Set default token provider to UUID

This changes the default token provider to UUID, which affords a much
better deployer experience (no external dependencies and no additional
setup complexity) for deployers. It also provides a better end-user
experience (smaller, more manageable tokens) and appears to be the more
popular deployment option today, despite the current default to PKI.

DocImpact
Closes-Bug: 1350000

Change-Id: I7fb2b191cce7a9762c33fee09e7e8d48a71a297b
Remove trailing space in tox.ini

Change-Id: Ic523b92861ee1264b29cd12ece3fe12c177eed3f
Cleanup superfluous string comprehension and coersion

Remove the superfluous string comprehension and coersion to string
type in a join within the keystone.notifications module. The elements
in the namedtuple are already string types.

Change-Id: I107102fabc2f6671e10bcf1b5db40529fdb19d69
JSON Home data is required

For the initial implementation, the JSON Home data was optional. Now
that JSON Home is implemented, JSON Home data is required.

bp json-home

Change-Id: I5af70401fba892166cd107264e9d5eafe6bcbd03
Test cleanup: do not leak FDs during test runs

Avoid leaking file descriptors during test runs. Instead use a secure
tempfile fixture that guarantees the file descriptor from
tempfile.mkstemp is closed and that performs the appropriate cleanup
on the tempfile name in the cleanup phase.

Change-Id: I7e1ddd3122d72d8850794df9467f7b6c0608ac2d
Spelling errors fixed in the comments

Change-Id: I68abed3cbc0846a75d723ed7ca69c26d5903b446
Lower log level for notification registration

Registering an internal notification isn't something that an admin
would generally be interested in, and if they are they can configure
debug logging for keystone.notifications.

Closes-Bug: #1363704

Change-Id: Id7cd3bf2e1f373b818329978553eb53af399386c
General logging cleanup in keystone.notifications

There was an error message that wasn't translated.

Related-Bug: #1363704

Change-Id: Icdc21029c62e2b4b7fcb9b6853eac165175fe96a
Fix logging config twice

The config was being logged twice, once from keystone-all and once
from keystone.openstack.common.service. The logging done by
keystone-all is removed.

Change-Id: I7af03fb9db819b0ee21953988271c42ec8aa3c7a
Closes-Bug: #1363709
Mark the revoke kvs backend deprecated, for removal in Kilo

Although the kvs.Base was marked as deprecated, the individual
backends were not.  This marks the kvs revoke backend.

Change-Id: I6592cce10687e355536a4c9f89fc885692a73e23
Partially-implements: bp deprecated-as-of-juno
Fix follow up review issues with endpoint policy backend patch.

Change-Id: If5d741ae9efdbbbc84df15d30b83d1024c2b6f21
Closes-bug: 1363750
Remove TODO that was done

Keystone already has token routes.

Change-Id: I3c1ee1953070d04b3f787759cd619bcd07d2a40e
Create SAML generation route and controller

In order to take advantage of the new SAML generation code, we
need to create a route and controller in OS-FEDERATION.

corresponding api spec: https://review.openstack.org/#/c/113998/

Implements: bp keystone-to-keystone-federation

Change-Id: Ib27921fa1fcff8760836e065ede1e90d1330fd16
Implement validation on Trust V3 API

Use JSONschema on create operations on V3 Trust API.

This change refactors a lot of the test_v3_auth tests to get them to
pass with proper validation.

Closes-Bug: #1362344
bp: api-validation

Change-Id: If4b59a6ac84e308eff8bf5ea35772173b0ba7fe5
IdP SAML Metadata generator

Keystone acting as a SAML2 Identity Provider needs to be able to
generate and expose metadata that is consumed by federated
Service Providers.

Co-Authored-By: Steve Martinelli <stevemar@ca.ibm.com>
Change-Id: I9e4b2f068a8190215749b95f31d634eb09c1e3f1
Implements: bp keystone-to-keystone-federation
Generate IdP Metadata with keystone-manage.

For proper federation setup, an Identity Provider peer needs to
generate metadata that can later be consumed by a federated Service
Provider. Since metadata content doesn't change very often it's
advised to generate a static file and later read its content on demand
(this is out of the scope of this patch). This patch adds required
functionality for utilizing the federation.idp.MetadataGenerator class
from a keystone-manage command line tool. Generated metadata will
be redirected to the stdout.

Change-Id: Ifed1f4e4ede0276b3aba22aa9e236e5e74e2ed93
Implements: bp keystone-to-keystone-federation
Routes for Keystone-IdP metadata endpoint

Keystone acting as an Identity Provider should expose an endpoint
where federated peers can access its SAML2 Metadata file.

API spec: https://review.openstack.org/#/c/118074/

Change-Id: I94d26ce88d2468af71bc1c9d1cba1b422da4480e
Implements: bp keystone-to-keystone-federation
Fix minor nits for token2saml generation.

bknudson left few (mostly) minor comments on the token2saml patch.
This commit addresses them.

Change-Id: I755e4a064d5ada1215e82f143914af1bd1cfcd9d
Implements: bp keystone-to-keystone-federation
Implementation of Endpoint Grouping

The Endpoint Filter extension has been extended to support Endpoint
Grouping which provides a dynamic endpoint attribute filtering capability
that is directly associated with a project.

Change-Id: I7b628ac565f58077ff7521458cc1d02b3bf47d29
implements bp multi-attribute-endpoint-grouping
Merge "Remove TODO that was done"