Check that region ID is not an empty string

It generates an ID when a POST request to /regions has an empty string as ID

Change-Id: I49afd1f8c2e09ed31329bd8d1d88ca7f29ef7be9
Closes-Bug: 1322639
Details the proper way to call a callable

Change-Id: I288822ed3aa8a755fc90fbf7940da043995cb719
Refactor set domain-id and mapping code

Applied function separation refactorings to the
_set_domain_id_and_mapping function in the identity/core module in an
attempt to make it more readable.

Change-Id: I921a05b0164bc6afa329e98c26faf4cf4f336f2f
Fix invalid self link in get access token

When getting a single access token, the `self` link didn't contain user section.
This commit fixes the url by overriding the method that generates the self
referential links and adds corresponding test.

Change-Id: I366ee2d691008b6b7412adb8cf95179129310728
Closes-Bug: #1279496
Add pluggable range functions for token flush

This patch refactors the flush tokens functionality to have a pluggable
expiration range strategy that can be customized based on database
backend.  The batch size method has been replaced with a method that
will return an appropriate iterator for choosing expiration ranges.

This patch also allows MySQL to use the batch flush functionality to
alleviate problems with Galera replication and large write sets.  Galera
has a modest size limit (1GB) on how large write sets can grow and this
can be reached fairly easily if you run expiration infrequently, or just
have a high token issue rate.

This also changes the mechanism to do batch flushes to a more portable
mechanism that does not require subquery support w/LIMIT.  MySQL does
not support DELETE with a subquery that uses LIMIT.

The batch expiration strategy will return a timestamp each time it's
called.  The flush function will then delete all expired tokens up to
that timestamp.  It is possible that this will delete somewhat more than
the `batch_size` number of rows, but it is expected that it will
typically be close to that number, and will effectively chunk the work
into roughly equal size batches.

Closes-Bug: 1188378
Change-Id: I2df68a35691e001083f41f43e9c325bd687f7ec8
Fix revoking domain-scoped tokens

A token scoped to a domain wouldn't be revoked for a domain-wide
revocation event. This is because the code to convert a token to a
dict for revocation event processing didn't handle domain-scoped
tokens.

Partial-Bug: #1349597

Change-Id: Ib2c58f3fc8790dbe7f8b073d18d3fa9b0dff608d
Add a test for revoking a scoped token from an unscoped

There was no test that showed that when a scoped token created from
an unscoped token is revoked that the unscoped token also winds up
being revoked.

Change-Id: I2c1574573488bb60a059c5d7f8747d6a1977aab7
Partial-Bug: #1347318
Catch correct oslo.db exception

Now oslo.db wraps all the database exceptions into specific oslo.db
exceptions. A test expects for IntegrityError where now returns
DBDuplicateEntry. We should catch DBDuplicateEntry to keep test
correctness.

Change-Id: I4576f19c4fd3db6742a6a2fbbca0e0e5400b792d
Closes-Bug: #1214341
Fix revoking a scoped token from an unscoped token

When a scoped token that was created from an unscoped token was
revoked, the original token wound up being revoked. This is because
the scope wasn't included in the revocation event. By including the
scope in the revocation event only the scoped token is revoked.

Change-Id: I5652663ab7e1176d3b1efc5d218a8a020498067e
Closes-Bug: #1347318
Remove fixture from openstack-common.conf

Keystone doesn't use anything in fixture, so remove it from
openstack-common.conf and re-sync with oslo-incubator 5fa2da to
remove unused parts.

Change-Id: Icec01fc7e3bcf3df03c1f8a589d13f8955c64380
Issue multiple SQL statements in separate engine.execute() calls

Some sqlalchemy drivers (eg: mysqlconnector) don't support
engine.execute("sql stmt 1; sql stmt 2;") and require a separate
execute() call for each SQL statement.  After discussions with
sqlalchemy author, he confirmed it would be better to fix callers rather
than attempt to patch in support for multiple statements.

With this fix, keystone-manage db_sync succeeds using mysqlconnector.

Change-Id: I658a4dd479dbdcd07345c97d810c85aada3fa35b
Merge "Refactor set domain-id and mapping code"
Fix revocation event handling with MySQL

When MySQL is used to store revocation events, events are returned
from the database with the timestamps truncated to the second. This
causes a revocation event for a token (which has the issued_at
timestamp to the microsecond) to not match the revocation event and
therefore the token is not considered to be revoked.

The fix is to have the revocation events and token timestamps both
always be truncated to the second. This will cause all tokens for a
user that are issued within a second to be revoked when any of those
tokens are revoked, which shouldn't be a problem.

Change-Id: Ibd82b4ce910206dfd504c396614ae2ebed025e9b
Closes-Bug: #1347961
Update the config file

Noticed that some of the ec2 options no longer appear, so I ran
tox to update the config file.

Change-Id: I886d76f9d1201bdbb066b76928de7fe6244dfb58
Trust unit tests should target additional threat scenarios

This adds unit tests for two threat scenarios around the trust functionality
that are not currently tested.

The first scenario is related to deletion of a grant that has been previously
delegated via a trust. We need to ensure that executing a trust for a role that
the trustor no longer has is rejected.

The second scenario is related to an attempt to use a trust token with
impersonation to execute another trust as the impersonated user. We need to
ensure that a trust token can't be used to execute another trust.

SecurityImpact
Closes-Bug: #1347909
Change-Id: Ie1a0c286ff7e513cd964d4a93855230c78b98c6c
Refactor existing endpoint filter tests

Refactored the existing suite of endpoint filter tests including
renaming method names to aid readability and added additional
comments.

Change-Id: I98ded2632a6130e2b664e987f08499162801be6b
Merge "Check that region ID is not an empty string"
Filter List Regions by 'parent_region_id'

List Regions (GET /regions) has an optional query parameter
'parent_region_id', but the API still returns all the regions.

This fix adds support of filtering regions by an optional query
parameter 'parent_region_id'.

Closes-Bug: #1350192

Change-Id: I59f8d852870bd3ad26622bfcd00dfadfdf9d5b42
Class for V3 router packages

The V3 routes were being added by the append_v3_routers function in
each controller package, so the only way state could be stored is in
a global variable which makes unit testing difficult. With this
change, the append_v3_routers functions are put into a class in each
package. This will eventually be used to store JSON Home data.

bp json-home

Change-Id: I744a4c82dc84bb1a8d29d0314e3c51cc43c077a2
Enhance V3 router class for resources

RESTful APIs are resource-oriented, and Keystone provides a
RESTful API, but the current way that routes are being mapped is
based on URLs rather than resources. With this change, the base
Routers class is enhanced to support a resource-oriented way to
map paths to controllers and methods.

bp json-home

Change-Id: I0ba856845116b3ddd3dfed4608be65a87d9c01dc