trust creation allowed with empty roles list

The docs state "A project_id may not be specified without at least
one role, and vice versa.", however /OS-TRUST/trusts does allow you
to create a trust with an empty roles list and project_id specified.

This results in 401 responses whenever you try to consume the trust,
because there are no roles for the trustee on the authorized project.

This patch will add a check in trust creation to ensure at least one
role exists if project_id is supplied.

Change-Id: Iebad0b6b7ed62a029d1e50afb003679bafb1655d
Closes-Bug: #1214064
Use class attribute to represent 'user' and 'group'

When sending a notification a resource_type is required, such as a user
or project. This value is always consistent between the different
notifications.created, updated, deleted methods, so make it a class
attribute.

Change-Id: I084fedb1d8f0c1b1d7db575860d96ff2e5a27647
Update sample config

The sample config file was out of date, generated with

 $ tox -r -e sample_config

Change-Id: I51e0b35f21fc27edb8376310214d79afcb40cd77
Filter LDAP dumb member when listing role assignments

When the LDAP assignment driver is used and the "use_dumb_member"
configuration option is enabled, the dumb member is listed when
listing the role assignments. This can be seen by running the live
LDAP tests, as the "test_list_role_assignments_unfiltered" test will
fail due to the additional role assignments for the dumb member.

This patch filters out the LDAP dumb member when listing role
assignments.

Change-Id: I585d54847778f02621b8201644ec9285495a63aa
Closes-Bug: 1280965
Do not use keystone.conf.sample in tests

The keystone.conf.sample file has no values set in it (anymore)
and therefore should not be loaded by the test cases. The one
exception to this rule is the ConfigTestCase as the config file
is used in one of the code paths to determine paste-ini location.

Change-Id: I6b9dbe160c5ffe26971320a29f933018ac0486c2
Sync db, db.sqlalchemy from oslo-incubator 0a3436f

This change sync's oslo-incubator's db module from commit hash
0a3436fbcd69b7e0cd1a768be15cbf794c803e3b

$ python update.py --nodeps --base keystone \
    --dest-dir ../keystone \
    --modules db,db.sqlalchemy

This includes a fix where the keystone server would log a warning
that starts with

  This application has not enabled MySQL traditional mode ...

This change includes the following commits from oslo-incubator:

a1a8280 Fix excessive logging from db.sqlalchemy.session
dc2d829 Add lockutils fixture to OpportunisticTestCase
d10f871 Adapt DB provisioning code for CI requirements
5920bed Make db utils importable without migrate
9933bdd Get mysql_sql_mode parameter from config
96a2217 Prevent incorrect usage of _wrap_db_error()
20a7510 Add from_config() method to EngineFacade
fea119e Drop special case for MySQL traditional mode, update unit tests
a584166 Make TRADITIONAL the default SQL mode
5b9e9f4 Fix doc build errors in db.sqlalchemy

The above list was generated by doing the following in oslo-incubator:

 $ git log --oneline --no-merges \
     6ba44fd..0a3436fbcd69b7e0cd1a768be15cbf794c803e3b \
     openstack/common/db/ openstack/common/db/sqlalchemy

The keystone log shows that the last sync was 6ba44fd:

 $ git log -n1 --oneline --no-merges \
     keystone/openstack/common/db \
     keystone/openstack/common/db/sqlalchemy
 8f7b87b Sync db, db.sqlalchemy, gettextutils from oslo-incubator 6ba44fd

Closes-Bug: #1271706
Change-Id: If537ff5166b8e9a6fc18c570cdd2e44943faac9c
Merge "Update sample config"
Ensure v3policysample correctly limits domain_admin access

Recent changes tidied up the v3 sample policy, but unfortunately this
introduced a defect that meant a domain admin could create roles on
other domains.  In addition, in an attempt to simplify the policies,
these changes increased the risk of a user being able to spoof the
policy by using bogus url options. This patch fixes these issues.

Limitations:
- The current code + policy does not prevent a domain admin updating the
  domain_id of a user/group/project to some other domain.  Ideally we
  would prevent this via policy, but this requires an enhancement
  to our policy engine (to be be able to check for existance of a member
  in an object).  Such a change of domain_id is, with this patch, at
  least now benign - since if the user acting as domain admin does not
  have a role on the new domain, then there is nothing they can do. A
  separate bug (1291393) has been raised for this.

Closes-Bug: 1287219

Change-Id: I9d4380ac8586b2af0d7ba945ae5e38cc0d2adbd5
Don't automatically enable revocation events.

Cuts any direct imports of revoke.model as that
triggers the dependency registration.

In order to fix a dependecy resolution issue, changes the syncronziation to
using the same sort of chaching mechanism as the other drivers.

Adds the ability to Lazy activate providers for future or optional dependency
resolution.

Closes-Bug: 1291099
Related-Bug: 1292283
Change-Id: I0db36b295c2040ec1fb248cf75dc55c44c059211
Merge "Do not use keystone.conf.sample in tests"
Merge "Use class attribute to represent 'user' and 'group'"
Removal of test .conf files

The following configuration files used for testing purposes have
been migrated to use the configuration fixture instead of relying
on a mechanism to load a large number of configuration options
from various locations on disk.

    keystone/tests/auth_plugin_external_default_legacy.conf
    keystone/tests/auth_plugin_external_disabled.conf
    keystone/tests/auth_plugin_external_domain.conf
    keystone/tests/auth_plugin_external_domain_legacy.conf
    keystone/tests/backend_rules.conf
    keystone/tests/test_associate_project_endpoint_extension.conf
    keystone/tests/test_auth_plugin_by_class_name.conf
    keystone/tests/test_overrides.conf
    keystone/tests/test_pki_token_provider.conf
    keystone/tests/test_revoke_kvs.conf
    keystone/tests/test_revoke_sql.conf
    keystone/tests/test_uuid_token_provider.conf

The following configuration files have had a number of elements
extracted to be used within the config fixture instead of the
configuration files. Most of these files contain controls that
need to be overridden to test against alternative (non internal /
in-memory) "live" configurations.

   keystone/tests/backend_ldap.conf
   keystone/tests/backend_liveldap.conf
   keystone/tests/backend_multi_ldap_sql.conf
   keystone/tests/backend_sql.conf
   keystone/tests/backend_tls_liveldap.conf

This patchset also consolidates the setting of the default
[database] ``connection`` option so that it can be overridden
as needed for testing against non-sqlite database engines.

Change-Id: I996709546f713c36bf654c5aea64cbf3472ffef1
Move test .conf files to keystone/tests/config_files

Move the test configuration files to an isolated directory. This
allows for less clutter in the keystone/tests directory and keeps
the configuration data a bit more isolated from the test cases
themselves.

Change-Id: I054393b968824a0e3c31fd227d7b09e9c14c764b
Replace httplib.HTTPSConnection in ec2_token

httplib.HTTPSConnection is known to not verify SSL certificates in Python 2.x.
Implementation got adapted to make use of the requests module instead.

SSL Verification is from now on enabled by default.

Can be disabled via an additional introduced configuration option:

`keystone_ec2_insecure=True`

SecurityImpact
DocImpact
Partial-Bug: 1188189

Change-Id: Ie6a6620685995add56f38dc34c9a0a733558146a
Provide option to make domain_id immutable

Currently, a user, group or project entity can be moved between
domains by updating their domain_id. There are situations where
this is not desirable (and in fact could create a potential security
hole) - for example when creating a domain admin persona, using an
appropriate policy file (such as policy.v3cloudsample).

For backward compatibility, the option to make the domain_id immutable
is controlled by a config option, with the default being no change
to existing functionality.

Change-Id: Idd847f471beae7387d6cc59af0a960a923da799f
Closes-Bug: 1291393
Filter out nonstring environment variables before rules mapping.

Before the requests environment is passed to the RuleProcessor, all
parameters that are not inheriting from the basestring type should
be filtered out.

Change-Id: I469107633abfa86232e1dc1f1bc64605cd888dc2
Closes-bug: #1291981
Merge "Don't automatically enable revocation events."
Make LIVE Tests configurable with ENV

To enable ldap live test, set the environmental variable
``ENABLE_LDAP_LIVE_TESTS`` to a non-false value.

To enable tls ldap live test, set the environmental variable
``ENABLE_TLS_LDAP_LIVE_TESTS`` to a non-false value.

To enable mysql sql live test, set the environmental variable
``ENABLE_LIVE_MYSQL_TESTS`` to a non-false value.

To enable postgres sql live test, set the environmental variable
``ENABLE_LIVE_POSTGRES_TESTS`` to a non-false value.

To enable db2 sql live test, set the environmental variable
``ENABLE_LIVE_DB2_TESTS`` to a non-false value.

This allows for running all tests in a standard run by simply setting
the appropriate environmental variables.

This moves the live tests to be skips if the specific live-test
environmental variables are not set.

Change-Id: I8c09a8dcfca3f9691306c5f416f688205171bda3
Closes-Bug: 1243392
Merge "Replace httplib.HTTPSConnection in ec2_token"
Merge "Sync db, db.sqlalchemy from oslo-incubator 0a3436f"