Allow specification of optional domain name space

This documents the v3 api changes proposed to represent the optional
support for domain name spaces, allowing uniqueness of user and
project names to be either global or domain wide.  These changes
match the spec that was part of the blueprint.

blueprint domain-name-spaces

DocImpact

Change-Id: Ib824c5c9f441a78b5009e1954d97427e869ed2e4
Enable token scoping to a domain

This documents v3 api changes to allow a token to be scoped
do a domain as well as a project.  Now that keystone supports
RBAC on its own APIs along with domain level entities (like
users and groups), then it is appropriate to allow token
scoping to a domain to facilitate supporting roles like
Domain Administrators.

blueprint domain-scoping

Since they are so interrelated, this proposal also fixes
defect 1081681 (Unclear how domain_id is set for a user in v3 api).

DocImpact

Change-Id: Ica8594055f0a6bbb3fcda5a75a90eda45aac47d3
Disable domain does not cascade

As gyee pointed out in a related review[1], disabling a domain does not
need to cascade to owned projects/users as the effect of disabling a
domain only needs to be enforced service-side when a user is requesting
auth.

[1]: https://review.openstack.org/#/c/19787/

Change-Id: Ibd9882bdb933381f26a9ac4daf7e78ddf5dc53b3
Merge "Disable domain does not cascade"
(trivial) indiciate certain calls return a List

"List entities ..." rather than "Get entities ..."

Change-Id: I463a0801a7fbc04d537e61f3cfbf115737f35acb
Remove old refs to Policy's endpoint_id attr

Change-Id: I9686e4080f46988c41b3872cb85d111d0daf9ecb
Add Credential's user_id to examples (req attr)

Change-Id: I45e447e8bce7fb86724ab9351e423b63284b5d2f
Merge "Add Credential's user_id to examples (req attr)"
Merge "Remove old refs to Policy's endpoint_id attr"
Domain_id should be optional for Projects

Like User and Group, the domain_id should be an optional attribute for
a Project, as opposed to being required. Also updated the desciption of
the domain that will be used if it is not specified by the cleint for
Users, Groups and Projects

bug #1110758

Change-Id: Ia100d15b9988c056485eea4393a05734c44f915e
Addition token API changes.

See

https://etherpad.openstack.org/grizzly-keystone-v3api

Change-Id: Ied7552c37c0b9b68a175dd754fb98cd09b9544c1
Each Domain has its own namespace

Previously, a domain could be optionally defined with a private
namespace - meaning that the name uniquness of user and project
entities owned by it would only have to be unique within that
domain.  The fact that there could exist a mixture of domains,
some with and some without such a namespace causes confusion
complexity, both for the api itself as well as poentially for
cloud administrators.  This change therefore defines that a
domain always has its own namespace for user, group and project
names (i.e. they only need to be unique within that domain).

The use of domains remains optional - i.e. it is a supported
configuration to run without any explict domains, in which case
the name uniquness constrains are identical to previous releases
of the Identity Service.

blueprint domain-name-spaces

Change-Id: Id2f5ffc275b9ef3ab0937f6874d12d07a86d8b74
Listing Users should support domain_id in query filter

Listing Groups and Projects support domain_id in their query
filter, for some reason this was missing from Users.  I also
re-ordered the query filter options for Users and Projects to be
alphabetical, to match how we give entity examples.

Fixes bug #1118161

Change-Id: I2c99acb175b3f2184536d5f5b4a57702889eb8be
Remove "default domain" & restore unscoped token

- Removes mentions of a default domain (which is intended to be an
  implementation detail). Everything the document describes as a
  behavior related default-domain can be more simply achieved by having
  the client assume a default domain ID value of `default` to correspond
  with the current implementation (e.g. --os-domain-id=default), rather
  than specifying a one-off behavior at the API-level.
- The previous wording left no room for a token without a defined
  authorization scope

Change-Id: Idde45a884dd56748bb3f1409116e7783bdd1a2ed
V3 token operations should use /v3/auth

Change-Id: I8517605567bc79f585f25ff14027ecb73ef5e993
Merge "Listing Users should support domain_id in query filter"
Spelling corrections

Also replaced fancy slant’d quotes with straight single quotes.

Change-Id: I87b60975493fdd17ff6aa9111aaeef56cb800380
Remove 'auth' container

Change-Id: I360e438445e78314c0095261a3f36dd80c10b422
Merge "V3 token operations should use /v3/auth"
Merge "Spelling corrections"