Add testcase for coverage of 002_add_endpoint_groups

There wasn't unit test coverage for (keystone.contrib.
endpoint_filter.migrate_repo.versions.002_add_endpoint_groups).

Change-Id: I902ff28a82a964f19835d2b16e46501e45fb1371
Fixes code comment to be more accurate

Change-Id: I4aaa57b05e9aab2ff223f62bd1f5fe0f37e7f247
Updates package comment to be more accurate.

Change-Id: I980b9fb37516f5775f11a01d93e82d5349b8850a
Update man pages

The man pages were out of date.

Change-Id: I9ce00b06ce2df6fe4f12c3fbeae9ad5ddbdbb13d
Closes-Bug: #1366944
Remove trailing space from string

There was an extra space at the end of the debug log string.

Change-Id: I96a231d136a829e049a4e026ed07ff3730eeb388
Making KvsInheritanceTests use backend KVS

The KvsInheritanceTests does not use backend
KVS as identity driver. This patch fix this
by setting it in the config_overrides method.

Change-Id: I45e80e18d7dbcd027493755a8bd30c3fc7e09638
Closes-Bug: 1364618
improve dependency injection doc strings

This also renames the provider_name argument to better convey it's
status as a kwarg for internal use only.

Change-Id: Ie1afee4e37cfa149ddb73a001985c98aa90b97a5
Fix Policy backend driver documentation

Change-Id: If5e0655eb6733cca1294d780f3a9446ed4ada357
Closes-Bug: #1362007
Adds hint about filter placement to extension docs

Since a filter cannot be the last entry in a pipeline it makes sense to
call that out in the extension documentation.

Change-Id: Idf73bdb6d6d237cbf9d108f67eeb8020caeaa364
Related-Bug: #1363932
Correct typos in keystone/common/base64utils.py docstrings

Closes-bug: #1366649
Change-Id: Ic3f4a3eb9da303a4da7d532f02f6c6e82a725924
Fix fakeldap search_s documentation

FakeLdap's search_s documentation said it only supported base and
subtree, but it also supports onelevel.

Change-Id: I7536855d5a94a5d570e993be1a1e3da92ddd9e0f
Refactor FakeLdap to share delete code

FakeLdap is changed to implement delete_s using delete_ext_s.

Change-Id: Ibf63f6e13da830b57a9f7ea5b9689d52d7bdf690
Fail on empty userId/username before query

Rather than attempting to query the database for an empty userId
that results in an error, just raise an error immediately that
has a better error message than one indicating a missing 'len()'
attribute.

Change-Id: I6db54d8f6114337d37be3cab20f60d7905243cba
Closes-Bug: #1368046
Merge "Making KvsInheritanceTests use backend KVS"
Merge "Adds hint about filter placement to extension docs"
Set LDAP certificate trust options for LDAPS and TLS

We currently only set the LDAP library certificate trust options
when TLS is being used (via startTLS).  If regular LDAPS is being
used, the certificate trust options that are defined in Keystone's
configuration file are never actually set.

This patch sets the certificate trust options for both LDAPS and
TLS cases.

Closes-bug: #1209343
Change-Id: Ieb94b732f623695920feb34995bb863175ddf27a
Document Keystone2Keystone federation

Document the following:
  - create a region
  - setup config options
  - run keystone-manage command for metadata
  - samlize the token

Change-Id: I771fc5bbe1bb57f36bfbc929f2c64d17c2641899
Change pysaml2 comment in test-requrements.txt.

    Even though the ``pysaml2`` library is used for Keystone2Keystone
    functionalities, Keystone will complain about missing dependency right
    after federation extension is enabled.
    Commend in the test-requirements.txt should be updated to reflect the
    situation.

Change-Id: Id4e615905574d5ad3d050bd8077b25f8327419ab
Revoke the tokens of group members when a group role is revoked

Fixes a bug introduced by the previous commit:
https://review.openstack.org/#/c/115338/

If revoke_api is not enabled, tokens of group members are not revoked
when a group role is revoked.

Change-Id: I7542ee775ddd6fd240ecb370a3e243e465accbb0
Closes-Bug: 1369664
Adds a whitelist for endpoint catalog substitution

Change-Id: If02327d70d0143d805969fe927898f08eb84c4c2
Closes-Bug: #1354208