Configurable python-keystoneclient repo

The URL for the python-keystoneclient repo couldn't be configured.
With this change, the user can set the OPENSTACK_REPO environment
variable to set the URL for where the python-keystoneclient repo
should be cloned from. So for example you can use a local clone.
The default OPENSTACK_REPO is https://git.openstack.org/openstack
which gets python-keystoneclient.git added ot it to make the clone
come from
https://git.openstack.org/openstack/python-keystoneclient.git.

Change-Id: I936713af3c11e8d68d8739dc68eefabd645df294
Issue multiple SQL statements in separate engine.execute() calls

Some sqlalchemy drivers (eg: mysqlconnector) don't support
engine.execute("sql stmt 1; sql stmt 2;") and require a separate
execute() call for each SQL statement.  After discussions with
sqlalchemy author, he confirmed it would be better to fix callers rather
than attempt to patch in support for multiple statements.

With this fix, keystone-manage db_sync succeeds using mysqlconnector.

Change-Id: I658a4dd479dbdcd07345c97d810c85aada3fa35b
Filter List Regions by 'parent_region_id'

List Regions (GET /regions) has an optional query parameter
'parent_region_id', but the API still returns all the regions.

This fix adds support of filtering regions by an optional query
parameter 'parent_region_id'.

Closes-Bug: #1350192

Change-Id: I59f8d852870bd3ad26622bfcd00dfadfdf9d5b42
Enhance V3 router class for resources

RESTful APIs are resource-oriented, and Keystone provides a
RESTful API, but the current way that routes are being mapped is
based on URLs rather than resources. With this change, the base
Routers class is enhanced to support a resource-oriented way to
map paths to controllers and methods.

bp json-home

Change-Id: I0ba856845116b3ddd3dfed4608be65a87d9c01dc
Change V3 router classes to use resources

The V3 router classes are changed to use the resource-oriented
method to map paths.

bp json-home

Change-Id: I81957c5b2fc41d6f46e4913afa1073c58a040c45
V3 Extension class

There was no base class specific to V3 extensions. This adds a base
class for V3 extensions and also changes the current V3 extensions
to use it.

bp json-home

Change-Id: I9a65867ced1bc116e3395baf4abfa35796511788
Enhance V3 extension class to use resources

RESTful APIs are resource-oriented, and the V3 extensions each
provide a RESTful API, but the current way that extensions map their
routes is based on URLs rather than resources. With this change, the
base V3 extensions class is enhanced to support a resource-oriented
way to map paths to controllers and methods.

bp json-home

Change-Id: Ic82fc9d03b0073a8a1fcec5d03529c84e22f4d69
Change V3 extensions to use resources

The V3 extension classes are changed to use the resource-oriented
method to map paths.

bp json-home

Change-Id: I4286f0affee7570b509c215f3375b2a517a5af4f
Allow LDAP lock attributes to be used as enable attributes

Some LDAP servers support disabling accounts via a boolean "lock"
attribute. For these servers, a value in LDAP of "True" means that
the account is locked, while a value of "False" means the account
is active. When the "user_enabled_mask" and "user_enabled_emulation"
options are not in use, Keystone currently expects a boolean
"enabled" attribute where "True" means the account is enabled and
"False" means the account is disabled.

To support LDAP account lock attributes, we need a way to tell
Keystone that the boolean values from LDAP are inverted. This
adds a new "user_enabled_invert" setting that allows the enabled
boolean logic to be inverted in the resource (LDAP), while leaving
the logic as-is in the model (Keystone user object).  The existing
default behavior remains as-is.

DocImpact
Change-Id: I2a89d4b98c854e68e1bb10f53b8b29d92f945f60
Closes-bug: #1337029
Remove assignment controller dependency on token_api

The assignment controller now uses the `validate_token` method on
the `token_provider_api` instead of referencing `get_token` directly
from the token persistence service.

The user_crud contrib (v2.0) extension now will emit an actual
token to the wire instead of the raw-internal data structure from
the token persistence backend. The intent here was clear by the
fact that the structure was built to look like a v2.0 token,
however, it was retriving the data from the persistence backend
and just updating the token_id then resaving the data before
emitting the raw persistence data (incorrect). The extension
now uses the issue_v2_token method from the token_provider_api.

This change is to ensure interactions with the token persitence
are consistent so that it is possible to support toggling
persistence of tokens.

Change-Id: I22b6b837731566bfd4dc61a47eec2eb0d336d4d1
bp: non-persistent-tokens
Expose token revocation list via token_provider_api

Use the token_provider_api for the token revocation list instead
of directly accessing the token persistence service.

Tests have been updated to compare results from the token_api
and the token_provider_api for the revoked token list.

This change is to ensure interactions with the token persitence
are consistent so that it is possible to support toggling
persistence of tokens.

Change-Id: Ic3982329dd28db5b2f974fadbab6c5e010365d27
bp: non-persistent-tokens
Remove ec2 contrib dependency on token_api

The ec2 contrib extension now utilizes the `validate_token` method
from the `token_provider_api` instead of directly referencing the
token persistence service.

This change is to ensure interactions with the token persistence
are consistent so that it is possible to support toggling
persistence of tokens.

Change-Id: Iad6c13d027fffdb23497f22b29a9ce6d5009f158
bp: non-persistent-tokens
add i18n to lxml error

This tweaks the error message to be a complete sentence, which should
make translation easier, and wraps the message in a gettext call.

Change-Id: Ic240d4bbc7f03df4b9c76e642be3779341519c1c
Keystone service throws error on receiving SIGHUP

This patch resolves following erorrs:
1. AttributeError: 'Server' object has no attribute 'reset'.
2. error: [Errno 9] Bad file descriptor
3. Can't dup an SSL object

When the SIGHUP signal is received by the service launcher in
common service framework, it calls the server's reset method.
As reset method is not present in Sever class of
keystone.common.environment.eventlet_server module, it raises
AttributeError: 'Server' object has no attribute 'reset'.

After adding reset method when SIGHUP signal is sent to service
parent process, it stops the service and then calls service start
method again. When it stops the service, it kills the eventlet
thread, which internally closes the wsgi server socket object.
This server socket object is now not usable again and it throws
following error, while restarting the service:

error: [Errno 9] Bad file descriptor

To resolve 'Bad file descriptor' error, creating duplicate
socket object, every time service starts.

As SSL object can not be duplicated, creating duplicate
socket object before converting a regular socket into an
SSL socket.

Closes-Bug: #1337850
Change-Id: I52caacc01a94428e4986ef68d032ad317e09b276
Support the hints mechanism in list_credentials()

This fix implements the hints mechanism, considering filters as hints,
so the particular backend implementation has an option to process or
ignore it. Since the EC2 credentials code calls list_credentials() with
user_id as a param, a separate method list_credentials_for_user has been
introduced to provide the compatibility while support the standard hints
mechanism in list_credentials().

This fix doesn't plug hints into the controller, it prepares the way for
implementation of the bp filter-credentials-by-user to support filtering
credentials by user in a follow on patch.

Closes-Bug: #1353511

Change-Id: Ibcf59aa45a8fc7e5cc66fd4edb91ae8fdc641d93
Clean whitespace off token.

A bogus, non-visible character may be appended to the token.
If it is, the hash will not match the original, and the token
will be incorrectly reported as invalid.

Change-Id: I7b2c831b85818a8c07616f44c1d501701c9d72f8
Closes-Bug: 1354765
Merge "Expose token revocation list via token_provider_api"
Merge "Remove ec2 contrib dependency on token_api"
remove unused import

Change-Id: I1e6e8bf558990db8025326b679bf72aa957bd446
Merge "Enhance V3 router class for resources"