Fix type error message in format_url

The error message for a TypeError in format_url mentioned a key error rather
than a type error as it should have.

Change-Id: I8557d49901f8a8e591654ef0bd530eb8e45e8b5b
Use translation hints

Use the _LI() function instead of _() for new LOG.info messages.

Change-Id: I6af25a33018e76b321488cacea65885fa597abbf
Related-Bug: #1299012
Enforce ``saml2`` protocol in Apache config

Shibboleth, a SAML2 federation software should only protect urls with
protocol set to ``saml2``. Therefore, <Location> directive in the Apache
config should enfore this, instead of accepting every protocol.
Mind that a vhost should still accept all the protocols.

Change-Id: I0d368159fa8862581ae51267e6068f29cae942a2
gitignore etc/keystone/

this is the default directory used by pki_setup and ssl_setup if running
with a keystone.conf alongside keystone.conf.sample for development...
for example:

$ tree etc/keystone/
etc/keystone/
└── ssl
    ├── certs
    │   ├── 01.pem
    │   ├── ca.pem
    │   ├── index.txt
    │   ├── index.txt.attr
    │   ├── index.txt.old
    │   ├── openssl.conf
    │   ├── req.pem
    │   ├── serial
    │   ├── serial.old
    │   └── signing_cert.pem
    └── private
        ├── cakey.pem
        └── signing_key.pem

3 directories, 12 files

Change-Id: I6264805dc91bc165e930708c2781074aa0b29070
Sync service module from oslo-incubator

Previously we synced with oslo-incubator commit hash
caed79d8239679cb74476bb0d9e5011b4fcc39da.

This adds the service module from the same oslo hash.

The service module is required for bug 1157261.

Change-Id: I8c83901dadf52d64755328c70e3c2583b8c07026
Use code-block for curl examples

The code-block directive wasn't used for literal blocks in the
curl examples document, so they weren't highlighted nicely.

Change-Id: If0165ec666003682695c06a9b4ae840016b8355b
Add v3 curl examples

There were curl examples for v2 APIs, but none for V3. This change
adds some that I've found handy.

Also, added an example of getting the revocation list using the v2
API. This is handy for checking token revocations.

Partial-Bug: #1283943

Change-Id: I228dc479b29db730873ba95207e4ace85c20e1fe
Make sure domains are enabled by default

Domains without an explicit 'enabled' key in the dict will now be
handled in the same way as projects are. This will ensure that
the KVS backend produces the same result as the SQL backend for
assignment.

Change-Id: I3b6d26278329841cfe1be5ce7f67ba6d3569785f
Related-Bug: #1311142
Fixes typo error in Keystone

This submission is to fix the typo error
in "/keystone/tests/test_v3_identity.py" file

Change-Id: I62e286f20a40808d5ff69f9d98bf407174d6613f
Block delegation escalation of privilege

Forbids doing the following with either a trust
  or oauth based token:
  creating a trust
  approving a request_token
  listing request tokens

Change-Id: I1528f9dd003f5e03cbc50b78e1b32dbbf85ffcc2
Closes-Bug:  1324592
Merge "Use code-block for curl examples"
Add cloud auditing notification documentation

Added documentation that states that Keystone has added audit
notification support for operations like authentication using
the DMTF Cloud Auditing Data Federation (CADF) standard.

Change-Id: I63858d14f1b628597251c8980eae6a4fe626e83f
enable multiple keystone-all worker processes

Fixes bug 1157261.

Since the majority of the work keystone does is cryptographic
calculations and filtering database records, keystone is CPU-bound.
Given that a keystone-all process has only one thread (i.e.,
eventlet's thread), keystone-all's throughput is limited to the
throughput of a single CPU core. To increase keystone-all's
throughput, we need to increase its CPU parallelism, which entails
running more keystone-all processes.

This patch adds two configuration options, public_workers=N and
admin_workers=N, that determine the number of keystone-all processes
that handle requests for keystone's public and admin WSGI applications
respectively.

Note that simply running keystone-all multiple times won't work
because care has to be taken for all of the worker processes to be
using the same socket (i.e., listen() then fork()).

DocImpact

Change-Id: If74f13bc2898e880649ee809967f5b5859b793c6
Co-Authored-By: Stuart McLaren <stuart.mclaren@hp.com>
Merge "Block delegation escalation of privilege"
Merge "Fix type error message in format_url"
Merge "Add cloud auditing notification documentation"
Merge "Use translation hints"
Merge "Enforce ``saml2`` protocol in Apache config"
Merge "gitignore etc/keystone/"
Merge "Make sure domains are enabled by default"