Encode/Decode LDAP parameters to/from UTF-8

The python-ldap API only accepts UTF-8 encoded strings therefore any
unicode values must be encoded to UTF-8 prior to passing to
python-ldap and conversely UTF-8 encoded strings returned from
python-ldap need to be decoded back from UTF-8 into unicode.

Need to use unicode() rather than str() to properly handle non-ascii
characters, but to be PY2/PY3 compatible use six.text_type.

Very few of the ldap tests were using non-ascii values, in fact
non-ascii values were restricted to only specific tests that
had 'unicode' in their test name. This is very weak test coverage.
Replace all occurances of 'fake', the standard string
used in the tests for test value with 'fäké' where the a has an
umlaut and the e has a diacritical. Visually they look almost the
same but will trigger the type of encoding exceptions we've seen
in the past.

This is the minimal backport for icehouse from the following
master commits:
https://review.openstack.org/#/c/82396/
https://review.openstack.org/#/c/82398/
https://review.openstack.org/#/c/82399/

Closes-Bug: #1172106

Change-Id: I6b328dfc8435457a8d7ff16320f3d869cfa1043c
Block delegation escalation of privilege

Forbids doing the following with either a trust
  or oauth based token:
  creating a trust
  approving a request_token
  listing request tokens

Change-Id: I1528f9dd003f5e03cbc50b78e1b32dbbf85ffcc2
Closes-Bug:  1324592
Merge "Encode/Decode LDAP parameters to/from UTF-8" into stable/icehouse
Make sure domains are enabled by default

Domains without an explicit 'enabled' key in the dict will now be
handled in the same way as projects are. This will ensure that
the KVS backend produces the same result as the SQL backend for
assignment.

Change-Id: I3b6d26278329841cfe1be5ce7f67ba6d3569785f
Related-Bug: #1311142
Properly invalidate cache for get_*_by_name methods

Use the original name for invalidating the cache on the
get_project_by_name and get_domain_by_name when performing update
operations on the name attributes.

Change-Id: If58a3b0a47501096f9fa9eb9cd7a6057f7b29298
Closes-Bug: #1311142
Bump stable/icehouse next version to 2014.1.2

Change-Id: Id7181755d3609c0ae91c2402b34f2de02c06a1f0
Merge "Make sure domains are enabled by default" into stable/icehouse
Merge "Properly invalidate cache for get_*_by_name methods" into stable/icehouse
Do not log 14+ INFO lines on a broken pipe error (eventlet)

Under eventlet if the client disconnects while Keystone is trying
to transmit data, approximately 14 lines of traceback are logged.

This could result in massive logs if done repeatedly; worst case
scenario could include a denial of service due to disk space being
exhausted.

Change-Id: Iaf14c64799daa7539d1bd85cb6c6457380c111d9
Closes-Bug: #1334466
Updated from global requirements

Change-Id: I8402f264446d94c43d00ef56fd0eb43a1551d979
Ensure that in v2 auth tenant_id matches trust

Previously if a trustee requests a trust scoped token for a project that
is different to the one in the trust, however the trustor has the
appropriate roles then a token would be issued.

Ensure that the trust that was given matches the project that was
specified in the scope.

(cherry picked from commit 1556faec2f65dba60584f0a9657d5b717a6ede3a)

Change-Id: I00ad783bcb93cea9e5622965f81b91c80f4570cc
Closes-Bug: #1331912
HEAD responses should return same status as GET

According to the HTTP spec, a HEAD request should return the same
status and headers as the GET request (including content-type and
content-length). The HEAD request simply strips out the body and
returns no body. Any case where HEAD routing returned a different
status code than GET, now returns the same status and headers.

Any case where HEAD was supported where GET was not supported now
supports both GET and HEAD.

The wsgi.render_response code now handles HEAD appropriately and
will maintain headers while enforcing no body data is returned.

The bulk of this change is to support the same behavior between
deploying Keystone under eventlet and under HTTPD + mod_wsgi. In
the case of deploying under HTTPD + mod_wsgi, there are cases
where mod_wsgi will turn a HEAD request into a GET request to
ensure that the proper response is rendered. With these changes
all HEAD responses will respond in the same manner under either
eventlet or mod_wsgi.

Change-Id: I13ce159cbe9739d4bf5d321fc4bd069245f32734
Closes-Bug: #1334368
(cherry picked from commit 82101a36d348ad0c3de10f455878828f4263ffe2)
Correct the region table to be InnoDB and UTF8

The region table was not specified as being InnoDB or UTF8 under
mysql initially. The migration will fail if the defaults for MySQL
are not set correctly. A new method has been added to the
migration_helpers module to detect and correct the InnoDB / UTF8
specific issue with the region table.

Change-Id: I374c3dd46a4292e8f9e74ef75a8bb463b951f135
Closes-Bug: #1334779
Merge "Updated from global requirements" into stable/icehouse
Updated from global requirements

Change-Id: Ic2c44e1410592d7080af7eb8f6df8f955382393c
Merge "Do not log 14+ INFO lines on a broken pipe error (eventlet)" into stable/icehouse
Merge "Correct the region table to be InnoDB and UTF8" into stable/icehouse
Don't override tox envdir for pep8

infra's run-pep8 job assumes the envdir for pep8 job is not
overwritten, so it can call out to .tox/pep8/bin/pip.

This bug is causing keystone pep8 job to occasionally fail in the gate.

If the motivation behind overriding the envdir jobs to use venv, one can
use devpi and/or wheels to speed up the process of building a venv.

This isn't a backport because in stable/icehouse Keystone didn't set
the venv for the cover job.

Change-Id: I32cd46152caa73e1308fdd216ba016c80a5a9b4f
Closes-Bug: #1352134
Add tests related to V2 token issued_at time changing

There was no test that showed that when a V2 token is used in a V3
context its "issued_at" time changes. This affects validating a V2
token using V3 and also revoking a V2 token. The tests show the
current incorrect behavior.

Partial-Bug: #1348820

Change-Id: I2a3443847b2699384413933ae164fdc183aa110f
(cherry picked from commit 556fb860311675fc437585651e4602b2908451eb)
Fix for V2 token issued_at time changing

When the server converted a V2 token to a V3 token it regenerated
the issued_at time.

This was causing the server to return a different issued_at time
when a V2 token was validated using the V3 API.

This was causing the server to fail to revoke a V2 token if it was
revoked before validating it first because the regenerated token was
considered to be after the revocation event.

Change-Id: I71fea3253295ee8794fb2c8211e1f030de3ae205
Closes-Bug: #1348820
(cherry picked from commit a4c73e4382cb062aa9f30fe1960d5014d3c49cc2)