fix EC2 Signature Version 4 calculation, in the case of POST

When calculating the AWS Signature Version 4, in the case of POST,
We need to set the CanonicalQueryString to an empty string. this
follows the implementation of the AWS and boto clients.

Change-Id: Iad4e392119067e246c7b77009da3fef48d251382
Closes-Bug: 1360892
Change 'secrete' to 'secret'

Removal of a spelling error.

Change-Id: If59dec6c226e86177019b665a5f0a0e5d42e6316
Stop using intersphinx

Remove intersphinx from the docs build as it triggers network calls that
occasionally fail, and we don't really use intersphinx (links other
sphinx documents out on the internet)

This also removes the requirement for internet access during docs build.

This can cause docs jobs to fail if the project errors out on
warnings.

Change-Id: I71e941e2a639641a662a163c682eb86d51de42fb
Related-Bug: #1368910
Fix the condition expression for ssl_insecure

In the existing code, self.ssl_insecure is a string. If insecure
option is set in nova api-paste.ini, whatever it is 'true' or
'false', kwargs['verify'] will become False. This commit corrects
the condition expression. This patch is backported from
https://review.openstack.org/#/c/113191/

Change-Id: I91db8e1cb39c017167a4160079846ac7c0663b03
Closes-Bug: 1353315
SAML2 federated authentication for ADFS.

Authentication workflow for the Active Directory Federated Services
(ADFS) by Microsoft is different from 'standard' ECP based one.
This plugin allows for authentication and fetching security token with SAML2
assertion inside, sending to the Service Provide and retrieving an
unscoped token.

Change-Id: I588de1967a7fb92c5928686d092895847553923a
Implements: blueprint add-saml2-cli-authentication
Handle federated tokens

Federated tokens don't include domains in the user object.
Keystoneclient should be able to estimate whether the token is a
federated one and, if so, don't expect user domain information.
In case of the federated token keystoneclient returns None in response
to user_domain_name and user_domain_id calls.

Co-Authored-By: Steve Martinelli <stevemar@ca.ibm.com>

Closes-Bug: #1346820
Change-Id: I3453275fa1b0a41b1c015b0c3a92895a77d69a41
Merge "Handle federated tokens"
Fix a doc_string error

Change-Id: Ib2ab829ed777a4f2fb13ec7426dffef99a4118ab
Add support for endpoint policy.

This adds the client library class for the endpoint policy extension.

Implements: bp endpoint-policy
Change-Id: I7153d7a093f4299d7f912b0b4a9a02ffacdb9e69
Updated from global requirements

Change-Id: I67a599e362685f7990175fb5668e6909d670a225
Merge "fix EC2 Signature Version 4 calculation, in the case of POST"
Merge "Fix a doc_string error"
Merge "SAML2 federated authentication for ADFS."
Merge "Fix the condition expression for ssl_insecure"
Do not iterate action.choices if it is none

Do not iterate action.choices in the method add_arguments
in the class OpenStackHelpFormatter if action.choices is
not iterable because it is none.

Change-Id: Ie7110adb798326e5856fddfb6a7365c663b84998
Closes-Bug: #1372152
Fix auth_token for old oslo.config

When running with a havana-level of oslo.config (<1.3.0),
applications with any config options in their api-paste.ini will
fail to start with an error like

 'StrOpt' object has no attribute 'type'

This is because the config options didn't have a type attribute
until 1.3.0.

During the grenade test, the havana level of oslo.config is used,
while the master level of keystoneclient is used, and also in the
havana tests the services are still using the keystoneclient
auth_token middleware.

Change-Id: I745c3e04f18941a2d41e191d43f61b926522bb9d
Closes-Bug: #1372422
Merge "Do not iterate action.choices if it is none"
Enumerate Projects with Unscoped Tokens

Creating a client with a session using an Unscoped tokens now sets auth
info in client.  This Auth Info is necessary in order to enumerate
projects.  This is the standard login path for Horizon.

Change-Id: I688a27cd0e7c98e7cf899ac65bb593a85171813f
Merge "Stop using intersphinx"
Merge "Enumerate Projects with Unscoped Tokens"