Adds support for username to match the v2 spec

The v2.0 API spec uses username for the user's name, whereas the v3 API
just uses name. The v2.0 implementaion incorrectly used name instead of
username, but did allow a username to be specified and stored in the
extras.

This patch makes the implementation more closely conform to the API
without breaking backward compatibility. Anyone using name in the v2.0
API can continue to do so. They can even specify a username that will
still get stored in the extras. Users can now use the documented
username instead of name and the API will work for them as well.

Both name and username will always be returned for the v2 API calls.

DocImpact
Change-Id: Ia95aa5d442a8311925399fa59e5022d31f68d374
Closes-Bug: #1214686
Sync several modules from oslo-incubator

This change syncronizes excutils,lockutils,log, and
db.sqlalchemy.session modules from oslo-incubator
commit 19e0a51204df247dc38de880d08e6d66e89e6572 .

 $ python update.py --nodeps --base keystone --dest-dir ../keystone \
     --modules  excutils,lockutils,log,db.sqlalchemy.session

This includes fixes for 2 problems:

"keystone=INFO" was in the default_log_levels. This made it
more difficult than necessary to debug the Keystone server,
since you can set debug=True but then the keystone logging
level is overridden and you get no debug output for keystone.

"keystone=INFO" may have been in the default_log_levels because
of the auth_token middleware, but this has been moved to
python-keystoneclient now and the logging config for the
python APIs is done differently.

Closes-Bug: 1245629

Also, fixes some warnings and errors when docs are generated.

Change-Id: I53868bef975f73b4aee35695b6387b718c4179f9
Clean up docstrings in contrib.oauth1.core

The docstrings were using the wrong parameter name.

Change-Id: I237b2b137fa8c8f6138a4a7eacf6140843517225
Merge db.sqlalchemy from oslo-incubator af5f710

The db.sqlalchemy module was not recent with oslo-incubator.

 $ git checkout af5f71096c7bb83fe2f956588a9ec643b0d9a2f6
 $ python update.py --nodeps --base keystone \
   --dest-dir ../keystone --modules db.sqlalchemy

The af5f710 oslo-incubator db.sqlalchemy contains a fix for the
following problem, which caused a regression in Keystone:

The database connection string was not marked as secret, so it
would be printed out in cleartext in the logs when config settings
were logged.

The database connection string typically contains the password
that's used to connect to the database, so it should be marked as
secret so that it doesn't get logged.

Change-Id: Ibdc63480a836646c5571a368f3c3a1d0c82d6aba
Closes-Bug: #1266590
Safe command handling for openssl

The openssl command line was passed to exec() as a string with
no attempt at escaping. This could lead to odd results if someone
configured their system with a space in the filename of a key.

The fix is to pass the command to exec() safely, as a list.

Change-Id: I4faa2b66f79bf6ffddabf4a0f0b407ce9afa72d2
derive custom exceptions directly from Exception

Although StandardError derives from Exception, the python docs for
Exception read:

    All user-defined exceptions should also be derived from this class.

http://docs.python.org/2/library/exceptions.html#exceptions.Exception

Change-Id: If0f009cd0ad5a30329f0f97d869137aeef66af23
Enable lazy translation

This change makes it so that if the user makes a request with an
Accept-Language header and the response is an error where the
message is translatable, then the message will be translated to
the requested language (or the most appropriate language
available).

completes bp user-locale-api

Change-Id: I5b0b02e0459a6a444baa12f8722adb829b7e152b
Sync with global requirements

Change-Id: Ibdd73aa142be103d285ce0f15701dc96c1ec34ae
rename templated.TemplatedCatalog to templated.Catalog

This addresses a long standing TODO for consistency across catalog
drivers, making it more intuitive to switch drivers.

UpgradeImpact

Change-Id: I109513695e60867d1111795ab958a3cc4240e831
Enhance tests for non-default default_domain_id

There were no tests that show what happens when the
default_domain_id is changed from the default. The new tests show
that in some cases the behavior is incorrect, and in other cases
it is correct.

Change-Id: Ia167e153f488617f94afce7fddfc52e1e2c8e79c
Related-Bug: #1265108
Remove unused member from KVS assignment

The KVS assignment backend's _get_user_by_name method was not used.
This change removes it.

Change-Id: I357adf745095b2ac868c3c6eb78e4ab6db2ca0fc
KVS support domain as namespace for users

The KVS identity backend didn't support having users with the
same name in different domains.

Change-Id: I4f6a9010ed085aef9cba5f368e292dd28339a0fa
Related-bug: #1265108
Enhance auth tests for non-default default_domain_id

There wasn't an authentication test that showed what happens when
the default_domain_id option is changed from the default. The new
tests show that the behavior is incorrect.

This test is split out because it uses a new feature of the KVS
backend to allow adding users with the same name in different
domains, because I don't think we'll backport that change.

Change-Id: I890a1c798d7f4a8a345404cd7754708ab0d36651
Related-Bug: #1265108
Fix using non-default default_domain_id

Changing the default_domain_id to something other than the
default would cause several operations to not work correctly.
This is because the value of default_domain_id was read and
cached in several parts on import, which is before the call to
CONF() so the cached value is the original default ('default')
rather than the value that the operator has in the config file.

This change removes the cached default_domain_id and instead
reads the value when it's needed at runtime so that the
user-configured value is used instead of the original default.

Change-Id: I9543e2108866ed66000d75f868bbd2b1ed978b97
Closes-Bug: #1265108
remove unused LOG

Change-Id: I5dec1b23667c7226697f064fe793c556c71e3abe
Drop unsused "extras" dependency

Change-Id: I9264d983f809fafa249536f1b321ee1db02aad4d
description is wrong in endpoint filter rst doc

Literal block must start and end with blank line.

Change-Id: Ib80bc76101da34b8251d731cee5b60bde45ec099
Closes-Bug: #1269300
Update comments in test_v3_protection.py

Updated some comments that were not anymore up do date.

Change-Id: I388ccb69762dd1bf8a41a8061bab5380eb06dbbc
Move KDS paths file

Paths are really only needed for testing so they should live in the
testing directory rather that in the application code.

We don't really need the paths we had as they are used for static
directories and template directories, neither of which are used.

Change-Id: I14aa5e332e7df2b21311fe369a1f2706efee4cc3
Identity Providers CRUD operations

Implementation of CRUD operations for:

- Identity Providers
- Protocols used to authenticate remote users (SAML, OpenId, etc)

Change-Id: I0ce62e720e797718dbfde6bfcd4b22a213985867
Implements: blueprint identity-providers