Sync several modules from oslo-incubator

This change syncronizes excutils,lockutils,log, and
db.sqlalchemy.session modules from oslo-incubator
commit 19e0a51204df247dc38de880d08e6d66e89e6572 .

 $ python update.py --nodeps --base keystone --dest-dir ../keystone \
     --modules  excutils,lockutils,log,db.sqlalchemy.session

This includes fixes for 2 problems:

"keystone=INFO" was in the default_log_levels. This made it
more difficult than necessary to debug the Keystone server,
since you can set debug=True but then the keystone logging
level is overridden and you get no debug output for keystone.

"keystone=INFO" may have been in the default_log_levels because
of the auth_token middleware, but this has been moved to
python-keystoneclient now and the logging config for the
python APIs is done differently.

Closes-Bug: 1245629

Also, fixes some warnings and errors when docs are generated.

Change-Id: I53868bef975f73b4aee35695b6387b718c4179f9
Merge db.sqlalchemy from oslo-incubator af5f710

The db.sqlalchemy module was not recent with oslo-incubator.

 $ git checkout af5f71096c7bb83fe2f956588a9ec643b0d9a2f6
 $ python update.py --nodeps --base keystone \
   --dest-dir ../keystone --modules db.sqlalchemy

The af5f710 oslo-incubator db.sqlalchemy contains a fix for the
following problem, which caused a regression in Keystone:

The database connection string was not marked as secret, so it
would be printed out in cleartext in the logs when config settings
were logged.

The database connection string typically contains the password
that's used to connect to the database, so it should be marked as
secret so that it doesn't get logged.

Change-Id: Ibdc63480a836646c5571a368f3c3a1d0c82d6aba
Closes-Bug: #1266590
derive custom exceptions directly from Exception

Although StandardError derives from Exception, the python docs for
Exception read:

    All user-defined exceptions should also be derived from this class.

http://docs.python.org/2/library/exceptions.html#exceptions.Exception

Change-Id: If0f009cd0ad5a30329f0f97d869137aeef66af23
Sync with global requirements

Change-Id: Ibdd73aa142be103d285ce0f15701dc96c1ec34ae
Enhance tests for non-default default_domain_id

There were no tests that show what happens when the
default_domain_id is changed from the default. The new tests show
that in some cases the behavior is incorrect, and in other cases
it is correct.

Change-Id: Ia167e153f488617f94afce7fddfc52e1e2c8e79c
Related-Bug: #1265108
Remove unused member from KVS assignment

The KVS assignment backend's _get_user_by_name method was not used.
This change removes it.

Change-Id: I357adf745095b2ac868c3c6eb78e4ab6db2ca0fc
KVS support domain as namespace for users

The KVS identity backend didn't support having users with the
same name in different domains.

Change-Id: I4f6a9010ed085aef9cba5f368e292dd28339a0fa
Related-bug: #1265108
Enhance auth tests for non-default default_domain_id

There wasn't an authentication test that showed what happens when
the default_domain_id option is changed from the default. The new
tests show that the behavior is incorrect.

This test is split out because it uses a new feature of the KVS
backend to allow adding users with the same name in different
domains, because I don't think we'll backport that change.

Change-Id: I890a1c798d7f4a8a345404cd7754708ab0d36651
Related-Bug: #1265108
Fix using non-default default_domain_id

Changing the default_domain_id to something other than the
default would cause several operations to not work correctly.
This is because the value of default_domain_id was read and
cached in several parts on import, which is before the call to
CONF() so the cached value is the original default ('default')
rather than the value that the operator has in the config file.

This change removes the cached default_domain_id and instead
reads the value when it's needed at runtime so that the
user-configured value is used instead of the original default.

Change-Id: I9543e2108866ed66000d75f868bbd2b1ed978b97
Closes-Bug: #1265108
remove unused LOG

Change-Id: I5dec1b23667c7226697f064fe793c556c71e3abe
Identity Providers CRUD operations

Implementation of CRUD operations for:

- Identity Providers
- Protocols used to authenticate remote users (SAML, OpenId, etc)

Change-Id: I0ce62e720e797718dbfde6bfcd4b22a213985867
Implements: blueprint identity-providers
Switch from 400 to 403 on ImmutableAttributeError

Change-Id: Ib34903487e6a2322dd9ef3afd02793916f22207e
Add mapping function to keystone

Add a mapping implementation for the federation extension.
This will allow a set of rules to be added, that map
relationships between identity providers and keystone

api spec: https://review.openstack.org/#/c/59848/

Implements: bp mapping-distributed-admin
Change-Id: Iab93dc6759f195fecd88dcdf1c635c81ad59165a
Simple Certificate Extension

Implement the Simple Certificate Extension for retrieving token signing
certificates from a server.

Change-Id: I653c527ca2b39628658a24b4d484683d1ac6acf2
Closes-Bug: #1259011
Fixup incorrect comment

This was a left over from a previous draft of the API. It is submitted
as a separate patch so as not to interrupt the gate during I2.

Change-Id: Id160466f6c05b3c0a7f1568cdd694fe0a411f295
Remove kwargs from trust_api.create_trust

This change allows notifications to be sent using the existing
implementation and the resulting trust ID is stored in args[1], instead
of kwargs. Using args this way maintains consistency with
trust_api.delete_trust().

Change-Id: I8169b9ea6fabcd8aff864c3bf900ceb1b32676f3
Closes-Bug: #1269157
Implement notifications for trusts

Use the existing notifications wrapper to send notifications when a
trust is created or deleted. There is no need to send a notification on
a trust update since trusts are immutable. This change adds
trusts to the event_notifications.rst documentation.

Change-Id: I777ad4594ce9b93c36af675ac677cfa61524a3e7
blueprint: trust-notifications
Don't duplicate the existing config file list

Make a copy of the original config file list for test_v3.
Otherwise additional tests end up appending to them and corrupting other tests.

Change-Id: I4232956dbfea4b1b7103c751e35112daddc5ff37
initialize environment for tests that call popen

Change-Id: I5b367f7f97de353f12e41dc7768a7fcdc740eabd
Use six.string_types instead of basestring

basestring only exists in Python 2. Use six.string_types to make code
Python 3 compatible. See http://pythonhosted.org/six/#six.string_types

Part of blueprint keystone-py3kcompat

Change-Id: I5022259cfd648ba2680aabbb0fbc403f10c5dc7e