Bump stable/icehouse next version to 2014.1.3

Bump stable/icehouse next version to 2014.1.3

Change-Id: I0015685b92ba405307240f163ecb43b7080ca6dd
Signed-off-by: Chuck Short <chuck.short@canonical.com>
Remove `with_lockmode` use from Trust SQL backend.

Due to the lack of support of `SELECT .. FOR UPDATE` call in
MySQL + Galera, the use of `with_lockmode('update')` needs to be
removed from the Trust SQL backend when utilizing the MySQL
dialect.

Instead of the pessimistic locking method (row lock, table lock),
use optimistic locking. The consume_use method now attempts to
update the remaining_uses column for the trust in question only
if the remaining_uses equal the same number as on the initial
query. This is done in a loop with a 10-iteration failsafe to
prevent endless looping.

Conflicts:
	keystone/trust/backends/sql.py

Minor changes to the sql.py driver over the course of Juno
caused the conflict. The resulting code for consume has
not changed.

Change-Id: I1b8af6ce5709f829f345cd351ec9242d0217e743
Closes-Bug: #1325143
(cherry-picked from commit 0724fc4d27c90461de3310b3b2cb7387e6c92bba)
Implicitly ignore attributes that are mapped to None in LDAP

Attributes that are mapped to None in LDAP trigger a 500 error when
performing a search if they are not explicitly ignored in keystone's
configuration.  These attributes should always be ignored, even if
the admin left the attribute out of the ignore list.

Change-Id: Ibbabdd0013059d5720250816764021a0b3ce8ce0
Closes-bug: #1335437
(cherry picked from commit 10a3edb7800d380ed72fcbbaae98251998c0e2c7)
Fixes an issue with the XMLEquals matcher

The matcher implementation would fail to match two documents that are
semantically equivalent, but sibling elements appear in different
document order.

Change-Id: I99dc6401e73be4c61bb265c3258b6245f2e7bb34
Closes-bug: #1347891
No longer allow listing users by email

As specified in the bug description, the listing of users by using the
email attribute as a filter would cause an exception. This is because
the email is not a first class attribute, yet it was considered so in
the filters. Thus, this fix will prevent the exception while also
preventing the filtering by email.

Change-Id: Ibf4b51a91c1e47e8197af49855307460559a7fc9
Closes-Bug: #1306835
(cherry picked from commit 75cca803739a5b4ef197666589582802c7391e17)
Ignore broken endpoints in get_v3_catalog

Change-Id: Ifd858e9f37155e3806329c4688be494d0132a9c7
Partial-bug: #1347862
(cherry picked from commit 7e4aab33e2d38a87e26f9f4e65b4ba2097564fd2)
Ignore broken endpoints in get_catalog

If an endpoint is created with a malformed URL then get_catalog would
throw a HTTP 500 error. With this change we ignore all malformed
endpoints.

Change-Id: Ibe9a8fa49f410f2a76a0df732247bd6813fc734b
Partial-bug: #1347862
(cherry picked from commit 8737b43d2cc9cbc1af1ea7a0fbff39f1b1c50747)
Updates keystone.catalog.core.format_url tests

Since the tests were unit tests I moved them into the new directory
structure. I also added a few tests to increase the coverage to 100%.

Change-Id: I063f0712b83ddd7773458a5bb3d4f483c20eb2a2
Partial-bug: #1347862
(cherry picked from commit 7c1a3421077a1971742e7e9887793ad5f4c9f615)
Fixes catalog URL formatting to never return None

The old behavior was to return None if the URL template was not a string
(or not string-like). This was a mistake because a None should never be
able to make its way into the catalog.

This is based off of an IRC discussion that spawned from:
https://review.openstack.org/#/c/81528/4/keystone/catalog/backends/sql.py

Change-Id: I12b0362d3869a3ec8dc1a6fa34e934a221deecbc
Partial-bug: #1347862
(cherry picked from commit 8599aa5d8393e3217e04bd8fb4bca2b2eaa41a69)
Merge "Bump stable/icehouse next version to 2014.1.3" into stable/icehouse
Add workaround to support tox 1.7.2

Change-Id: I58542f6e7dbbad98517c09b6176b9827f66dd1ff
Partial-Bug: 1348818
(cherry picked from commit 61b44eaceb3f57ef1d34e6a358398e36f49ba396)
Merge "Ignore broken endpoints in get_v3_catalog" into stable/icehouse
Merge "Ignore broken endpoints in get_catalog" into stable/icehouse
Merge "Updates keystone.catalog.core.format_url tests" into stable/icehouse
Merge "Fixes catalog URL formatting to never return None" into stable/icehouse
Ensure token is a string

Token is passed as a header from wsgi to HTTPD
If that token is unicode, it triggers an exception in mod_wsgi

Closes-Bug: 1312971

Change-Id: I4bb6ef6c98fbcd35435956d701f1ee3281e9935a
(cherry picked from commit ba1bba8257716c2f5aa668e496173e96a80f0e43)
Catalog driver generates v3 catalog from v2 catalog

The default get_v3_catalog method in the catalog driver would just
raise NotImplemented. This method is given a default implementation
that generates the v3 catalog by translating the v2 catalog.

With this change, the templated and kvs catalog backends can
generate a v3 catalog.

(cherry picked from commit 8b9580456aa4223184f612330c31077624dbf0ff)

Closes-Bug: #1313458
Change-Id: I1646c7dcab90f2e0e9e370f48f7ee3643bd2fe3d
Merge "No longer allow listing users by email" into stable/icehouse
Avoid conversion of binary LDAP values

A few of the LDAP searches performed in the identity and assignment
LDAP drivers do not specify the list of attributes to return, which
causes all attributes present in the LDAP entry to be returned.  We
attempt to convery these values from utf8 to unicode, which fails
when we encounter a binary value.  This patch addresses this problem
in two ways.

The first is to only request the attributes that we actually need
returned from the LDAP server.  This avoids potential binary values
that we do not even need to be concerned with.

The second thing this patch does is to make our conversion code
more tolerant by ignoring attributes that contain binary values.  If
a binary value is present, we simply skip over that attribute in
the conversion and log a debug message.  We should not be encounting
binary values in a typical Keystone deployment, but this gives us
some protection just in case we do encounter a binary value.

Conflicts:
        keystone/assignment/backends/ldap.py
        keystone/identity/backends/ldap.py

Closes-bug: #1355489
Change-Id: I62325ab9c75bac67cca329fb7bd3c74aea7d2867
(cherry picked from commit 940551c6bdd1477574c1dee165efe75366343bd7)
Remove extraenous instantiations of managers

There were cases where a number of the API managers were being
instantiated more than one time. This could cause a number of
odd edge cases where the managers would have different
configurations and/or different dependency injection results.

The managers should now be properly instantiated only once
unless explicitly required (e.g. testing the token provider
manager raises an exception in badly configured states).

Conflicts:
	keystone/auth/plugins/token.py

Closes-Bug: #1294994
Change-Id: I1babb065065cb5b06899f59568020a1c38f1156c
(cherry-picked from commit 0a1cb0e20247a3c7856b409452b01ad6db8069f0)