Add new error for invalid response

There are a number of places where we expect a certain format of
response. If it's not found we often end up raising a KeyError when
accessing data.

Create a new Exception type that is raised when a HTTP response is not
appropriate for parsing and use it within authentication calls.

Closes-Bug: #1307306
Change-Id: I3cf2db07a8e76ee17702130e9efb0edf640d293a
Deprecate admin_token option in auth_token

The admin_token option shouldn't be used with the auth_token
middleware. It's used to specify a token to be used to perform
operations on the identity server, so would typically be set
to the admin token. The admin token should only be used to
initially set up the Keystone server, and then the admin token
functionality should be disabled. If this recommended setup is
used then the auth_token middleware shouldn't be using the
admin token / auth_token.

In preparing for removal of the admin_token option, the option
is now deprecated. A warning will be logged if it's set.

DocImpact

Change-Id: I5bc4f4a6ad7984892151c8011ccd92f166aba4c2
Closes-Bug: #1306981
Fix the catalog format of a sample token

This token is used for auth_token testing and is a valid v3 token other
than the catalog which is in v2 format.

Convert the catalog to V3 format. Whilst there pretty print the token so
we can more easily see what's happening.

Change-Id: I893ea6e76f3fcc20b13b331911d7b8288b98991d
Ensure that cached token is not revoked

We need to ensure that tokens won't stay in cache after they have been
revoked.

Changed default revocation_cache_time 300 -> 10 seconds.
revocation_cache_time has to be << than token_cache_time to make token
cache efficient.

Fixes bug #1287301

Change-Id: I14c0eacac3b431c06e40385c891a6636736e5b4a
Debug log when token found in revocation list

The auth_token middleware didn't log when a token is rejected
because it's in the revocation list. This adds a log message so
that it's easier to debug problems.

Change-Id: I1388ed04641d209ba2083a1096488edc22267ebe
Limited use trusts

Trusts now have a "remaining_uses" field that tracks how many times
a trust can still issue a token. It is decremented by 1 each time a
trust related authentication occurs (call to /auth/tokens), until it
reaches 0 and no token can be issued through this trust anymore. If
set to null (default value), trusts can be used indefinitely to
authenticate.
This is the client side of the implementation.

Closes-Bug: #1250617
Implements: bp trusts-chained-delegation

Change-Id: Ib035a9772b7f035c3a9af102e8e15a860a96a96d
Merge "Add new error for invalid response"
Merge "Fix the catalog format of a sample token"
Merge "Limited use trusts"
Merge "Ensure that cached token is not revoked"
Enhance tests for auth_token middleware

There was code in _verify_uuid_token that was not covered by unit
tests. This change increases the coverage.

Change-Id: I63e171a0a8e63ae599c967adc9ff09670063b807
Related-Bug: #1174499
Merge "Debug log when token found in revocation list"
Updated from global requirements

Change-Id: I274214f7924fc2edddfc54a81147a3b17123238f
Merge "Deprecate admin_token option in auth_token"
Fix typo in BaseAuthTokenMiddlewareTest

Setup was used where setUp is the name of the function.

Change-Id: Ie8aef4e128a443ddec48fc82cb7314081ee5bfd2
auth_token test remove unused fake_app parameter

set_middleware is never called with fake_app, so remove it.

Change-Id: Id4541f77a12a9d43f2761f8d1fd14d633f6944ac
Synced jsonutils from oslo-incubator

The sync includes change that drastically enhances performance on Python
2.6 with fresh simplejson library installed.

The latest commit in oslo-incubator:
- 732bdb6297eb9de81667f7713ebcb1ccc2ee45a7

Change-Id: Ib3dc0b713ed90396919feba018772243b3b9c90f
Closes-Bug: 1314129
Remove unused AdjustedBaseAuthTokenMiddlewareTest

assertDictEqual isn't used, and the assertIsInstance message
should be consistent across versions. This leaves nothing in
AdjustedBaseAuthTokenMiddlewareTest so remove it.

Change-Id: I7d338c9b66c77ff81a79d1a1d5c8ebcc3dd300a2
auth_token configurable check of revocations for cached

The auth_token middleware would fail if it couldn't fetch the
revocation list. If the system is configured for UUID tokens then
the revocation list may not be available.

With this fix, the revocation list will only be checked for
cached tokens if the new check_revocations_for_cached option
is set to True.

Also, this change prevents the revocation list from being
checked twice for a PKI token that's validate off-line.

Change-Id: I5408bbe12aefda608ebcb81cf3c7ef068b2bf2f6
Closes-Bug: #1312858
Fix docstrings in keystoneclient

Trusts and service catalog had a few malformed docstrings
that caused warnings when building docs.

Change-Id: Iea8612c3aaebea54c00b02c73c77f0c9e79f86bc
Partial-Bug: #1315523