Explicitly setting of PKI token signing cert

Enable setting of the cert, key, and cacert for PKI token signing.

Replaces abandoned change https://review.openstack.org/#/c/93598

Change-Id: I91f1c3c6f2d1fcb477699b2b23b56cbe22006d4e
Closes-Bug: #1319470
Require Class['mysql::server'], not Service['mysqld'] when creating DB.

When using version >= 2.2 of the MySQL module, setting up
the database for Keystone depended on the MySQL service
(Service['mysqld']). However, if the service is not managed
by Puppet (e.g. it is managed through Pacemaker instead),
this would cause catalog compilation to fail because there
is no Service['mysqld']. This is the case when the MySQL
module is called with service_manage => false. Requiring
Class['mysql::server'] instead fixes this.

Change-Id: Ia1b34051dd6e4fc0916ac788d6027c1f987418a8
Closes-Bug: 1349316
keystone_user_role supports email as username

When defining the keystone user with the email address, the keystone_user_role doesn't handle it correctly.

user: "user@example.org"
tenant: "test"

keystone_user_role { "user@example.org@test":
  roles = '_member_'
}

Because of the use of the split('@',2) method, user and tenant will be parsed as:
  user: "user"
  tenant: "example.org@test"

By using rpartition('@'), it will be correctly parsed as:
  user: "user@example.org"
  tenant: "test"

A unit test for the keystone_user_role provider is available.

Change-Id: I68139910bb82c62f26ba3433456e5406c99541a2
Closes-Bug: 1341552
Install dependency python-memcache when token driver memcache.

Token driver backends.memcache requires python-memcache which not
installed by default. As result keystone crash with exception.

Patch install python-memcache when it's need.

Change-Id: I752a97ad9b3135a7336265760f0cd3304e0277b4
Merge "keystone_user_role supports email as username"
Fix usage of admin_endpoint

The admin_endpoint in keystone.conf is used
to advertise for service discovery to a client, and
should not contain the identity version as this will
be appended based on which versions are available.

This patch changes the behavior of the native types that
depend on admin_endpoint and the service validation to
accept a url without a version appended. In both cases,
the version will be set to v2.0, as there is no suitable
conf option in keystone.conf from which the available
versions can be deduced. This allows the correct, versionless
admin_endpoint to be set in keystone.conf for the service
itself.

Change-Id: I0c1ebd9f1cf452828698555e7c642fac770aa73f
Merge "Install dependency python-memcache when token driver memcache."
Merge "Explicitly setting of PKI token signing cert"
spec: rename token_flush spec file

Rename keystone_cron_token_flush to keystone_cron_token_flush_spec to
follow standards.

Change-Id: If3ae62c0d262229c708616022a00fe25468ce9fb
Migrate mysql backend to use openstacklib::db::mysql

Implements: blueprint commmon-openstack-database-resource
Change-Id: I5dc293c1b8033000523fae504f789199599cf447
token flushing: don't override log file

Modify the crontab which flush old tokens to not override the log file,
and avoid deleting previous logs.

Change-Id: I11566d62b633f2d396badcb0b3e99f62929dfec9
Signed-off-by: Emilien Macchi <emilien.macchi@enovance.com>
Add extended logging options.

There is a range of extended logging options in Openstack services that use
openstack.common.logger (Ceilometer, Cinder, Heat, Keystone, Nova). Adding
keystone::logging to support them. This change is identical to
<https://review.openstack.org/#/c/113560/> but it applies to puppet-keystone
instead of puppet-ceilometer.

No blueprint/spec, as discussed in the IRC meeting on 08-11-2014.

Change-Id: I88fcf025b9467090d21d1a10a5af9b270f8ef11e
Don't create _member_ role from puppet

The _member_ role is provided by db migration or is created
automatically when user is created. Creating role _member_ from
puppet causes it to have different id than the one specified in
member_role_id keystone config option.

Change-Id: I3f0102b184a484f5e5a85cadf26ed651829fbf8c
Closes-Bug: rhbz#1129760
Merge "Migrate mysql backend to use openstacklib::db::mysql"
Merge "Add extended logging options."
Make user creation optional when creating service.

In some cases it is useful to be able to just configure
the service in Keystone and not the service user. This
is the case when e.g. a read only LDAP backend is used.
Added a parameter configure_user (defaults to true).
Closes-Bug: 1360232

Change-Id: I8f6d6f3903b9140bf22c676b3661c2dda5766db6
Merge "Fix usage of admin_endpoint"
Duplicate definition of parameters in ldap.pp

    Closes-Bug: 1367582

Change-Id: I9915cb884d9024ed2b71932826ffa4837884fd46
Use UUID as the default token provider

Keystone changed it's default token provider to UUID for Juno.
This patch changes the puppet-keystone default to match.

One of the existing spec tests was incorrect, and had to be removed.
The test was expecting signing certificate setup to be performed wen
enable_ssl is True, but that setup is really only performed when
configuring PKI format tokens.  There is already a test that covers
properly enabling SSL and PKI token format configuration, so this
incorrect test can be removed.

Change-Id: Id838bbb06602b9fe5331329c74872b62932ace1b
Closes-bug: #1372991
pki-setup should be run regardless of token provider

The puppet-keystone module currently will only execute
'keystone-manage pki_setup' to create the signing key if the PKI
token provider is being used. The signing key/cert is still used
for signing the token revocation list, even when the UUID token
provider is being used. We should be running
'keystone-manage pki_setup' if enable_pki_setup=true, regardless
of token provider.

Change-Id: I2817fbde74cbd50cae31f681503816e576cc7b60
Closes-bug: #1373064