Remove intersphinx mappings

There are no intersphinx mappings used within the documentation so we
should remove the links so that they don't try to download.

Related-Bug: #1353817
Change-Id: I24edc4d88e9badd2b92ea124ebe960abc7d2d51c
Add a test for re-caching a token

There was no test that showed that when a token was in the cache
and a request is made to validate it again, it gets cached again.

Change-Id: I1992fa6b5ddc0792dfd1ce90fb888c365ecb1612
Partial-Bug: #1289075
auth_token cached token handling

auth_token handles tokens that are from its cache, uncached PKI
(compressed and ASN, "offline validation") and UUID/hashed tokens
("online" validation).

For all of these cases, the auth_token middleware was doing

1) expiration check
2) confirm token bind
3) store in cache

In some cases, some of these steps aren't necessary.

When getting the token from the cache
1) no expiration check is needed because the expiration time is
   stored as cache data and the token would be rejected during
   _cache_get.
2) Storing in the cache is unnecessary because the token is
   already in the cache.

When doing online validation, it's not necessary to do the
expiration check because the identity server would have rejected
the token if it was expired.

Closes-Bug: #1289075
Change-Id: I6afa98504215521538434f1f8a2d97585ce35de5
Hash for PKIZ

Only PKI (asn1) based tokens were checked for format and hashed

Closes-Bug: 1355125

SecurityImpact

Change-Id: I24cb09edd9a6c9e99e48042a623c7818321f2ead
Merge "Hash for PKIZ"
Updated from global requirements

Change-Id: Idb5cb2ede20c95ee266ab4ef24b2654f172d2003
Merge "Remove intersphinx mappings"
Merge "Add a test for re-caching a token"
Create an Auth Plugin to pass to users

We pass the service catalog and token data through to consumers via
headers, with the auth plugin work we can create clients that are
authenticated with the incoming token and service catalog.

DocImpact: A new environment option is passed out of auth_token
middleware called `token_auth` which is an authentication plugin that
can be used with a session in a service.

Implements: blueprint create-auth-plugin
Change-Id: I549a421fc73f00126f6ac5f4b5911de2e32de825
Always supply a username to auth_token tests setup

Whilst the v2.Password plugin (which is used by default) will accept a
None value for username this is incorrect behaviour. We should always
provide at least a username so that the plugin can do sensible error
handling if it is not present.

Change-Id: Id790b52f3b06240923f605754c7ffcf4ff136062
Closes-Bug: #1361444
Merge "auth_token cached token handling"
warn against sorting requirements

Change-Id: I64ae9191863564e278a35d42ec9cd743a233028e
Closes-Bug: 1365061
Always add auth URI to unauthorized requests

For those services that use delay_auth_decision we need to support
adding the keystone URI rejection headers to the response in a uniform
way. I feel this should be more generic and that every 401 response
should contain this header.

Create a WSGI wrapper so that if a 401 is ever returned through
auth_token middleware we can add an additional WWW-Authenticate header.

Closes-Bug: #1349364
Change-Id: Ib5231a09fd5c6cb6cd17f07c87e982d2e8fde2bf
convert the conf value into correct type

If options are set in paste file e.g. api-paste.ini for nova, all
the option values passed into AuthProtocol.conf are string type.
So, we should convert the conf value into correct type.

Change-Id: I0367cd6b54ee49f5db6541840539e7700f241f87
Closes-Bug: #1353315
Use oslo_debug_helper and remove our own version

With the latest version of oslotest, we can now take advantage
of a common oslo_debug_helper script.
We can now remove our own homebrewed version, minor changes to
tox.ini were needed.

Change-Id: I992244897eac7471c14988c34b8d140827fd65aa
Merge "Always supply a username to auth_token tests setup"
Merge "Always add auth URI to unauthorized requests"
Merge "convert the conf value into correct type"
Merge "Create an Auth Plugin to pass to users"
Merge "Use oslo_debug_helper and remove our own version"