Add unit tests for disabled endpoints in catalog

There were no tests that show how disabled endpoints are dealt
with in the catalog backend or when getting or validating a
token.

Change-Id: I42ba07e2e7a9c95469b3f2a741a809756cda9361
Related-Bug: #1273867
Fix include only enabled endpoints in catalog

The server was returning disabled endpoints in the catalog for a
token response. The server should not return disabled endpoints
in the catalog.

Change-Id: Ibaa54eb827846a613fe8c9eced6ae79a8abbfff2
Partial-Bug: #1273867
trust creation allowed with empty roles list

The docs state "A project_id may not be specified without at least
one role, and vice versa.", however /OS-TRUST/trusts does allow you
to create a trust with an empty roles list and project_id specified.

This results in 401 responses whenever you try to consume the trust,
because there are no roles for the trustee on the authorized project.

This patch will add a check in trust creation to ensure at least one
role exists if project_id is supplied.

Change-Id: Iebad0b6b7ed62a029d1e50afb003679bafb1655d
Closes-Bug: #1214064
Fix db_version failed with wrong arguments

The `keystone-manage db_version` command was failing with an error
like

 TypeError: db_version() takes exactly 2 arguments (1 given)

This is because an engine wasn't being passed to db_version().

Change-Id: I20b4cb10f9c83fc672de2838bac8236938b92e32
Closes-Bug: #1284341
remove hardcoded SQL queries in tests

There are several occurrences of hardcoded SQL queries in tests.
Due to variations in databases these queries might not work all
the time, and should be replaced by queries built with sqlalchemy.

Change-Id: Id0198ea03087ab4acc7eebf0e4d12a37e3437382
Closes-Bug: #1287637
Use class attribute to represent 'user' and 'group'

When sending a notification a resource_type is required, such as a user
or project. This value is always consistent between the different
notifications.created, updated, deleted methods, so make it a class
attribute.

Change-Id: I084fedb1d8f0c1b1d7db575860d96ff2e5a27647
Update sample config

The sample config file was out of date, generated with

 $ tox -r -e sample_config

Change-Id: I51e0b35f21fc27edb8376310214d79afcb40cd77
Remove unnecessary oauth1.Manager constructions

There's an oauth1.Manager kept in the global dependency that's
created when the oauth1 extension is loaded due to being in the
paste pipeline, so there's no need to create more of them.

Closes-Bug: #1291705
Change-Id: I78e19e3b165b4cd503e2da6a135daa54e98de599
Updated from global requirements

Change-Id: I1733a270d488b807183c6ff29226a93fd994e741
Merge "Add unit tests for disabled endpoints in catalog"
Merge "Fix include only enabled endpoints in catalog"
Do not use keystone.conf.sample in tests

The keystone.conf.sample file has no values set in it (anymore)
and therefore should not be loaded by the test cases. The one
exception to this rule is the ConfigTestCase as the config file
is used in one of the code paths to determine paste-ini location.

Change-Id: I6b9dbe160c5ffe26971320a29f933018ac0486c2
Merge "Remove unnecessary oauth1.Manager constructions"
Merge "Updated from global requirements"
Merge "Fix db_version failed with wrong arguments"
Merge "remove hardcoded SQL queries in tests"
Sync db, db.sqlalchemy from oslo-incubator 0a3436f

This change sync's oslo-incubator's db module from commit hash
0a3436fbcd69b7e0cd1a768be15cbf794c803e3b

$ python update.py --nodeps --base keystone \
    --dest-dir ../keystone \
    --modules db,db.sqlalchemy

This includes a fix where the keystone server would log a warning
that starts with

  This application has not enabled MySQL traditional mode ...

This change includes the following commits from oslo-incubator:

a1a8280 Fix excessive logging from db.sqlalchemy.session
dc2d829 Add lockutils fixture to OpportunisticTestCase
d10f871 Adapt DB provisioning code for CI requirements
5920bed Make db utils importable without migrate
9933bdd Get mysql_sql_mode parameter from config
96a2217 Prevent incorrect usage of _wrap_db_error()
20a7510 Add from_config() method to EngineFacade
fea119e Drop special case for MySQL traditional mode, update unit tests
a584166 Make TRADITIONAL the default SQL mode
5b9e9f4 Fix doc build errors in db.sqlalchemy

The above list was generated by doing the following in oslo-incubator:

 $ git log --oneline --no-merges \
     6ba44fd..0a3436fbcd69b7e0cd1a768be15cbf794c803e3b \
     openstack/common/db/ openstack/common/db/sqlalchemy

The keystone log shows that the last sync was 6ba44fd:

 $ git log -n1 --oneline --no-merges \
     keystone/openstack/common/db \
     keystone/openstack/common/db/sqlalchemy
 8f7b87b Sync db, db.sqlalchemy, gettextutils from oslo-incubator 6ba44fd

Closes-Bug: #1271706
Change-Id: If537ff5166b8e9a6fc18c570cdd2e44943faac9c
Merge "Update sample config"
Ensure v3policysample correctly limits domain_admin access

Recent changes tidied up the v3 sample policy, but unfortunately this
introduced a defect that meant a domain admin could create roles on
other domains.  In addition, in an attempt to simplify the policies,
these changes increased the risk of a user being able to spoof the
policy by using bogus url options. This patch fixes these issues.

Limitations:
- The current code + policy does not prevent a domain admin updating the
  domain_id of a user/group/project to some other domain.  Ideally we
  would prevent this via policy, but this requires an enhancement
  to our policy engine (to be be able to check for existance of a member
  in an object).  Such a change of domain_id is, with this patch, at
  least now benign - since if the user acting as domain admin does not
  have a role on the new domain, then there is nothing they can do. A
  separate bug (1291393) has been raised for this.

Closes-Bug: 1287219

Change-Id: I9d4380ac8586b2af0d7ba945ae5e38cc0d2adbd5
Don't automatically enable revocation events.

Cuts any direct imports of revoke.model as that
triggers the dependency registration.

In order to fix a dependecy resolution issue, changes the syncronziation to
using the same sort of chaching mechanism as the other drivers.

Adds the ability to Lazy activate providers for future or optional dependency
resolution.

Closes-Bug: 1291099
Related-Bug: 1292283
Change-Id: I0db36b295c2040ec1fb248cf75dc55c44c059211