Check that region ID is not an empty string

It generates an ID when a POST request to /regions has an empty string as ID

Change-Id: I49afd1f8c2e09ed31329bd8d1d88ca7f29ef7be9
Closes-Bug: 1322639
Details the proper way to call a callable

Change-Id: I288822ed3aa8a755fc90fbf7940da043995cb719
Remove duplicated asserts

Remove a couple of duplicated asserts from the test case for the
token model.

Change-Id: I4a7419845e3aa16dfe429cb839eb7c0a87bd7e96
bp: non-persistent-tokens
Refactor set domain-id and mapping code

Applied function separation refactorings to the
_set_domain_id_and_mapping function in the identity/core module in an
attempt to make it more readable.

Change-Id: I921a05b0164bc6afa329e98c26faf4cf4f336f2f
Do not consume trust uses when create token fails

Currently, remaining trust uses are consumed even when create token
fails. We should only consume trust uses when successfully creating
a token.

Change-Id: I55a726250312fa81ed9556dfd530e96f72548930
Closes-Bug: #1335037
Fix invalid self link in get access token

When getting a single access token, the `self` link didn't contain user section.
This commit fixes the url by overriding the method that generates the self
referential links and adds corresponding test.

Change-Id: I366ee2d691008b6b7412adb8cf95179129310728
Closes-Bug: #1279496
Add pluggable range functions for token flush

This patch refactors the flush tokens functionality to have a pluggable
expiration range strategy that can be customized based on database
backend.  The batch size method has been replaced with a method that
will return an appropriate iterator for choosing expiration ranges.

This patch also allows MySQL to use the batch flush functionality to
alleviate problems with Galera replication and large write sets.  Galera
has a modest size limit (1GB) on how large write sets can grow and this
can be reached fairly easily if you run expiration infrequently, or just
have a high token issue rate.

This also changes the mechanism to do batch flushes to a more portable
mechanism that does not require subquery support w/LIMIT.  MySQL does
not support DELETE with a subquery that uses LIMIT.

The batch expiration strategy will return a timestamp each time it's
called.  The flush function will then delete all expired tokens up to
that timestamp.  It is possible that this will delete somewhat more than
the `batch_size` number of rows, but it is expected that it will
typically be close to that number, and will effectively chunk the work
into roughly equal size batches.

Closes-Bug: 1188378
Change-Id: I2df68a35691e001083f41f43e9c325bd687f7ec8
Fix revoking domain-scoped tokens

A token scoped to a domain wouldn't be revoked for a domain-wide
revocation event. This is because the code to convert a token to a
dict for revocation event processing didn't handle domain-scoped
tokens.

Partial-Bug: #1349597

Change-Id: Ib2c58f3fc8790dbe7f8b073d18d3fa9b0dff608d
Add a test for revoking a scoped token from an unscoped

There was no test that showed that when a scoped token created from
an unscoped token is revoked that the unscoped token also winds up
being revoked.

Change-Id: I2c1574573488bb60a059c5d7f8747d6a1977aab7
Partial-Bug: #1347318
Catch correct oslo.db exception

Now oslo.db wraps all the database exceptions into specific oslo.db
exceptions. A test expects for IntegrityError where now returns
DBDuplicateEntry. We should catch DBDuplicateEntry to keep test
correctness.

Change-Id: I4576f19c4fd3db6742a6a2fbbca0e0e5400b792d
Closes-Bug: #1214341
KeyError instead of exception.KeyError

KeyError is a built-in error. Not part of Keystone exception module.

Change-Id: Ia3723c71fcd80773c2ac6f49ec7a7ab8bed602ad
closes-bug: #1349955
Fix revoking a scoped token from an unscoped token

When a scoped token that was created from an unscoped token was
revoked, the original token wound up being revoked. This is because
the scope wasn't included in the revocation event. By including the
scope in the revocation event only the scoped token is revoked.

Change-Id: I5652663ab7e1176d3b1efc5d218a8a020498067e
Closes-Bug: #1347318
Use config fixture from oslo.config

With the release of oslo.config 1.4.0.0a1, oslo.config
contains the config fixture. Keystone was using the config
fixture in oslo-incubator's fixture module. With this change
Keystone is using the config fixture in oslo.config

Change-Id: Id03efdfbe8893c48a9ad65f0cf59e1dbae03dc47
Remove fixture from openstack-common.conf

Keystone doesn't use anything in fixture, so remove it from
openstack-common.conf and re-sync with oslo-incubator 5fa2da to
remove unused parts.

Change-Id: Icec01fc7e3bcf3df03c1f8a589d13f8955c64380
Merge "KeyError instead of exception.KeyError"
Add filters to the collections 'self' link

The v3 collections wrapper automatically adds the collections links
(self, next, prev) to facilitate pagination. However, the 'self' url
link only contains the base url, without any specified filters.

This fix adds specified filters to the collections 'self' link.

To test this fix validations of list responses in test_v3_identity.py
were updated with the optional 'resource_url' parameter which triggers
the 'self' link validation.

Closes-Bug: #1195037.

Change-Id: Iff1bcf21ea4f716ea0f412b86b4c8e9126007b7b
Merge "Use config fixture from oslo.config"
Merge "Remove duplicated asserts"
Merge "Add filters to the collections 'self' link"
Merge "Do not consume trust uses when create token fails"