Do not support toggling key_manglers in cache layer

Due to needing to pass the PKI token (complete id) to the backend,
the cache layer needs to ensure that the cache-key is always
shortened down to a reasonable length. Disabling the key_mangler
should only have ever been done in limited debug configurations.
Real deployments would be unable to reliably run without the
key mangler (due to cache-key length on most systems being
exceeded by the Token calls).

This change of ID being passed around is for supporting
non-persistent tokens.

DocImpact: configuration.rst updated to reflect the change in
           configuration options for keystone cache layer.
bp: non-persistent-tokens

Change-Id: Ia4eb3df7ccffa58ee867120f698e24d926f0ec9e
remove default=None for config options

In the cfg module default=None is set as the default value.
It's not necessary to set default=None when defining new
parameters.

Closes-Bug: #1323975
Change-Id: Ibd52063cf30ca7b5565b09ed4602c15d5def3645
Updated from global requirements

Change-Id: I726f4b9cfecddb90fe6f89f95689713dffd34fbc
Fix docs and scripts for pki_setup and ssl_setup

Make sure we document that pki_setup and ssl_setup scripts are not
recommended for production deployments.

Closes-Bug: #1291366
Change-Id: Ic0e163a7d54f7438b7963ed18a356137206dde8a
Add identity mapping capability

This adds the underlying capability of identity mapping that will be
needed for multi-backend unified identifiers. The mapping capability
is not yet wired into the rest of Keystone - a subsequent patch will
modify identity core and supporting files to do this.

In order for this patch to be totally invisible, the addition of
relevant config options, as well as documentation, is left to the
follow-on patch when this capability is exposed to cloud providers.

Partially Implements Blueprint: multi-backend-uuids

Change-Id: Idfcad2ef30195f7b7a25dfff52fc1498fc3fa9f1
Ensure that in v2 auth tenant_id matches trust

Previously if a trustee requests a trust scoped token for a project that
is different to the one in the trust, however the trustor has the
appropriate roles then a token would be issued.

Ensure that the trust that was given matches the project that was
specified in the scope.

Change-Id: I00ad783bcb93cea9e5622965f81b91c80f4570cc
Closes-Bug: #1331912
Ending periods in exception messages deleted

Some of messages contained a period at the end of line right after key
content. This created bad user experience while copying from the
terminal because this period was usually copied too.

Change-Id: If9a74f865f0813469f215bc6b4dd8a934fbf8f44
Closes-Bug: #1313837
Fix OAuth1 to not JSON-encode create access token response

The OAuth1 response was a JSON-encoded urlencoded string rather
than just a urlencoded string as expected.

This also enhances keystone.middleware.wsgi.render_response() to
support setting the Content-Type header in the response.

Closes-Bug: #1336910

Change-Id: I72dcb61cae712c3c76382d2d6067b4f5fad7729d
Merge "Ensure that in v2 auth tenant_id matches trust"
Merge "Ending periods in exception messages deleted"
Merge "remove default=None for config options"
Fix the section name in CONTRIBUTING.rst

The name of the section "If you're a developer, start here"
has changed in the wiki, now is "If you're a developer".
This commit updates it to correctly refer to the
proper section.

Change-Id: I36c7e868f1c77d9efef0a0eadce9342212423c65
Correct docstring for assertResponseSuccessful

The example had a parameter that didn't exist for the method.

Change-Id: I17a63326e109776dd3192cfb8af5ca85f49a8e5f
update example with a status code we actually use

Keystone doesn't return HTTP 203 today, so the example is a bit
misleading. HTTP 204 is something we use on assignment operations, for
example.

Change-Id: I874c02ae44f4d49848c49451c40005c7f1e33865
Add schema check for OS-FEDERATION mapping table

Implement 'mapping' schema check ensuring the table was correctly
created in the database.

Change-Id: Ic69864bb4327657dc1b981de4229abce9e86aa86
Sync with oslo-incubator e9bb0b59

This syncs Keystone with oslo-incubator commit hash
e9bb0b596650540f336afb070a1f8c7de099721f .

In keystone:

 $ rm -r keystone/openstack/common

In oslo-incubator:

 $ git checkout e9bb0b596650540f336afb070a1f8c7de099721f
 $ python update.py ../keystone

Commits
-------
bc48099 Log the function name of looping call
109e325 Use oslo.messaging to publish log errors
de4adbc pep8: fixed multiple violations
9651085 generator: remove unused param, small clean up
eac71f5 Fix common.log.ContextFormatter for Python 3
238e601 Make policy debug logging less verbose
250cd88 Fixed a new pep8 error and a small typo
5e3d3a5 Mask passwords included without quotes at the ends of commands
e7c8a45 Improve error handling for conf sample generation
9e88af1 fixed typos found by RETF rules
5f12bba Implement stop method in ProcessLauncher
0d7296f Add kwargs to jsonutils.load(s) functions
9c88dc3 file_open: fixed docstring to refer to open() instead of file()
d78b633 Fixes a simple spelling mistake
621d831 always log a traceback in the sys.excepthook

Change-Id: I4ef56ce08e1f3bbc0ddb82a495da153e09a14c50
Merge "Fix docs and scripts for pki_setup and ssl_setup"
Merge "Fix the section name in CONTRIBUTING.rst"
Updated from global requirements

Change-Id: I302b2ba8b4d608d689cadbf8e5b4bd29764465e3
Merge "Fix OAuth1 to not JSON-encode create access token response"