Fix type error message in format_url

The error message for a TypeError in format_url mentioned a key error rather
than a type error as it should have.

Change-Id: I8557d49901f8a8e591654ef0bd530eb8e45e8b5b
Use translation hints

Use the _LI() function instead of _() for new LOG.info messages.

Change-Id: I6af25a33018e76b321488cacea65885fa597abbf
Related-Bug: #1299012
install gettext on OS X for msgfmt

as already mentioned by this doc, gettext provides msgfmt, which is
required for i18n validation via tox.

Change-Id: I4cae5fddc42897615554746f946ed4f490dc1ca5
Enforce ``saml2`` protocol in Apache config

Shibboleth, a SAML2 federation software should only protect urls with
protocol set to ``saml2``. Therefore, <Location> directive in the Apache
config should enfore this, instead of accepting every protocol.
Mind that a vhost should still accept all the protocols.

Change-Id: I0d368159fa8862581ae51267e6068f29cae942a2
gitignore etc/keystone/

this is the default directory used by pki_setup and ssl_setup if running
with a keystone.conf alongside keystone.conf.sample for development...
for example:

$ tree etc/keystone/
etc/keystone/
└── ssl
    ├── certs
    │   ├── 01.pem
    │   ├── ca.pem
    │   ├── index.txt
    │   ├── index.txt.attr
    │   ├── index.txt.old
    │   ├── openssl.conf
    │   ├── req.pem
    │   ├── serial
    │   ├── serial.old
    │   └── signing_cert.pem
    └── private
        ├── cakey.pem
        └── signing_key.pem

3 directories, 12 files

Change-Id: I6264805dc91bc165e930708c2781074aa0b29070
Sync service module from oslo-incubator

Previously we synced with oslo-incubator commit hash
caed79d8239679cb74476bb0d9e5011b4fcc39da.

This adds the service module from the same oslo hash.

The service module is required for bug 1157261.

Change-Id: I8c83901dadf52d64755328c70e3c2583b8c07026
Add v3 curl examples

There were curl examples for v2 APIs, but none for V3. This change
adds some that I've found handy.

Also, added an example of getting the revocation list using the v2
API. This is handy for checking token revocations.

Partial-Bug: #1283943

Change-Id: I228dc479b29db730873ba95207e4ace85c20e1fe
Make sure domains are enabled by default

Domains without an explicit 'enabled' key in the dict will now be
handled in the same way as projects are. This will ensure that
the KVS backend produces the same result as the SQL backend for
assignment.

Change-Id: I3b6d26278329841cfe1be5ce7f67ba6d3569785f
Related-Bug: #1311142
Properly invalidate cache for get_*_by_name methods

Use the original name for invalidating the cache on the
get_project_by_name and get_domain_by_name when performing update
operations on the name attributes.

Change-Id: If58a3b0a47501096f9fa9eb9cd7a6057f7b29298
Closes-Bug: #1311142
Add missing docstrings and 1 unittest for LDAP utf-8 fixes

A minimal backport of these accepted master commits:

https://review.openstack.org/#/c/82396/
https://review.openstack.org/#/c/82398/
https://review.openstack.org/#/c/82399/

was done for Icehouse in the following:

https://review.openstack.org/#/c/91883/

In the above backport review it was requested docstrings be added for
some functions and an additional unittest be added. That work was done
for the Icehouse backport and was positively reviewed, at the same it
was requested the those changes be reflected back into master so as
not to lose them going forward. This patch does that, adds the
docstrings and one additional small unittest.

Change-Id: I881ba9b274692427d4c7b9f5357ee4735b4e6699
Related-Bug: #1172106
Fixes typo error in Keystone

This submission is to fix the typo error
in "/keystone/tests/test_v3_identity.py" file

Change-Id: I62e286f20a40808d5ff69f9d98bf407174d6613f
Add cloud auditing notification documentation

Added documentation that states that Keystone has added audit
notification support for operations like authentication using
the DMTF Cloud Auditing Data Federation (CADF) standard.

Change-Id: I63858d14f1b628597251c8980eae6a4fe626e83f
enable multiple keystone-all worker processes

Fixes bug 1157261.

Since the majority of the work keystone does is cryptographic
calculations and filtering database records, keystone is CPU-bound.
Given that a keystone-all process has only one thread (i.e.,
eventlet's thread), keystone-all's throughput is limited to the
throughput of a single CPU core. To increase keystone-all's
throughput, we need to increase its CPU parallelism, which entails
running more keystone-all processes.

This patch adds two configuration options, public_workers=N and
admin_workers=N, that determine the number of keystone-all processes
that handle requests for keystone's public and admin WSGI applications
respectively.

Note that simply running keystone-all multiple times won't work
because care has to be taken for all of the worker processes to be
using the same socket (i.e., listen() then fork()).

DocImpact

Change-Id: If74f13bc2898e880649ee809967f5b5859b793c6
Co-Authored-By: Stuart McLaren <stuart.mclaren@hp.com>
Password trunction makes password insecure

The trunc_password function attempts to correct and truncate
password. It is not recommended to 'fix' invalid input and
continue on processing and logging it. Instead, strict check
is introduced to validate password. If a password exceeds the
maximum length, an HTTP 403 Forbidden error is thrown.

In order to keep compatibility, an option 'strict_password_check'
is also introduced to let operator decide which method to use.

DocImpact
Change-Id: I560daa843b94a05412af59a059de5a98bad2925e
Closes-Bug: #1175904
Merge "Fix type error message in format_url"
Merge "Add cloud auditing notification documentation"
Merge "Use translation hints"
Merge "Enforce ``saml2`` protocol in Apache config"
Merge "gitignore etc/keystone/"
Merge "Make sure domains are enabled by default"