Fix the order of assertEqual arguments(keystoneclient, kvs, etc)

assertEqual method's arguments should be in
('expected', 'actual') order.

Change-Id: Ic429c9264a823c3b03ca3b5c898b4aeb96891504
Partial-Bug: #1277104
Fix test_provider_token_expiration_validation transient failure

The keystone.tests.test_token_provider.TestTokenProvider.
test_provider_token_expiration_validation test would fail if the
tests weren't run before the expiration period passed. This could
happen if the system was slow and the previous tests took a long
time causing a potential transient failure.

Change-Id: I123aadd55770002fe1c9ed9b17669d5212198aa3
Closes-Bug: #1278550
remove the unused variable in test_sql_upgrade

There is an unused variable in tests/test_sql_upgrade.py. It needs
to be removed.

Change-Id: Ia50a4e91319d1a4dce9515c8b910de28fa68fcb5
Add slowest output to tox runs (testr)

Add --slowest for all tox test runs that don't use other various
test commands.

Change-Id: I9f9fdcdda8895ba33c817f87b566794dbcd6ccb9
Filter LDAP dumb member when listing role assignments

When the LDAP assignment driver is used and the "use_dumb_member"
configuration option is enabled, the dumb member is listed when
listing the role assignments. This can be seen by running the live
LDAP tests, as the "test_list_role_assignments_unfiltered" test will
fail due to the additional role assignments for the dumb member.

This patch filters out the LDAP dumb member when listing role
assignments.

Change-Id: I585d54847778f02621b8201644ec9285495a63aa
Closes-Bug: 1280965
Make LIVE Tests configurable with ENV

To enable ldap live test, set the environmental variable
``ENABLE_LDAP_LIVE_TESTS`` to a non-false value.

To enable tls ldap live test, set the environmental variable
``ENABLE_TLS_LDAP_LIVE_TESTS`` to a non-false value.

To enable mysql sql live test, set the environmental variable
``ENABLE_LIVE_MYSQL_TESTS`` to a non-false value.

To enable postgres sql live test, set the environmental variable
``ENABLE_LIVE_POSTGRES_TESTS`` to a non-false value.

To enable db2 sql live test, set the environmental variable
``ENABLE_LIVE_DB2_TESTS`` to a non-false value.

This allows for running all tests in a standard run by simply setting
the appropriate environmental variables.

This moves the live tests to be skips if the specific live-test
environmental variables are not set.

Change-Id: I8c09a8dcfca3f9691306c5f416f688205171bda3
Closes-Bug: 1243392
Rename scope_to_bad_project() to test_scope_to_bad_project().

In class test_v3_federation.FederatedTokenTests rename method
scope_to_bad_project() to test_scope_to_bad_project() and make
tox launch it automatically.

Change-Id: Id5cbc9843eae122b4e1709ace494bf05e467f116
Closes-Bug: #1294393
Use oslo db.sqlalchemy.session.EngineFacade.from_config

Rather than passing the CONF dict to EngineFacade, Keystone can
use the new from_config factory function.

Change-Id: I60f30254431b512988a0f1811b3c119207b91ad7
Do not expose internal data on UnexpectedError

UnexpectedError now works much-more akin to SecurityError and
obscures internal data from being leaked unless running in debug
mode.

Change-Id: I8c8895f5c9db9f51dec014da24f7e86d607d0363
Closes-Bug: #1291047
Make domain_id immutable by default

We already allow the domain_id in User, Group and Project entities
to be made immutable by use of a config option.  By default, however,
the domain_id is mutable.

This patch switches this so that the domain_id is immutable by default.
Although this changes existing functionality, it is felt that since
nearly all non-trivial production implementations that use domains
are going to want to restrict domain admin personas with a suitable
policy file, leaving the domain_id mutable by default represents a
potential vunerability that could be exploited.

Closes-Bug: 1294293

Change-Id: I0cb9fd4dc520d0a15bf54f4d138a3794d0ccd1d9
Store groups ids objects list in the OS-FEDERATION object.

When issuing unscoped federated token store groups ids
object in the OS-FEDERATION objects instead of standalone
OS-FEDERATION:groups.

Change-Id: I116466c6eefae674d2245796dfd608b12d5d3e6d
Closes-Bug: #1294150
Merge "Rename scope_to_bad_project() to test_scope_to_bad_project()."
Merge "Make LIVE Tests configurable with ENV"
Add user_id when calling populate_roles_for_groups

The call to _populate_roles_for_groups was missing the user_id,
and was always defaulted to None.

closes bug: #1294781

Change-Id: Ic78c66a1cbd0a32630f7247f0176ced2de352921
Ability to turn off ldap referral chasing

When getting an ldap connection, check a config property to see if
referral chasing should be turned off.

Co-Authored-By: Dolph Mathews <dolph.mathews@gmail.com>
Change-Id: I3bb5cc11b3c5c9108cfa656d5f5de1eaeb103fe5
Closes-Bug: 1233365
Remove unused db_sync from extensions

The db_sync in the extensions isn't used, either by the tests or
by keystone-manage db_sync, so remove them.

Change-Id: Ia0598e8dae81e258a05767f47525d5c11acce8db
Uses generator expressions instead of filter

Change-Id: I3685a8ecb4d34258e44a1480c4f78aaaf4dca27c
Implements: bp keystone-py3kcompat
Merge "Store groups ids objects list in the OS-FEDERATION object."
Merge "Ability to turn off ldap referral chasing"
Merge "Add user_id when calling populate_roles_for_groups"