Filter LDAP dumb member when listing role assignments

When the LDAP assignment driver is used and the "use_dumb_member"
configuration option is enabled, the dumb member is listed when
listing the role assignments. This can be seen by running the live
LDAP tests, as the "test_list_role_assignments_unfiltered" test will
fail due to the additional role assignments for the dumb member.

This patch filters out the LDAP dumb member when listing role
assignments.

Change-Id: I585d54847778f02621b8201644ec9285495a63aa
Closes-Bug: 1280965
Make LIVE Tests configurable with ENV

To enable ldap live test, set the environmental variable
``ENABLE_LDAP_LIVE_TESTS`` to a non-false value.

To enable tls ldap live test, set the environmental variable
``ENABLE_TLS_LDAP_LIVE_TESTS`` to a non-false value.

To enable mysql sql live test, set the environmental variable
``ENABLE_LIVE_MYSQL_TESTS`` to a non-false value.

To enable postgres sql live test, set the environmental variable
``ENABLE_LIVE_POSTGRES_TESTS`` to a non-false value.

To enable db2 sql live test, set the environmental variable
``ENABLE_LIVE_DB2_TESTS`` to a non-false value.

This allows for running all tests in a standard run by simply setting
the appropriate environmental variables.

This moves the live tests to be skips if the specific live-test
environmental variables are not set.

Change-Id: I8c09a8dcfca3f9691306c5f416f688205171bda3
Closes-Bug: 1243392
Rename scope_to_bad_project() to test_scope_to_bad_project().

In class test_v3_federation.FederatedTokenTests rename method
scope_to_bad_project() to test_scope_to_bad_project() and make
tox launch it automatically.

Change-Id: Id5cbc9843eae122b4e1709ace494bf05e467f116
Closes-Bug: #1294393
Use oslo db.sqlalchemy.session.EngineFacade.from_config

Rather than passing the CONF dict to EngineFacade, Keystone can
use the new from_config factory function.

Change-Id: I60f30254431b512988a0f1811b3c119207b91ad7
Do not expose internal data on UnexpectedError

UnexpectedError now works much-more akin to SecurityError and
obscures internal data from being leaked unless running in debug
mode.

Change-Id: I8c8895f5c9db9f51dec014da24f7e86d607d0363
Closes-Bug: #1291047
Make domain_id immutable by default

We already allow the domain_id in User, Group and Project entities
to be made immutable by use of a config option.  By default, however,
the domain_id is mutable.

This patch switches this so that the domain_id is immutable by default.
Although this changes existing functionality, it is felt that since
nearly all non-trivial production implementations that use domains
are going to want to restrict domain admin personas with a suitable
policy file, leaving the domain_id mutable by default represents a
potential vunerability that could be exploited.

Closes-Bug: 1294293

Change-Id: I0cb9fd4dc520d0a15bf54f4d138a3794d0ccd1d9
Store groups ids objects list in the OS-FEDERATION object.

When issuing unscoped federated token store groups ids
object in the OS-FEDERATION objects instead of standalone
OS-FEDERATION:groups.

Change-Id: I116466c6eefae674d2245796dfd608b12d5d3e6d
Closes-Bug: #1294150
Merge "Rename scope_to_bad_project() to test_scope_to_bad_project()."
Merge "Make LIVE Tests configurable with ENV"
Add user_id when calling populate_roles_for_groups

The call to _populate_roles_for_groups was missing the user_id,
and was always defaulted to None.

closes bug: #1294781

Change-Id: Ic78c66a1cbd0a32630f7247f0176ced2de352921
Ability to turn off ldap referral chasing

When getting an ldap connection, check a config property to see if
referral chasing should be turned off.

Co-Authored-By: Dolph Mathews <dolph.mathews@gmail.com>
Change-Id: I3bb5cc11b3c5c9108cfa656d5f5de1eaeb103fe5
Closes-Bug: 1233365
Uses generator expressions instead of filter

Change-Id: I3685a8ecb4d34258e44a1480c4f78aaaf4dca27c
Implements: bp keystone-py3kcompat
Merge "Store groups ids objects list in the OS-FEDERATION object."
Merge "Ability to turn off ldap referral chasing"
Merge "Add user_id when calling populate_roles_for_groups"
Comparisons should account for instantaneous test execution

The comparisons for the Revoke tests were greater than or less than, but if the test
did not take a full clock tick, the values could be equal.

Closes-Bug: 1295261

Change-Id: I7526640c283f13a4e4ed4f0b0ebd059bbe38ad9b
expires_at should be in a tuple not turned into one

Change-Id: I273ed2cd984f1e69cc595169a59647c76a8ca202
explicitly import gettext function

Change-Id: I2cdcbc82542c61a6d1aa9ba0d12f874589190001
Closes-Bug: 1294971
Merge "Comparisons should account for instantaneous test execution"
Merge "expires_at should be in a tuple not turned into one"