trustor_user_id not available in v2 trust token

The trust information in the v2 token is missing the trustor_user_id
and impersonation values. This means you are unable to tell who gave
you the trust.

Change-Id: I7ed215b3353079d8ed9514c586d256c1226a2c19
Closes-bug: #1331882
DocImpact
Update the docs that list sections in keystone.conf

The current docs are wildly out of date, and need to be updated
to actually show what are valid sections in keystone.conf

Change-Id: Icaced2499c6e05e0abfbb45abfbfd416a67d72e9
Use oslo_debug_helper and remove our own version

With the latest version of oslotest, we can now take advantage
of a common oslo_debug_helper script.
We can now remove our own homebrewed version, minor changes to
tox.ini were needed.

Change-Id: Ide72fb3531f0498dfe289d028049cd432aa08887
Enable filtering of services by name

This commit enables the filtering of services through the service's
name. This wasn't available before, since the name is not saved in the
backend as a column, but instead it's stored as an extra attribute.

Thus, this commits enables this type of search by asserting a TODO that
was left in the SQL backend, and also adding the `name` attribute to the
filterprotected decorator.

This is needed since some clients (namely python-openstackclient) assume
that this functionality already exists and thus give the option to
create endpoints with the service name as a parameter.

Change-Id: Ifc9c1e44e908410740f6f20380b264d35096fcac
Closes-Bug: #1350273
Update man pages

The man pages were out of date.

Change-Id: I9ce00b06ce2df6fe4f12c3fbeae9ad5ddbdbb13d
Closes-Bug: #1366944
Use id attribute map for read-only LDAP

For read-only LDAP, we have no control over the DIT. We can only use the
attribute maps. Therefore, we need to honor the attribute map for all
attributes.

This patch also added the missing ID attribute when creating an object in
LDAP. For lookup, we also need the ID attribute to be returned.

Change-Id: I57c099eefdca7e756d294c35cf5b70d119c5c955
closes-bug: #1361306
closes-bug: #1340041
Making KvsInheritanceTests use backend KVS

The KvsInheritanceTests does not use backend
KVS as identity driver. This patch fix this
by setting it in the config_overrides method.

Change-Id: I45e80e18d7dbcd027493755a8bd30c3fc7e09638
Closes-Bug: 1364618
Fix Policy backend driver documentation

Change-Id: If5e0655eb6733cca1294d780f3a9446ed4ada357
Closes-Bug: #1362007
Adds pipeline hints to the example paste config

The order of entries in the pipeline matters. The is especially true for
the application. It must always come last. None of the configuration
documentation for extensions calls this out when they tell the user to
add something to their pipeline.

Change-Id: I46b9b1ac59865d996caa4174867bcf54318035a3
Closes-Bug: #1363932
Adds hint about filter placement to extension docs

Since a filter cannot be the last entry in a pipeline it makes sense to
call that out in the extension documentation.

Change-Id: Idf73bdb6d6d237cbf9d108f67eeb8020caeaa364
Related-Bug: #1363932
Ensure a consistent transactional context is used

This change repairs a migration that was using multiple
transactional contexts for a single operation.  Using
a Session implies that operations do not proceed under
"autocommit", so here the autoload operations as well as
migration operations are invoked under a single
connection.  The issue has been exposed due to improvements
in oslo.db which expose SQLite as supporting transactional
DDL.

Change-Id: Ic6673234122e1cf1bc4c05907299bb1938e54a9f
Related-Bug: #1367354
Fix LDAP group role assignment listing

The Keystone server would return group assignments as user
assignments when listing roles assignments and configured to use
the LDAP assignment backend.

Change-Id: Icd4f2b7f7f68e8f8b586fd756f7570fd6439e8de
Closes-Bug: #1365787
Add characterization test for cleanup role assignments for group

There was no test that showed that when a group is deleted the
role assignments for the group are expected to also be removed.
The test shows that the role assignments are not removed for the
LDAP and KVS assignment backends.

Change-Id: I7a11edcf516740fd2e73f0482ce6bbd67f5ab23f
Partial-Bug: #1366211
Fix using local ID to clean up user/group assignments

When using ID mapping and a user or group is deleted, the mapped id
was being passed to the assignment backend when it's told to clean up
the role assignments for hte user or group. The role assignments are
based on the external ID and not the mapped ID, so the role
assignments wouldn't be cleaned up.

With this change, the external ID is passed to the assignment backend
methods.

Change-Id: I4405329df509f81c9c1178e91092955b16cd586b
Closes-Bug: #1222675
Add delete notification to endpoint grouping

Add delete notification to endpoint grouping so that if a project
or endpoint group is deleted this will automatically force the
deletion of the related project endpoint group association.

Closes-Bug: 1365169
Change-Id: Ic67eaf52ec220bc4ace32a7625af643b3f0818d6
Merge "Update the docs that list sections in keystone.conf"
Merge "Enable filtering of services by name"
Merge "trustor_user_id not available in v2 trust token"
Merge "Use oslo_debug_helper and remove our own version"
Merge "Use id attribute map for read-only LDAP"