" and "user_enabled_emulation"
options are not in use, Keystone currently expects a boolean
"enabled" attribute where "True" means the account is enabled and
"False" means the account is disabled.

To support LDAP account lock attributes, we need a way to tell
Keystone that the boolean values from LDAP are inverted. This
adds a new "user_enabled_invert" setting that allows the enabled
boolean logic to be inverted in the resource (LDAP), while leaving
the logic as-is in the model (Keystone user object).  The existing
default behavior remains as-is.

DocImpact
Change-Id: I2a89d4b98c854e68e1bb10f53b8b29d92f945f60
Closes-bug: #1337029
Fixes an issue with the XMLEquals matcher

The matcher implementation would fail to match two documents that are
semantically equivalent, but sibling elements appear in different
document order.

Change-Id: I99dc6401e73be4c61bb265c3258b6245f2e7bb34
Closes-bug: #1347891
Use mail for the default LDAP email attribute name

test_user_mixed_case_attribute passes when not using a live LDAP backend.
The test fails when using a live LDAP backend because the standard LDAP
email attribute is 'mail', but the test is expecting the LDAP backend to
use 'email' as the attribute name.  The fix is to use 'mail' as the
attribute returned by the LDAP backend, and 'email' as the corresponding
property in the User object.
To test, run the test_ldap_livetest test e.g.

  python -m testtools.run keystone.tests.test_ldap_livetest

Closes-Bug: #1321822

Change-Id: I2100b5706852fdc7dfea2d4473ef6685c8a2f874
Use python convention for function names in test_notifications

Renamed a few methods in test_notifications to follow the python
convention, using underscores instead of camelCase.

Change-Id: I48003566b8f5967185e5067ff3cfbf4324b81d43
Merge "Use mail for the default LDAP email attribute name"
Expose context to create grant and delete grant

To correctly issue a CADF audit event for a change in role
assignments, we need to expose the context at the manager level.
Note that the driver signatures are *not* changing, just the
manager needs to know the context.

implements bp role-assignment-notifications

Change-Id: I116b185f5d1fc3f9cbb03ffcf3ce64c56a73d969
Enable filtering of credentials by user ID

A credentials entity has a user_id attribute. Currently the lack of a
filter of user_id means that we cannot use the keystone policy file to
enable users to have access to (only) their credentials. This fix solves
it by adding such a filter:

List credentials: `GET /credentials`
Optional query parameters:
- `user_id` (string)

Implements: blueprint filter-credentials-by-user

Closes-Bug: #1267096

Change-Id: Iff016fac37b50d55d77ec7511aae4e57af34f08f
Merge "Fixes an issue with the XMLEquals matcher"
Create authentication specific routes

These routes are purely based on your current authentication and bridge
the gap between what is available in the standard identity-api for
fetching scope targets based on user_id and what is required for the
federation APIs.

Implement /auth/projects /auth/domains and move /catalog to
/auth/catalog

Change-Id: I464c0ca5cc9f250d593340e9563de45b077dd4cd
Implements: blueprint auth-specific-data
Merge "Use python convention for function names in test_notifications"
Merge "Enable filtering of credentials by user ID"
Fixing simple type in comment

Change-Id: Ia213bf0b842484360633a3d851d74cff5bfb3a8e
Add audit ids to tokens

Add audit identifiers to each token. If the token is a rescoped token
the audit identifier will be a list where index 0 being the token's 
audit id and index 1 is the initial token in the chain's audit_id.

If the token is not rescoped, the token's audit_ids will only contain
the audit_id of the token itself (at index 0).

This change is to resolve a method of performing token revocations
on individual tokens without needing to rely on the low
resolution of token expires time.

DocImpact

Change-Id: If5fdf187bd525f273281f9fdf53bdc8865164289
bp: non-persistent-tokens
Sync with oslo-incubator

Syncs Keystone with oslo-incubator commit hash
a9e1122f44deedeeb5dc824b6c085bb9beb08452

Commits since last sync (5fa2dae4):
-----------------------------------
037dee0 Set stevedore log level to WARN by default
ad248f6 Specify namedtuple_as_object=False when using simplejson
1c3ecfc Enhance versionutils.deprecated to work with classes
37c0091 Add unicode coercion of logged messages to ContextFormatter
6614413 Correct coercion of logged message to unicode
1188d88 Except socket.error if syslog isn't running
ac995be Fix E126 pep8 errors
631f880 Set keystonemiddleware and routes.middleware to log on WARN level
726d00a Adjust oslo logging to provide adapter is enabled for
9a46271 Add Kilo release name to versionutils
433fa0b Make logging_context_format_string optional in log.set_defaults
a2ad3a2 Allow deprecated decorator to specify no plan for removal
2b966f9 Fix deletion of cached file for policy enforcer
ac92c06 Add default log level for websocket

Change-Id: I244115cb31a3f90951be8914091a1a0175930442
bp: non-persistent-tokens
Convert to urlsafe base64 audit ids

Convert audit ids over to being urlsafe base64 strings. This also
addresses an issue with Python3 bytes object not having a .encode
method.

Change-Id: I9e9459b87ebb84d3bc3e36ef10a4b8364abc0c5f
bp: non-persistent-tokens
Merge "Allow LDAP lock attributes to be used as enable attributes"
Merge "Create authentication specific routes"
Correct the signature for some catalog abstract method signatures.

Closes-bug: 1359608

Change-Id: If706c4b28a357e2f3dcde50fbff6418c193c0887
Add notifications for policy, region, service and endpoint.

The endpoint policy extension will need to ensure stale
associations are removed on deletion of these entities. Delete
events are already generated for endpoints. For completeness,
create and update notifcations for these entities have also
been implemented.

Partially implements: bp endpoint-policy
Change-Id: I5de15459f5b577955056ecc166b450963e85bbc9
Merge "Correct the signature for some catalog abstract method signatures."