Fix type error message in format_url

The error message for a TypeError in format_url mentioned a key error rather
than a type error as it should have.

Change-Id: I8557d49901f8a8e591654ef0bd530eb8e45e8b5b
update release support warning for domain-specific drivers

Change-Id: I4f5c600af9cce44573eb032942ed65cb2e2af19d
Use translation hints

Use the _LI() function instead of _() for new LOG.info messages.

Change-Id: I6af25a33018e76b321488cacea65885fa597abbf
Related-Bug: #1299012
install gettext on OS X for msgfmt

as already mentioned by this doc, gettext provides msgfmt, which is
required for i18n validation via tox.

Change-Id: I4cae5fddc42897615554746f946ed4f490dc1ca5
Enforce ``saml2`` protocol in Apache config

Shibboleth, a SAML2 federation software should only protect urls with
protocol set to ``saml2``. Therefore, <Location> directive in the Apache
config should enfore this, instead of accepting every protocol.
Mind that a vhost should still accept all the protocols.

Change-Id: I0d368159fa8862581ae51267e6068f29cae942a2
gitignore etc/keystone/

this is the default directory used by pki_setup and ssl_setup if running
with a keystone.conf alongside keystone.conf.sample for development...
for example:

$ tree etc/keystone/
etc/keystone/
└── ssl
    ├── certs
    │   ├── 01.pem
    │   ├── ca.pem
    │   ├── index.txt
    │   ├── index.txt.attr
    │   ├── index.txt.old
    │   ├── openssl.conf
    │   ├── req.pem
    │   ├── serial
    │   ├── serial.old
    │   └── signing_cert.pem
    └── private
        ├── cakey.pem
        └── signing_key.pem

3 directories, 12 files

Change-Id: I6264805dc91bc165e930708c2781074aa0b29070
remove unneeded definitions of Python Source Code Encoding

I think PEP 0263 (http://legacy.python.org/dev/peps/pep-0263/) is
not used anywhere else and so it should be removed when it's not
needed.

Change-Id: I7bbbf8ab0f47c6f8a3b25e92e4678e76c77f19a1
Sync service module from oslo-incubator

Previously we synced with oslo-incubator commit hash
caed79d8239679cb74476bb0d9e5011b4fcc39da.

This adds the service module from the same oslo hash.

The service module is required for bug 1157261.

Change-Id: I8c83901dadf52d64755328c70e3c2583b8c07026
Use code-block for curl examples

The code-block directive wasn't used for literal blocks in the
curl examples document, so they weren't highlighted nicely.

Change-Id: If0165ec666003682695c06a9b4ae840016b8355b
Add v3 curl examples

There were curl examples for v2 APIs, but none for V3. This change
adds some that I've found handy.

Also, added an example of getting the revocation list using the v2
API. This is handy for checking token revocations.

Partial-Bug: #1283943

Change-Id: I228dc479b29db730873ba95207e4ace85c20e1fe
remove unnecessary word in docs: 'an'

Per Brant's comment in:
    https://review.openstack.org/#/c/99075/3/doc/source/http-api.rst

Change-Id: I7d4b6d46666a71601f30da48bd720f847a8dfa09
Convert explicit session get/begin to transaction context

Convert the explicit common.sql.get_session() and subsequent
session.begin() to the transaction context manager for Trust
SQL backend.

Change-Id: I52745118782301ef26452063628e16e92e8ee276
Make sure domains are enabled by default

Domains without an explicit 'enabled' key in the dict will now be
handled in the same way as projects are. This will ensure that
the KVS backend produces the same result as the SQL backend for
assignment.

Change-Id: I3b6d26278329841cfe1be5ce7f67ba6d3569785f
Related-Bug: #1311142
Properly invalidate cache for get_*_by_name methods

Use the original name for invalidating the cache on the
get_project_by_name and get_domain_by_name when performing update
operations on the name attributes.

Change-Id: If58a3b0a47501096f9fa9eb9cd7a6057f7b29298
Closes-Bug: #1311142
Add missing docstrings and 1 unittest for LDAP utf-8 fixes

A minimal backport of these accepted master commits:

https://review.openstack.org/#/c/82396/
https://review.openstack.org/#/c/82398/
https://review.openstack.org/#/c/82399/

was done for Icehouse in the following:

https://review.openstack.org/#/c/91883/

In the above backport review it was requested docstrings be added for
some functions and an additional unittest be added. That work was done
for the Icehouse backport and was positively reviewed, at the same it
was requested the those changes be reflected back into master so as
not to lose them going forward. This patch does that, adds the
docstrings and one additional small unittest.

Change-Id: I881ba9b274692427d4c7b9f5357ee4735b4e6699
Related-Bug: #1172106
Fixes typo error in Keystone

This submission is to fix the typo error
in "/keystone/tests/test_v3_identity.py" file

Change-Id: I62e286f20a40808d5ff69f9d98bf407174d6613f
Block delegation escalation of privilege

Forbids doing the following with either a trust
  or oauth based token:
  creating a trust
  approving a request_token
  listing request tokens

Change-Id: I1528f9dd003f5e03cbc50b78e1b32dbbf85ffcc2
Closes-Bug:  1324592
Merge "Use code-block for curl examples"
Add cloud auditing notification documentation

Added documentation that states that Keystone has added audit
notification support for operations like authentication using
the DMTF Cloud Auditing Data Federation (CADF) standard.

Change-Id: I63858d14f1b628597251c8980eae6a4fe626e83f
enable multiple keystone-all worker processes

Fixes bug 1157261.

Since the majority of the work keystone does is cryptographic
calculations and filtering database records, keystone is CPU-bound.
Given that a keystone-all process has only one thread (i.e.,
eventlet's thread), keystone-all's throughput is limited to the
throughput of a single CPU core. To increase keystone-all's
throughput, we need to increase its CPU parallelism, which entails
running more keystone-all processes.

This patch adds two configuration options, public_workers=N and
admin_workers=N, that determine the number of keystone-all processes
that handle requests for keystone's public and admin WSGI applications
respectively.

Note that simply running keystone-all multiple times won't work
because care has to be taken for all of the worker processes to be
using the same socket (i.e., listen() then fork()).

DocImpact

Change-Id: If74f13bc2898e880649ee809967f5b5859b793c6
Co-Authored-By: Stuart McLaren <stuart.mclaren@hp.com>