Move shib specific documentation

The generic 'configure federation' section has several references
to SAML and shib, we should move those to the shib specific doc.

Change-Id: Ie626a5039d33683c04cd964674ee2a9aab98c215
Fix project federation tokens for inherited roles.

Currently project-scoped federation-generated tokens fail to include
group roles that are inherited to the project from the owning domain.
This error is also exposed via the /auth/projects and
/OS-FEDERATION/projects API calls. This patch patch fixes this.

Change-Id: I1ce5007984938365208630ad901c7c508c57fcd4
Closes-bug: 1389752
Closes-bug: 1385694
Improve testing of exclusion of inherited roles.

The list_domains_for_user() method is supposed to only return the
domains for which a user has a role (direct or via a group).
However, it currently ignores the inherited attribute, hence will
incorrectly return domains which only contain inherited roles.

This patch adds a test to show the error, a follow-on patch will
fix it.

Partially implements: bug 1390640

Change-Id: I71e118741919e9e488d9b9fd1e0b59999bb229fe
Exclude domains with inherited roles from user domain list.

The list_domains_for_user() method is supposed to only return the
domains for which a user has a role (direct or via a group).
However, it currently ignores the inherited attribute, hence will
incorrectly return domains which only contain inherited roles.

This patch fixes this issue.

Closes-bug 1390640

Change-Id: Iadcafd8e60ff5532d788c865a8cd3b180de31b4f
Allow for REMOTE_USER name in federation mapping

Co-Authored-By: Marek Denis <marek.denis@cern.ch>

Change-Id: I74e2599394752c75a0df3090c74f7b5c54c771e0
Closes-Bug: #1390085
Don't return ``user_name`` in mapped.Mapped class.

auth.mapped.Mapped._handle_unscoped_token() and _setup_username don't
need to return and store variable ``user_name``. Drop it.

Change-Id: Id66e63a49a146a04217ad5c548cd877819aa9ca2
Move test_pemutils.py to unit test directory

The test_pemutils.py module consists of unit tests for common Keystone
code. This commit moves the test_pemutils.py unit tests to the
keystone/tests/unit/common directory.

Change-Id: Ifeedaaf2fb7cd379bb9e872567874bced0c94b02
Merge "Move shib specific documentation"
Merge "Fix project federation tokens for inherited roles."
Merge "Improve testing of exclusion of inherited roles."
Merge "Exclude domains with inherited roles from user domain list."
Merge "Move test_pemutils.py to unit test directory"
Merge "Allow for REMOTE_USER name in federation mapping"
Merge "Don't return ``user_name`` in mapped.Mapped class."