Add testcase for coverage of 002_add_endpoint_groups

There wasn't unit test coverage for (keystone.contrib.
endpoint_filter.migrate_repo.versions.002_add_endpoint_groups).

Change-Id: I902ff28a82a964f19835d2b16e46501e45fb1371
Fixes code comment to be more accurate

Change-Id: I4aaa57b05e9aab2ff223f62bd1f5fe0f37e7f247
Updates package comment to be more accurate.

Change-Id: I980b9fb37516f5775f11a01d93e82d5349b8850a
Remove trailing space from string

There was an extra space at the end of the debug log string.

Change-Id: I96a231d136a829e049a4e026ed07ff3730eeb388
improve dependency injection doc strings

This also renames the provider_name argument to better convey it's
status as a kwarg for internal use only.

Change-Id: Ie1afee4e37cfa149ddb73a001985c98aa90b97a5
Fix Policy backend driver documentation

Change-Id: If5e0655eb6733cca1294d780f3a9446ed4ada357
Closes-Bug: #1362007
Correct typos in keystone/common/base64utils.py docstrings

Closes-bug: #1366649
Change-Id: Ic3f4a3eb9da303a4da7d532f02f6c6e82a725924
Fix fakeldap search_s documentation

FakeLdap's search_s documentation said it only supported base and
subtree, but it also supports onelevel.

Change-Id: I7536855d5a94a5d570e993be1a1e3da92ddd9e0f
Refactor FakeLdap to share delete code

FakeLdap is changed to implement delete_s using delete_ext_s.

Change-Id: Ibf63f6e13da830b57a9f7ea5b9689d52d7bdf690
Fail on empty userId/username before query

Rather than attempting to query the database for an empty userId
that results in an error, just raise an error immediately that
has a better error message than one indicating a missing 'len()'
attribute.

Change-Id: I6db54d8f6114337d37be3cab20f60d7905243cba
Closes-Bug: #1368046
Set LDAP certificate trust options for LDAPS and TLS

We currently only set the LDAP library certificate trust options
when TLS is being used (via startTLS).  If regular LDAPS is being
used, the certificate trust options that are defined in Keystone's
configuration file are never actually set.

This patch sets the certificate trust options for both LDAPS and
TLS cases.

Closes-bug: #1209343
Change-Id: Ieb94b732f623695920feb34995bb863175ddf27a
Remove unused cache functions from token.core

With the move of functionality from token.core to token.persistence
the cache functions and import are no longer needed in token.core.

Change-Id: I97c96fff64b5c952155c4054df05b1b3ec3a83c5
Add info about pysaml2 into federation docs.

pysaml2 is only required for Keystone2Keystone federation. Due to code
structure, ``pysaml2`` needs to be installed in order to enable
federation extension. Since federation is an extension all the
dependencies are not in the requirements.txt file and will not be
installed by default. This patch updates federation docs adding
information that the library must be installed by hand.

Change-Id: Icc0b3b5cc0e22950a85bb58bbd3631c911be8621
add --rebuild option for ssl/pki_setup

Currently, if you run "keystone-manage ssl_setup" more than once,
it does not overwrite existing files under /etc/keystone/ssl, and
does not print or log an error message. Now, we add --rebuild option
for ssl/pki_setup to clean up the exist generated files and rebuild
the configure files. Also, if you run "keystone-manage ssl_setup"
more than once, it will print prompt message to tell you take
--rebuild option to rebuild configure files.

Change-Id: Ia1e6830c4c81d5a53317a522c526b79b67de1bce
Closes-Bug: #1308778
Update URLs for keystone federation configuration docs

Seems like the URLs for identity-api changed, and need to be
updated.

Change-Id: Icc42da0a0b3794da65b464d1232fef12e47bedc4
Closes-Bug: #1363917
Add a pool of memcached clients

This patchset adds a pool of memcache clients. This pool allows for reuse of
a client object, prevents too many client object from being instantiated, and
maintains proper tracking of dead servers so as to limit delays
when a server (or all servers) become unavailable.

The new memcache pool backend is available either by being set as the memcache
backend or by using keystone.token.persistence.backends.memcache_pool.Token for
the Token memcache persistence driver.

[memcache]
servers = 127.0.0.1:11211
dead_retry = 300
socket_timeout = 3
pool_maxsize = 10
pool_unused_timeout = 60

Where:
- servers - comma-separated list of host:port pairs (was already there);
- dead_retry - number of seconds memcached server is considered dead
  before it is tried again;
- socket_timeout - timeout in seconds for every call to a server;
- pool_maxsize - max total number of open connections in the pool;
- pool_unused_timeout - number of seconds a connection is held unused in
  the pool before it is closed;

The new memcache pool backend can be used as the driver for the Keystone
caching layer. To use it as caching driver, set
'keystone.cache.memcache_pool' as the value of the [cache]\backend option,
the other options are the same as above, but with 'memcache_' prefix:

[cache]
backend = keystone.cache.memcache_pool
memcache_servers = 127.0.0.1:11211
memcache_dead_retry = 300
memcache_socket_timeout = 3
memcache_pool_maxsize = 10
memcache_pool_unused_timeout = 60

Co-Authored-By: Morgan Fainberg <morgan.fainberg@gmail.com>
Closes-bug: #1332058
Closes-bug: #1360446
Change-Id: I3544894482b30a47fcd4fac8948d03136fd83f14
Merge "Add info about pysaml2 into federation docs."
Fix minor spelling issues in comments

Change-Id: I46e8cd74dd2af409d502b04843ca17ef63e7e2e1
Closes-Bug: #1371499
Merge "Update URLs for keystone federation configuration docs"
Fix create and user-role-add in LDAP backend

The LDAP backend while generating 'dn' for ldapadd operations
does not add the id attribute in the attributes list
While newer versions of LDAP server support this operatoin,
older ones reported error. Eg. OpenLDAP 2.3

This change set fixes that error by adding the required
attribute in the list to make it compatible with older
LDAP versions

Change-Id: I1ed3f53d325eb280e036fbbf8e83d2e645db53cd
Closes-Bug: #1340041