Set default token provider to UUID

This changes the default token provider to UUID, which affords a much
better deployer experience (no external dependencies and no additional
setup complexity) for deployers. It also provides a better end-user
experience (smaller, more manageable tokens) and appears to be the more
popular deployment option today, despite the current default to PKI.

DocImpact
Closes-Bug: 1350000

Change-Id: I7fb2b191cce7a9762c33fee09e7e8d48a71a297b
Remove trailing space in tox.ini

Change-Id: Ic523b92861ee1264b29cd12ece3fe12c177eed3f
JSON Home data is required

For the initial implementation, the JSON Home data was optional. Now
that JSON Home is implemented, JSON Home data is required.

bp json-home

Change-Id: I5af70401fba892166cd107264e9d5eafe6bcbd03
Spelling errors fixed in the comments

Change-Id: I68abed3cbc0846a75d723ed7ca69c26d5903b446
General logging cleanup in keystone.notifications

There was an error message that wasn't translated.

Related-Bug: #1363704

Change-Id: Icdc21029c62e2b4b7fcb9b6853eac165175fe96a
Fix logging config twice

The config was being logged twice, once from keystone-all and once
from keystone.openstack.common.service. The logging done by
keystone-all is removed.

Change-Id: I7af03fb9db819b0ee21953988271c42ec8aa3c7a
Closes-Bug: #1363709
trustor_user_id not available in v2 trust token

The trust information in the v2 token is missing the trustor_user_id
and impersonation values. This means you are unable to tell who gave
you the trust.

Change-Id: I7ed215b3353079d8ed9514c586d256c1226a2c19
Closes-bug: #1331882
DocImpact
Create SAML generation route and controller

In order to take advantage of the new SAML generation code, we
need to create a route and controller in OS-FEDERATION.

corresponding api spec: https://review.openstack.org/#/c/113998/

Implements: bp keystone-to-keystone-federation

Change-Id: Ib27921fa1fcff8760836e065ede1e90d1330fd16
IdP SAML Metadata generator

Keystone acting as a SAML2 Identity Provider needs to be able to
generate and expose metadata that is consumed by federated
Service Providers.

Co-Authored-By: Steve Martinelli <stevemar@ca.ibm.com>
Change-Id: I9e4b2f068a8190215749b95f31d634eb09c1e3f1
Implements: bp keystone-to-keystone-federation
Generate IdP Metadata with keystone-manage.

For proper federation setup, an Identity Provider peer needs to
generate metadata that can later be consumed by a federated Service
Provider. Since metadata content doesn't change very often it's
advised to generate a static file and later read its content on demand
(this is out of the scope of this patch). This patch adds required
functionality for utilizing the federation.idp.MetadataGenerator class
from a keystone-manage command line tool. Generated metadata will
be redirected to the stdout.

Change-Id: Ifed1f4e4ede0276b3aba22aa9e236e5e74e2ed93
Implements: bp keystone-to-keystone-federation
Routes for Keystone-IdP metadata endpoint

Keystone acting as an Identity Provider should expose an endpoint
where federated peers can access its SAML2 Metadata file.

API spec: https://review.openstack.org/#/c/118074/

Change-Id: I94d26ce88d2468af71bc1c9d1cba1b422da4480e
Implements: bp keystone-to-keystone-federation
Fix minor nits for token2saml generation.

bknudson left few (mostly) minor comments on the token2saml patch.
This commit addresses them.

Change-Id: I755e4a064d5ada1215e82f143914af1bd1cfcd9d
Implements: bp keystone-to-keystone-federation
warn against sorting requirements

Change-Id: I64ae9191863564e278a35d42ec9cd743a233028e
Closes-Bug: 1365061
Add docs for enabling endpoint policy

Add documentation on how to enable endpoint policy, and link it
back to the configuration section of the Identity API.

Change-Id: I7bc895292462714a5dcc2624a22df94b1db9138f
Update the federation configuration docs for saml2

Since 'Re-engineered Federation' has merged, we should update the
configuration docs accordingly. We want to expose the mapped
class.

Change-Id: I8c53f7a3da4bdfb563f43cd0eefdf9d66fc57753
Work toward Python 3.4 support and testing

Change-Id: I8d4950000f4c4d0bbc06c8eda78589c40988e5fc
Add test for single app loaded version response

There was no test that showed what the version response is when
only a single application (public or admin) is loaded.

The test shows that the response is incorrect for the admin
application.

Change-Id: I1fb1789c465d3f587077e3817a8eb2da54e28c63
Partial-Bug: #1343579
Fix admin server doesn't report v2 support in Apache httpd

The Keystone server version response would only include v3 when
Keystone was running in Apache httpd. It should have also included
the v2.

Change-Id: Ib471539beda746d085adae1e72ab0dc1e0fb41e0
Closes-Bug: #1343579
use one indentation style

There are two (or three, depending on how you count) indentations styles
mixed together in this one logical line of code, which are further mixed
with two methods of closing parens and curly braces.

Besides being difficult to read, the mixture resulted in an off-by-one
error that isn't caught by the version of hacking that Jenkins is using,
but is caught by the latest.

Change-Id: Idab3c80c720e0bfd5741dc9e07f841b5ac270960
Closes-Bug: 1363019
Fixed spelling mistakes in comments.

Change-Id: I9b17bcee430c94993c20a74fbd774547d04dc189