Adds hacking check for debug logging translations

bp more-code-style-automation

Change-Id: Id54f322f00b04a165bb4a7b1e24f95bb72b7f068
Implicitly ignore attributes that are mapped to None in LDAP

Attributes that are mapped to None in LDAP trigger a 500 error when
performing a search if they are not explicitly ignored in keystone's
configuration.  These attributes should always be ignored, even if
the admin left the attribute out of the ignore list.

Change-Id: Ibbabdd0013059d5720250816764021a0b3ce8ce0
Closes-bug: #1335437
Fixes the order of assertEqual arguments

assertEqual method's arguments should be in
('expected', 'actual') order.

Change-Id: I524113ccc4a00e8363b2f9c418a3754f482b44d0
Partial-Bug: #1277104
LDAP: Added documentation for debug_level option

Change-Id: Ia5646ebae049eec296bd10826dfd57bf6b7761af
Closes-Bug: #1319564
Do not use keystone's config for nova's port

Keystone's configuration should have no bearing on the catalog
for nova's port. Nova's port is "static" data from the templated
catalog perspective.

The 'compute_port' option has been marked as deprecated and
slated for removal in the L release. The default/sample
templated catalog files do not rely on this option any
longer.

Change-Id: I51b0ec951449360f002c2e7c900ded0f40e16044
Closes-Bug: #1335278
Make OS-FEDERATION core.Driver methods abstract

Not all methods in contrib.federation.core.Driver are decorated
with @abs.abstractmethod. This patch adds missing decorators.

Change-Id: I93962110134d4b9062a75c228760333403a4f7eb
HEAD responses should return same status as GET

According to the HTTP spec, a HEAD request should return the same
status and headers as the GET request (including content-type and
content-length). The HEAD request simply strips out the body and
returns no body. Any case where HEAD routing returned a different
status code than GET, now returns the same status and headers.

Any case where HEAD was supported where GET was not supported now
supports both GET and HEAD.

The wsgi.render_response code now handles HEAD appropriately and
will maintain headers while enforcing no body data is returned.

The bulk of this change is to support the same behavior between
deploying Keystone under eventlet and under HTTPD + mod_wsgi. In
the case of deploying under HTTPD + mod_wsgi, there are cases
where mod_wsgi will turn a HEAD request into a GET request to
ensure that the proper response is rendered. With these changes
all HEAD responses will respond in the same manner under either
eventlet or mod_wsgi.

Change-Id: I13ce159cbe9739d4bf5d321fc4bd069245f32734
Closes-Bug: #1334368
Correct the region table to be InnoDB and UTF8

The region table was not specified as being InnoDB or UTF8 under
mysql initially. The migration will fail if the defaults for MySQL
are not set correctly. A new method has been added to the
migration_helpers module to detect and correct the InnoDB / UTF8
specific issue with the region table.

Change-Id: I374c3dd46a4292e8f9e74ef75a8bb463b951f135
Closes-Bug: #1334779
Merge "Correct the region table to be InnoDB and UTF8"
Merge "Make OS-FEDERATION core.Driver methods abstract"
Merge "HEAD responses should return same status as GET"
Add keystonemiddleware to requirements

Keystone middleware has been split. Keystone ec2_token middleware
has been included in the new repository. Keystone will depend on
the keystonemiddleware package and import ec2_token instead of
providing duplicated code.

Change-Id: I10534c1ca9883b9f98c998a6cb61e500f6c6ff2d
bp: split-middleware
Imported Translations from Transifex

Change-Id: Ia8bfc8f572d6f91ab39322e1a8274c5d2a12815b
Remove deprecated token_api.list_tokens

The method token_api.list_tokens was deprecated in Icehouse and
slated for removal in Juno. It was determined that the driver
version of .list_tokens was an internal method and should not
be used outside of the .delete_tokens method.

blueprint: non-persistent-tokens
Change-Id: I33e81503b1469537bbd745937bf2efe17c7ae469
Update the configuration docs for the revocation extension

There was a formatting error in how step 1 appeared, and I also
changed the title to the more formal name instead of OS-REVOKE,
as the other extensions did not use their OS-* name.

Change-Id: I658ac8dc61d6a8cdacb243a10d853cf9f6aa9409
Do not use lazy translation for keystone-manage

lazy translation provides the ability to translate messages to
different languages based on the request language in the HTTP
request. Since keystone-manage doesn't handle HTTP requests it
doesn't need to enable lazy translations.

Change-Id: I0abab2565b604e3325f61cad412dc8b28f768f18
Add oslo.i18n as dependency

oslo.i18n provides the i18n functions that were provided by
oslo-incubator's gettextutils module. Once Keystone is changed to
use oslo.i18n the gettextutils module can be removed.

Change-Id: Ie9db1c25ba0601258fb9a493cbc75b0ff205d0d6
Migrate default extensions

When running `keystone-manage db_sync` with no parameters, none of
the extensions are migrated.

This patch will now, by default, migrate the following extensions:
  revoke

DocImpact
Co-Authored-By: Steve Martinelli <stevemar@ca.ibm.com>
Closes-Bug: 1324260
Change-Id: I4711e8670bf9619b9bccc09bd6a843728230b25f
Update docs to reflect new db_sync behaviour

In the extension specific configuration docs, we ask that the user
always migrate the extension, however now that we migrate certain
extensions by default, we can mark those steps as optional.

Change-Id: I3d2419786d1f6c25b69c29629a47892fa682129d
multi-backend support for identity

The current code has a number of problems and limitations in its
support for having domain-specific backends (e.g. a different LDAP
server per domain).  Not least of the problems is that you cannot
always infer the domain if an API call is just handed a user_id or
group_id. These issues are so severe that this feature is currently
marked as experimental.

This patch fixes these issues by using a mapping layer to store
the domain and local ID for the public facing user and group IDs.
No API changes are required for this new support. An important
consequence of this change is that non-UUID IDs for backends
like LDAP do not escape from keystone.

To ensure backward compatibility with existing single backend
installations, the mapping is not used for the default driver.
An exception to this is that if a cloud provider wants to enable
mapping for the default LDAP driver then they can set a config
option to achieve this.

keystone-manage has been extended to provide options to purge
the mapping table.

Blueprint: multi-backend-uuids

Change-Id: I60f8965bb74b248e6a6c8f141289affa431ee3cf