add policy entries for /v3/regions

This adds entries to policy.json for v3 region CRUD including a refactor
around the create_region* methods such that there only needs to be one
entry in policy.json for both API methods (POST /v3/regions and PUT
/v3/regions/{region_id} are both enforced by 'identity:create_region').

This also corrects the HTTP response code on create_region (from 200 OK
to 201 Created) by explicitly setting it and makes the tests a bit more
dynamic.

Closes-Bug: 1272496
Closes-Bug: 1272501
Change-Id: Icaa9b005788b50342d5fdb334055f5fad25436d9
Update oslo-incubator log.py to a01f79c

This updates the log module from oslo-incubator to
a01f79c3050962fd744239956e9654407d14ea1f

 $ git checkout a01f79c3050962fd744239956e9654407d14ea1f
 $ python update.py --nodeps --base keystone \
     --dest-dir ../keystone --modules log

This includes a fix for the deprecated logger that caused the
deprecated message to be printed multiple times rather than once.

Change-Id: I6174b064205adcdc9fb966a9e01eb5190b5b730e
Closes-Bug: #904307
Closes-Bug: #1266812
Fix webob.exc.HTTPForbidden parameter miss

HTTPForbidden should use the parameter 'explanation'
instead of 'detail'.
This patch fixes this bug.

Change-Id: I0ebc01e8bbcc564debce450ea52faf94faa21eeb
Closes-Bug: #1283872
Fix the order of assertEqual arguments(v3_auth, v3_identity)

assertEqual method's arguments should be in
('expected', 'actual') order.

Change-Id: I771c0356518eceded52b045cba2177ab5dd7f4b1
Partial-Bug: #1277104
Fix assertEqual arguments order(backend_ldap, cache, v3_protection)

assertEqual method's arguments should be in
('expected', 'actual') order.

Partial-Bug: #1277104

Change-Id: I311590525bfebd3c587af6a94f6989df66dc2064
Fix assertEqual arguments order(_ldap_tls_livetest, backend_kvs, etc)

assertEqual method's arguments should be in
('expected', 'actual') order.

Partial-Bug: #1277104

Change-Id: I48d2220ebd39d72de071a4644b75182941bb5f4f
Replace assertEqual(None, *) with assertIsNone in tests

Replace assertEqual(None, *) with assertIsNone in keystone's tests
to havemore clear messages in case of failure.

Closes-Bug: #1280522
Change-Id: I5a857fcb3bfebc6ff14871df6b2cd1dee44596b2
Remove common.sql.migration

common.sql.migration has forgotten to be deleted. Now the file is unused.

Change-Id: I4075197185e21fab0accea0ed9826cc4f6d90fde
Blueprint: use-common-oslo-db-code
Handle exception messages with six.text_type

Handle exception messages with six.text_type instead of using
`str`. This is required to prevent of entering bytes to a database and
prevent unexpected behavior of database and database driver.

Change-Id: Idb54ee271cfb09e8523e357674b598b11704742c
Closes-Bug: #1273301
oauth1 extension migration fails with DB2

Running keystone-manage db_sync --extension oauth1 would fail when
using DB2 with an error that the REQUESTED_ROLES column isn't
defined on the REQUEST_TOKEN table.

This problem is worked around by dropping the NULL constraint
first and then renaming the column.

Change-Id: I58438cad4d645c553da5710455e8a219b8fd3014
Closes-Bug: #1284740
Fix issue with DB upgrade to assignment table

There are two changes:
- Commit changes to the grant tables after each update to ensure MySQL
  doesn't get confused when there are multiple assignments for a given
  actor/target (Postgresql doesn't have this issue)
- Close any sessions in test_sql_upgarde before we call the migrations,
  to ensure table dropping won't be blocked

Fixes bug 1284700

Change-Id: I81704b17ea9c11be926018df125fcfdb79ee6271
v3 endpoint create should require url

The url parameter of endpoint object is not nullable in db, but we
do not have a null check in api. So, when create a endpoint if I
do not specify url parameter I will get a 500 reponse.
This patch will add an attribute require check to url parameter.

Change-Id: I9c8aa3bcb99ea5cb5e4e4d3306d8d222c6f074d1
Closes-Bug: #1284422
Support for mongo as dogpile cache backend.

With this new optional caching backend, MongoDB can be used for caching data.

Change-Id: I25ba1cac9456d5e125a5eac99d42330507d4e329
Blueprint: mongodb-dogpile-caching-backend
Ensure v2 API only returns projects in the default domain

The assignment backend already has a call ready and waiting for this, so
it is just a matter of calling it.

Fixes bug 1276244

Change-Id: Ibff49202c8ca17df0344e48813916936edd3aa62
Cleanup and add more config help strings

Cleanup and add expanded helpstrings for the auto generated sample
config.

Change-Id: I2106d8efee9934e6a48e5d0184c5a63754816a74
Merge "Fix issue with DB upgrade to assignment table"
Fix table name typo in test_sql_upgrade

There was an assertion that group_domain__metadata didn't exist.
The table is called group_domain_metadata so this wasn't asserting
anything useful.

Change-Id: I27e64a2d29ad51b24d42f2dfc9c2143506917410
Merge "Ensure v2 API only returns projects in the default domain"
Merge "Cleanup and add more config help strings"
Support authentication via SAML 2.0 assertions

This patch will support authentication via SAML 2.0 assertions.
A new authentication plugin will allow external users to authenticate
with keystone, provided the incoming assertion is valid.

The file keystone/contrib/federation/controllers.py was extended with two
new controllers.V3Controller classes:

*) DomainV3 which handles /v3/OS-FEDERATION/domains API call and returns
   list of domains a user can access based on the provided list of groups.

*) ProjectV3 which handles /v3/OS-FEDERATION/projects API call and returns
   list of project a user can access based on the provided list of groups.

Change-Id: I89f70e3a24e825e21580772c088c6fd5c44f3b63
Implements: blueprint saml-id