Configurable python-keystoneclient repo

The URL for the python-keystoneclient repo couldn't be configured.
With this change, the user can set the OPENSTACK_REPO environment
variable to set the URL for where the python-keystoneclient repo
should be cloned from. So for example you can use a local clone.
The default OPENSTACK_REPO is https://git.openstack.org/openstack
which gets python-keystoneclient.git added ot it to make the clone
come from
https://git.openstack.org/openstack/python-keystoneclient.git.

Change-Id: I936713af3c11e8d68d8739dc68eefabd645df294
Set default token provider to UUID

This changes the default token provider to UUID, which affords a much
better deployer experience (no external dependencies and no additional
setup complexity) for deployers. It also provides a better end-user
experience (smaller, more manageable tokens) and appears to be the more
popular deployment option today, despite the current default to PKI.

DocImpact
Closes-Bug: 1350000

Change-Id: I7fb2b191cce7a9762c33fee09e7e8d48a71a297b
Allow LDAP lock attributes to be used as enable attributes

Some LDAP servers support disabling accounts via a boolean "lock"
attribute. For these servers, a value in LDAP of "True" means that
the account is locked, while a value of "False" means the account
is active. When the "user_enabled_mask" and "user_enabled_emulation"
options are not in use, Keystone currently expects a boolean
"enabled" attribute where "True" means the account is enabled and
"False" means the account is disabled.

To support LDAP account lock attributes, we need a way to tell
Keystone that the boolean values from LDAP are inverted. This
adds a new "user_enabled_invert" setting that allows the enabled
boolean logic to be inverted in the resource (LDAP), while leaving
the logic as-is in the model (Keystone user object).  The existing
default behavior remains as-is.

DocImpact
Change-Id: I2a89d4b98c854e68e1bb10f53b8b29d92f945f60
Closes-bug: #1337029
Remove trailing space in tox.ini

Change-Id: Ic523b92861ee1264b29cd12ece3fe12c177eed3f
Back off initial migration to 35

Upgrading from the Havana release to Juno is failing because the
initial Juno migration doesn't include a couple of migrations that
weren't in the initial Havana release but were added afterwards.

This change adds the 036 migration from Havana back in and moves
the initial Juno migration back to 035.

Change-Id: I1045696d66d7a63587aaaf70230a5eaf46e7d65d
Partial-Bug: #1357498
Back off initial migration to 34

Upgrading from the Havana release to Juno was failing because the
initial Juno migration didn't include a couple of migrations that
weren't in the initial Havana release but were added afterwards.

This change adds the 035 migration from Havana back in and moves
the initial Juno migration back to 034.

Change-Id: I012b3f707659557d1774bae78b1dd652bb1a4dd7
Closes-Bug: #1357498
Redirect stdout and stderr when using subprocess

The standard output and standard error streams where not captured
and logged in any meaningful way. This change captures those
streams and logs them in debug mode and when an exception is raised.

Closes-Bug: #1183526
Co-Authored-By: David Stanek <dstanek@dstanek.com>
Change-Id: I37fc99e0f857d21ddd02b15234a42fec5810bc03
Standardizing the Federation Process

Split functionality for attribute extraction and mapping layer
for saml2 auth plugin. Renamed to mapped.py, leaving original file
for backwards compatibility.

Co-Authored-By: Guang Yee <guang.yee@hp.com>
Implements: bp generic-mapping-federation

Change-Id: If9a8cbf62334c796a70e939bf00e7b194e5749c8
Create authentication specific routes

These routes are purely based on your current authentication and bridge
the gap between what is available in the standard identity-api for
fetching scope targets based on user_id and what is required for the
federation APIs.

Implement /auth/projects /auth/domains and move /catalog to
/auth/catalog

Change-Id: I464c0ca5cc9f250d593340e9563de45b077dd4cd
Implements: blueprint auth-specific-data
Fixing simple type in comment

Change-Id: Ia213bf0b842484360633a3d851d74cff5bfb3a8e
Add audit ids to tokens

Add audit identifiers to each token. If the token is a rescoped token
the audit identifier will be a list where index 0 being the token's 
audit id and index 1 is the initial token in the chain's audit_id.

If the token is not rescoped, the token's audit_ids will only contain
the audit_id of the token itself (at index 0).

This change is to resolve a method of performing token revocations
on individual tokens without needing to rely on the low
resolution of token expires time.

DocImpact

Change-Id: If5fdf187bd525f273281f9fdf53bdc8865164289
bp: non-persistent-tokens
Sync with oslo-incubator

Syncs Keystone with oslo-incubator commit hash
a9e1122f44deedeeb5dc824b6c085bb9beb08452

Commits since last sync (5fa2dae4):
-----------------------------------
037dee0 Set stevedore log level to WARN by default
ad248f6 Specify namedtuple_as_object=False when using simplejson
1c3ecfc Enhance versionutils.deprecated to work with classes
37c0091 Add unicode coercion of logged messages to ContextFormatter
6614413 Correct coercion of logged message to unicode
1188d88 Except socket.error if syslog isn't running
ac995be Fix E126 pep8 errors
631f880 Set keystonemiddleware and routes.middleware to log on WARN level
726d00a Adjust oslo logging to provide adapter is enabled for
9a46271 Add Kilo release name to versionutils
433fa0b Make logging_context_format_string optional in log.set_defaults
a2ad3a2 Allow deprecated decorator to specify no plan for removal
2b966f9 Fix deletion of cached file for policy enforcer
ac92c06 Add default log level for websocket

Change-Id: I244115cb31a3f90951be8914091a1a0175930442
bp: non-persistent-tokens
Sync Py2 and Py3 requirements files

bp python3

Change-Id: Ie6cd87bed5797bb9d845b0d9e9d0fa0410eab5c6
Convert to urlsafe base64 audit ids

Convert audit ids over to being urlsafe base64 strings. This also
addresses an issue with Python3 bytes object not having a .encode
method.

Change-Id: I9e9459b87ebb84d3bc3e36ef10a4b8364abc0c5f
bp: non-persistent-tokens
Merge "Allow LDAP lock attributes to be used as enable attributes"
Merge "Create authentication specific routes"
Correct the signature for some catalog abstract method signatures.

Closes-bug: 1359608

Change-Id: If706c4b28a357e2f3dcde50fbff6418c193c0887
Enhance V3 routers to store basic resource description

Part of JSON Home is providing a description of each resource
provided by the API. With this change, when resources are added
some basic description data required for JSON Home can be provided
and will be stored and made available.

bp json-home

Change-Id: I504cfd321f45e27f58b1998efc70e30a17805b74
Provide the V3 routers to the V3 extension controller

The V3 extension controller needs access to the V3 routers because
they provide the JSON Home data.

bp json-home

Change-Id: Ia455c7c5c06f7cfcefa0bc6afc91bf6954d85e3c
Enhance V3 version controller to provide JSON Home response

The V3 version controller would only respond with the normal version
JSON response. With this change, if the Accept header is
`application/json-home` it will respond with a JSON Home response
which includes all the registered JSON Home data. Note that there is
no JSON Home data yet so the response is empty.

bp json-home

Change-Id: Icfde89040b376bd6704d497966bd8ad109e32d08