Cleanup of test_cert_setup tests

- Removed the redundant calls to load backends and fixtures
- Only create a controller in the one test that needs it

Change-Id: I6c068452479ceb23010396f14fe6d155ac954b04
Enhance tests for user extra attribute mapping

This test shows that when an extra attribute mapping like
'description:description' is used, the description isn't returned
in the user.

Change-Id: Ie3520b315a0eecc2503953c0f15ae1da9a8070c9
Related-Bug: #1293698
Allow any attributes in mapping

When using attribute mapping (e.g., user_additional_attribute_mapping), any
attributes that Keystone didn't know about were ignored and a warning was
issued, like

 WARNING keystone.common.ldap.core [-] Invalid additional attribute mapping:
 "description:description". Value "description" must use one of password,
 enabled, default_project_id, name, email.

This check is removed. Additional attribute mappings for "unexpected"
attributes (such as description) should be allowed. For one thing, all the
known attributes already have a way of setting the mapping, via the
user_*_attribute config option. This will allow setting a "description" or
any other attribute mapping for users.

Change-Id: Idc2cd75ecd3e1a06a50fd0a676d83c5de74ca7a5
Partial-Bug: #1293698
Don't re-raise instance

There were a couple of places where the code would re-raise an
exception with `raise inst`. This would lose the original
backtrace.

Change-Id: I437039fe520bd88b556af9ed2ee4a14bfe120498
Removed unused code

Removed unused methods, variables, and arguments
from method signature. Method 'remove_user' was
removed because method 'add_user' is unused and if
we never do add_user then no reason to do remove_user.

Change-Id: I0ef900232bc26b91e9cd192ba29a720ff7de27a3
More debug output for test

This is to see if we can get some more info when this fails.

Related-Bug: #1300581

Change-Id: I9be3784095cfd8f04f3a49ae7e9d39520018b4da
Remove unnecessary dict copy

The conf object is ignored anyway so there is no point in copying and
updating the object.

Change-Id: I00a0af7433ad49150a3e135a0254030be59b1974
Closes-Bug: #1307781
Moves test database setup/teardown into a fixture

Change-Id: Ic59eb0a6f7d20abfcc2966a7162406cf541306b2
Merge "More debug output for test"
Adding one more check on project_id

Project_id is not a required attribute in creating Trust.
Authentication with this kind of trust results in an error:
"Expecting to find id or name in project".
This message is misleading as the trust creation without project_id
was successful which is a valid behavior.
This error message is generated from checking if project_id is in trust
metadata.
One more check is needed to verify if project_id is None or populated.

Closes-Bug: #1301622
Change-Id: Ic711a63f43ca87a97cb7f761170fa8aa2d45e11e
Sync with oslo-incubator 2fd457b

This syncs Keystone with oslo-incubator commit hash
2fd457bf2ccbeb2b84ffb204778b6417cd5405ba .

In keystone:

 $ rm -r keystone/openstack/common

In oslo-incubator:

 $ python update.py ../keystone

The newer lockutils requires posix_ipc. It's already in
global-requirements.

Keystone uses gettextutils and versionutils from oslo-incubator
so those should be in openstack-common.conf. They were pulled in
as dependencies of other oslo-incubator modules but Keystone
shouldn't rely on that.

Keystone doesn't use log_handler directly so that module was
removed from openstack-common.conf. log_handler is available in
the oslo.messaging library.

Change-Id: I6082f4e0995ca35372f9b061d8f76890aa93250c
Merge "Moves test database setup/teardown into a fixture"
Merge "Remove unnecessary dict copy"
Merge "Sync with oslo-incubator 2fd457b"
Isolate backend loading

Pecan uses thread local storage and so if we combine pecan and eventlet
we need to make sure that eventlet is monkey patched before pecan is
first loaded.

To keep the paste.ini file untouched we need to keep the app creation in
service.py but we can't load that from keystone-all because it has pecan
in it.

So we create a new file that can be safely imported before pecan is
loaded.

Change-Id: If7abf1db9859d66c06f7f223056c106292f256fa
blueprint: keystone-pecan
Merge "Removed unused code"
Add missing import, remove trailing ":" in middleware example

Minor fixes to the external authentication example given in the
documentation.

Change-Id: I2bef7da8bf8278349fec80a513095637ea49f19a
Closes-Bug: #1308634
Co-Authored-By: Florent Flament <florent.flament-ext@cloudwatt.com>
Merge "Adding one more check on project_id"
Remove LDAP password hashing code

Keystone should not be hashing passwords for LDAP users
itself.  Password hashing should be performed by the LDAP
server, as password policies may not allow pre-hashed
passwords to be set (they may enforce a scheme that is
stronger that salted SHA-1).

This removes the LDAP password hashing code.  When using
fakeldap for running unit tests, passwords will not be
hashed.  For this reason, the hashing tests are skipped
for LDAP backends.

Closes-bug: 1308793
Change-Id: Ia0998b7fd8fb5d01b86a947d18b7e79fcffd1228
Merge "Isolate backend loading"