Fix Jenkins translation jobs

The jobs keystone-propose-translation-update and
keystone-upstream-translation-update do not update from
transifex since our po files contain duplicate entries where obsolete
entries duplicate normal entries.

Remove all obsolete entries to fix the jobs.

NOTE: This is NOT a clean backport of the patch from master, but rather
this patch was generated similarly to the patch to master using
https://gist.github.com/dolph/9915293

Closes-Bug: #1299349

Change-Id: Ibbf26bb8158735a5dc57bff7d77a49e00239857c
Fix create_region_with_id raise 500 Error bug

1. add sql.handle_conflicts wrapper in sql backend driver.
2. check duplicate region id in kvs backend driver.
3. add 2 test cases to check exception.Conflict when create duplicate id region.

Closes-Bug: #1283904

Change-Id: Icfc5edf661501a5c134f324a76824812dbda2760
Sanitizes authentication methods received in requests.

When a user authenticates against Identity V3 API, he can specify
multiple authentication methods. This patch removes duplicates, which
could have been used to achieve DoS attacks.

Change-Id: Iec9a1875a4ff6e2fac0fb2c3db6f3ce34a5dfd1d
Closes-Bug: 1300274
Merge "Fix create_region_with_id raise 500 Error bug" into milestone-proposed
Sync from oslo db.sqlalchemy.migration

Sync the updated migration module to prevent errors on non-utf8
migrate_version and alembic_version tables (not controlled by the
schema migration directory).

Change from oslo commits:
[2fd457bf2cc] Ignore migrate versioning tables in utf8 sanity check

Change-Id: I6aef126b8d09c7a44f3815c4143ef1d4e5463426
Closes-Bug: #1301036
Merge "Sanitizes authentication methods received in requests." into milestone-proposed
Merge "Sync from oslo db.sqlalchemy.migration" into milestone-proposed
For ldap, API wrongly reports user is in group

When the ldap identity backend is configured,
HEAD v3/groups/​{group_id}​/users/​{user_id}
always returns 200, even if the user is not actually in the group.
This is because the sql and kvs backend will raise NotFound
exception if the user is not in the group, but the ldap backend
just return result.

Change-Id: Ie1585c8aebe054091bd76fded666bf41125ff9ca
Closes-Bug: 1245247
Keystone doesn't use pam

The requirements.txt file had pam, but Keystone doesn't use pam.

Change-Id: Ib617146d4ec75532f994ae85837ecbf383647306
Merge "Keystone doesn't use pam" into milestone-proposed
Remove legacy_endpoint_id and enabled from service catalog

Those two fields are for internal use, and should not be in the token.

The token size was expanding past the threshold where it could
be passed between a wsgi process and Apache HTTPD, even for
a basic, devstack sized catalog.  This reduces the size.

Change-Id: Ic8eb70e519a8a35fd05b497d917f9889e82b6e7f
Closes-Bug: 1302075
Fix invalid LDAP filter for user ID with comma

The Keystone server would respond with a 500 error when configured
to use the LDAP identity backend and a request is made to get a
token for a user that has an ID with a comma. The response is like:

 Authorization Failed: An unexpected error prevented the server from
 fulfilling your request. {'desc': 'Bad search filter'} (HTTP 500)

This is because the user DN wasn't properly escaped in the filter
for the query to get the groups that the user is a member of.

Closes-Bug: #1302106

Change-Id: Ib4886e66af0e979fcf23a84bcd51b07034547cb9
Updated from global requirements

Change-Id: I009a6494637c2daaae7a08e8ed3c6bf13155ead6
Merge "Fix invalid LDAP filter for user ID with comma" into milestone-proposed
Opening stable/icehouse

Bump version to next stable release on icehouse branch, and set
defaultbranch in .gitreview for convenience.

Change-Id: I64f11ddbb5fb28ec6cbeb55f672f7eae0c56d38d
Treat LDAP attribute names as case-insensitive

LDAP attribute names are case-insensitive, and different LDAP
server implementations behave differently when returning search
results.  Keystone attempts to use the attribute names as defined
in the mapping configuration when checking for values in the dict
that represents the search results.  If the case doesn't match,
we won't find the values which can lead to errors.

This patch converts the dictionary keys to lowercase to allow us
to perform a case-insensitive lookup when processing LDAP search
results.  When we create the model object, we still use the
attribute name case as defined in the mapping to allow predictable
lookups when we process the model object later.

Change-Id: Ib9a03b912bc7652dc6a61b1c97a950e263a9c6fa
Closes-bug: 1281216
(cherry picked from commit 7c104e13fce919dd2563f06ce31c059f145beb77)
Allow any attributes in mapping and include in results

When using attribute mapping (e.g., user_additional_attribute_mapping), any
attributes that Keystone didn't know about were ignored and a warning was
issued, like

 WARNING keystone.common.ldap.core [-] Invalid additional attribute mapping:
 "description:description". Value "description" must use one of password,
 enabled, default_project_id, name, email.

This check is removed. Additional attribute mappings for "unexpected"
attributes (such as description) should be allowed. For one thing, all the
known attributes already have a way of setting the mapping, via the
user_*_attribute config option. This will allow setting a "description" or
any other attribute mapping for users.

The extra attributes defined in the *_additional_attribute_mapping config
options weren't included in the list results. These attributes should be
included in the list results.

This is a combination of 3 commits from master:
(cherry picked from commit 17db03164200f0d7fff564058fc7df8e97705523)
(cherry picked from commit 10051adace7cd728d46cd4c999e3019fdbf2d961)
(cherry picked from commit ebfdab034f2b35074f1645b70c1f07d0c4dfd337)

Change-Id: Ia80174063a5eacdef690ca378b7cb71300a5f5f8
Closes-Bug: #1293698
Removed duplication with list_user_ids_for_project

Keystone list_user_ids_for_project has the possibility of returning
duplicate users if the user has more than one role in the project.
list_user_ids_for_project queries the assignment table which has
one entry for every role the user has but will now remove
duplicate combinations of target_id and actor_id. This impacts
V2 calls for tenants.list_users(<tenant_id>) and
users.list(tenant_id=<tenant_id>).

Change-Id: I9a1e5b944c2c627138851976e81d405f54fae1c9
Closes-Bug: #1308218
(cherry picked from commit d6cb7043cb47f5e73b61635af596736314441275)
Updated from global requirements

Change-Id: Ieea9cc5b41ac787fe9b1378f0df2f5c43ad4e6a9
SQL and LDAP fixes for get_roles_for_user_and_project user=group ID

When there was a role assigned to a group with the same ID as a user,
the SQL and LDAP assignment backends would incorrectly return the
assignment to the group when requesting roles for the user via the
get_roles_for_user_and_project method.

With this change, assignments to a group with the same ID are not
returned for the user when calling get_roles_for_user_and_project.

Functions were added to compare DNs more accurately based on the
LDAP RFCs.

The fakeldap code was changed to normalize the values when
comparing values for checking if the values match the filter.

Co-Authored By: Nathan Kinder <nkinder@redhat.com>
Co-Authored By: Adam Young <ayoung@redhat.com>

Change-Id: Id3d6f66c995e65e37d909359420d71ecdde86b69
Closes-Bug: #1309228