Safe command handling for openssl

The openssl command line was passed to exec() as a string with
no attempt at escaping. This could lead to odd results if someone
configured their system with a space in the filename of a key.

The fix is to pass the command to exec() safely, as a list.

Change-Id: I4faa2b66f79bf6ffddabf4a0f0b407ce9afa72d2
Reference dogpile.cache.memcached backend properly

It is dogpile.cache.memcached, not dogpile.cache.memcache
see
http://dogpilecache.readthedocs.org/en/latest/api.html?highlight=memcache#module-dogpile.cache.backends.memcached

Change-Id: Ia2aded1be82453b87a7734441537a5976385616e
Tests remove useless config list cleanup code

With the change to correctly copy the config file list, tests
don't have to revert their changes to the list manually.

Change-Id: Ic9c3b945f6cb663367dd054a501180831fa47658
Tests use setUp rather than init

Test classes should put their initialization code into setUp rather
than __init__. It gets called when the test starts.

Change-Id: Ice0631c864334435b895bad145f3b5b14dc3bffc
Use passed filter dict param in core sql filtering

The existing code incorrectly ignored the passed in cumulative dict.
It functionaly got away with this error since the variable name
it used internally matched the one used in the scope of the caller
method.  Also, correct misspelling in the the same variable name.

Change-Id: Ib80df4dda2f1a8058a15d6407cae1532f4f988e4
Use message when creating Unauthorized exception

The Unauthorized exception was being created with an underlying
exception as its message instead of that underlying exception's message,
such that it can be translated.

Change-Id: I57a7729d2416dda8098da2ea67e867cad31ff83b
Partial-Bug: #1274638
Uses six.iteritems for Python3 compat

Change-Id: I968c349919517bf02b331a8620b17e1789c30dc1
Implements: bp keystone-py3kcompat
Document priority level on Keystone notifications

In the notification docs, we never explicitly say that notification are
always set at the INFO level. This priority level is not configurable
by the end user through the keystone.conf and this change documents that
behavior in the event_notifications.rst docs.

Change-Id: I293db2b69a73a1b56fe0539e183ea13b87ce639a
Remove vim header

We don't need vim modelines in each source file, it can be set in
user's vimrc.

Change-Id: Ie51ad62946afdf39eadcd59edaf8134ec10265c6
Closes-Bug: #1229324
Update kvs assignment backend docs

The "key to data" mapping was not documented for the KVS
assignment backend.

Change-Id: Id3cf3e0d9b52ceae5099e6d3833cc88f7aa0f347
Do not use auth_info objects for accessing the API

Currently all the plugins in keystone.auth.plugins.external use the
auth_info object for acessing the identity and assignment APIs. This
change removes this and uses keystone.common.dependency instead.

Change-Id: I56f06a9c621b5127ae1ca786631c80207bb4286d
Doc - Keystone configuration - moving RBAC section

Moved the `Keystone API protection with RBAC` section between sections
`Configuration files` and `Adding Extensions`. It makes sense, since
it documents the `policy.json` file. This section was previously a
subsection of `Adding Users, Tenants, and Roles with
python-keystoneclient`.

Change-Id: I554f357c40666e67356e176ff82d057894e8bfe5
Use WebOb directly for locale testing

In the convert to Pecan we can't overload the Request type like we do
currently. At the moment we add only one method to request about
determining a locale which can be easily converted to a standalone
function.

Change-Id: I55de36d5ebc35ae868c9048dd4972df1634e2ee4
Blueprint: keystone-pecan
Enforce current certificate retrieval behaviour

There appear to be no tests for retrieving certificates from the v2 api.

When you return a string from a webob request it inserts it as the body
in a standard WebOb Response. Because it returns a WebOb Response the
standard encoding behaviours in wsgi are not enforced and and all
responses are returned as straight text/html.

We can't change the behaviour of the certificate retrieval because it
will fail to be retrieved by auth_token middleware.

Change-Id: I8394f7ad2cc5a8f90b860170c2a5e3ecf334ac96
Correct error class in find_migrate_repo

AssertionError mustn't be used in production code. This complicates error
handling.

Change-Id: I353a2c4cd9b8bb97fffb59918f00dbbf2f326f91
list limit doc cleanup

Includes spelling corrections and whitespace cleanup.

Change-Id: I203e84b1ea199ac80a68d374e54a1825e7916aaf
explicitly expect hints in the @truncated signature

Change-Id: I1a5818c6c68377d033c2c35c72a129334b79e829
Changing testcase name to match our terminology

In design discussions we have been using the term 'self service' to
differentiate a user changing their own password and an admin changing
it for them.

Change-Id: Ibb19bb29e9330c381524209b7560e8c7e81a66be
Move identity logic from controller to manager

The logic for changing a user's password will be used to implement
bp password-rotation.  Keeping the logic in the controller makes it
much harder to reuse.

Change-Id: I6e29a9f1875a3ea6dec4757db86c30497c0253cb
Notifications upon disable

Most entities have disable events that need to trigger other actions.
While disable is often a part of a update event, they are
semantically different events.

One alternative is to have the listener do a lookup, coupling it
tightly to the disabled entity. Sending a deliberate event is a
clearer indication of intention.

These notifications are internal only.

Change-Id: Ic0760ea715d9395bbf62ea90ea608ea85552fcbb