Add ability to disable pki_setup

The enable_pki_setup parameter adds the ability to disable pki_setup,
allowing the user to manage the signing certificate himself.

Change-Id: Icb84e01adecdd3287ceb22defb9882f03ae8d96f
Closes-bug: #1278546
(cherry picked from commit e6b2315808d633deb88246c74f4c91c1da2ccc43)
Load tenant un-lazily if needed

The laziness added to the role to reduce keystone
lookups assumes that all tenants are present in @tenants
if they are present in the system, and will not refresh
the class variable if the tenant is not found in it.

This patch adds a keystone lookup in the event of the supplied
tenant not being in the class variable, which can happen if a
tenant is created after prefetching.

Change-Id: I48b13f6abc906cde4794dd46d7938126aae204b1
(cherry picked from commit 9f7fe1827348d69a6d8b62c0a334612064cca554)
Add log_dir param. by default and allow users to disable it

This commit add log_dir param and configures it to /var/log/keystone
(default location). Set log_dir to false allows users to disable logging
to a directory (usefull if syslog is enabled in order not to log twice).

(cherry picked from commit 5a48d7d4fb0916695f6a8d29db47f46123398ee0)
Change-Id: I83446ff8b70c1cc136c9e1bb24513006ac9cb5a8
Closes-bug: #1282296
Merge "Add log_dir param. by default and allow users to disable it" into stable/havana
keystone-client: update endpoint argument

Endpoint argument is now os-endpoint: http://git.io/dVjoPg

Change-Id: Ibe43dc4e55fd315ee9e6dc7d68606efdae57476a
Signed-off-by: Emilien Macchi <emilien.macchi@enovance.com>
(cherry picked from commit bea3a92c5658cd1245f33f344bc841932f68b043)
Add support to enable ssl keystone config

Currently there is no easy way to pass in enable ssl
and set the ssl options in keystone config. This
should expose the options to be set as part of
the ssl config in keystone.

Change-Id: Idb63406a90d8b1072e6781f820e62633aeb3bac7
(Cherry picked from b1603846cb6bd87df63bd409aef3336d5e139aed )
Don't set keystone endpoint by default

In the current version of the keystone::init class, the default
values for keystone endpoint URLs are unversioned, which can lead
to problems connecting to the endpoint.  This patch reverts to
the old behavior of not setting them at all by default, and includes
sample values with versioned URL's both in the header and tests
so that users know to use versioned URL's if they choose to
override the defaults.  It also updates the documentation in the
header accordingly and tidies it up a bit.

Conflicts:

	manifests/init.pp

Change-Id: Ib14edf152c1d208418f101ed48cdc38b18f840a2
Closes-Bug: #1287520
(cherry picked from commit Ib14edf152c1d208418f101ed48cdc38b18f840a2)
Relax regex when keystone refuses connections

Seems newer python-keystoneclient have a different excpetion message,
specifically they dropped the HTTP prefix.  Now we allow both messages to be
trapped.

Add some additional cases that are common regex now covers
 (HTTP 400)
 [Errno 111] Connection refused
 503 Service Unavailable
 Max retries exceeded
 HTTP Unable to establish connection
 Unable to establish connection to http://...

Change-Id: I71fada12b3dbb681288c7ef2891603f970910736
Signed-off-by: Paul Belanger <paul.belanger@polybeacon.com>
Signed-off-by: Andrew Woodward <awoodward@mirantis.com>
Ensure that mysql users are created before keystone-manage db_sync.

Otherwise keystone-manage might not have rights to populate keystone DDL.
Fixes puppet re-runs on controller node. Tenant transition is not supported by puppet and will 'fail', workarounded to 'warn' and thus continues. Reason: With a keystone backend to ldap, a user's tenant id is not reported by keystone user-get (and it is a hack in sql, see extra column json blob in user SQL table); thus, transitions would happen all the time (even if they are in that tenant already).
Merge branch 'havana' of https://github.com/gwdg/puppetlabs-keystone into havana