Cleanup of test_cert_setup tests

- Removed the redundant calls to load backends and fixtures
- Only create a controller in the one test that needs it

Change-Id: I6c068452479ceb23010396f14fe6d155ac954b04
Enhance tests for user extra attribute mapping

This test shows that when an extra attribute mapping like
'description:description' is used, the description isn't returned
in the user.

Change-Id: Ie3520b315a0eecc2503953c0f15ae1da9a8070c9
Related-Bug: #1293698
Allow any attributes in mapping

When using attribute mapping (e.g., user_additional_attribute_mapping), any
attributes that Keystone didn't know about were ignored and a warning was
issued, like

 WARNING keystone.common.ldap.core [-] Invalid additional attribute mapping:
 "description:description". Value "description" must use one of password,
 enabled, default_project_id, name, email.

This check is removed. Additional attribute mappings for "unexpected"
attributes (such as description) should be allowed. For one thing, all the
known attributes already have a way of setting the mapping, via the
user_*_attribute config option. This will allow setting a "description" or
any other attribute mapping for users.

Change-Id: Idc2cd75ecd3e1a06a50fd0a676d83c5de74ca7a5
Partial-Bug: #1293698
Don't re-raise instance

There were a couple of places where the code would re-raise an
exception with `raise inst`. This would lose the original
backtrace.

Change-Id: I437039fe520bd88b556af9ed2ee4a14bfe120498
Adding one more check on project_id

Project_id is not a required attribute in creating Trust.
Authentication with this kind of trust results in an error:
"Expecting to find id or name in project".
This message is misleading as the trust creation without project_id
was successful which is a valid behavior.
This error message is generated from checking if project_id is in trust
metadata.
One more check is needed to verify if project_id is None or populated.

Closes-Bug: #1301622
Change-Id: Ic711a63f43ca87a97cb7f761170fa8aa2d45e11e
Isolate backend loading

Pecan uses thread local storage and so if we combine pecan and eventlet
we need to make sure that eventlet is monkey patched before pecan is
first loaded.

To keep the paste.ini file untouched we need to keep the app creation in
service.py but we can't load that from keystone-all because it has pecan
in it.

So we create a new file that can be safely imported before pecan is
loaded.

Change-Id: If7abf1db9859d66c06f7f223056c106292f256fa
blueprint: keystone-pecan
Fixes for in-code documentation

Fixes a couple of issues that slid by on review
https://review.openstack.org/85651

Change-Id: I2dd19c6d0af9c7c3148811aeb8299656d1afc788
Add missing import, remove trailing ":" in middleware example

Minor fixes to the external authentication example given in the
documentation.

Change-Id: I2bef7da8bf8278349fec80a513095637ea49f19a
Closes-Bug: #1308634
Co-Authored-By: Florent Flament <florent.flament-ext@cloudwatt.com>
Merge "Adding one more check on project_id"
Remove LDAP password hashing code

Keystone should not be hashing passwords for LDAP users
itself.  Password hashing should be performed by the LDAP
server, as password policies may not allow pre-hashed
passwords to be set (they may enforce a scheme that is
stronger that salted SHA-1).

This removes the LDAP password hashing code.  When using
fakeldap for running unit tests, passwords will not be
hashed.  For this reason, the hashing tests are skipped
for LDAP backends.

Closes-bug: 1308793
Change-Id: Ia0998b7fd8fb5d01b86a947d18b7e79fcffd1228
Merge "Isolate backend loading"
Merge "Cleanup of test_cert_setup tests"
Merge "Don't re-raise instance"
Merge "Enhance tests for user extra attribute mapping"
More efficient DN list for LDAP role delete

The search to get the DNs in RoleApi::delete would return all
attributes for the entry rather than just the DN.

This fix uses the special attribute name 1.1 to indicate that
no attributes should be included in the response.

Change-Id: Ifac101cb1e145050ee9a517c47b6bd4fea99ffa5
Merge "Allow any attributes in mapping"
Merge "Remove LDAP password hashing code"
add dependencies of keystone dev-enviroment

add sqlite-devel and openldap-devel to dependencies

Change-Id: Ia8d0d996795f71ea2885c37d3b05bc1643e85202
Closes-Bug: #1290254
Discourage use of pki_setup

After a mailing list discussion it is clear that users need more
information to make a decision on how to setup their PKI tokens.

This recommends an external CA over using keystone pki_setup as it does
offer a bit more protection against an intruder being able to setup a
rogue token generator.

Change-Id: I798a562dd8c222e04660482b434ed3bbe6b63d62
Merge "Fixes for in-code documentation"